[LOGICIEL] [resolu] infecté!

nicolasdi28 · le 19 août 2007

bonjour

mon systeme ralentit et j'ai quelques virus sur mon ordi....

j'ai telechargé le virus msn avec l'image msn est ce vous sur cette photo grace a mon frere....

j'ai utilisé msnfix et bitdefender

voila ce que ca donne:

//-----------------------------------------------------------------

//

// Product BitDefender Free Edition v10

// Product 10.2

//

// Created on: 19/08/2007 22:49:06

//

//-----------------------------------------------------------------

Virus Statistics

Scan path : C:\

D:\

Folders : 5116

Files : 165905

Memory processes scanned : 39

Archives : 1155

Runtime packers : 8341

Identified viruses : 9

Infected files : 10

Memory processes infected : 0

Suspect files : 0

Warnings : 0

Disinfected files : 0

Deleted files : 0

Moved files : 5

I/O errors : 33

Scan time : 01:01:21

Scan speed (files/sec) : 45

Spyware Statistics

Registry keys scanned : 1765

Registry keys infected : 0

Cookies scanned : 41

Cookies infected : 0

Spyware files infected : 0

Spyware threats detected : 0

Virus definitions : 805201

Scan plugins : 16

Archive plugins : 40

Unpack plugins : 6

Mail plugins : 6

System plugins : 5

Virus scan options

Detection

[X] Scan boot sectors

[X] Memory Processes

[X] Scan archives

[X] Scan runtime packers

[X] Scan email

File mask

[ ] Programs

[X] All files

[ ] User defined extensions:

[ ] Exclude extensions: ;

Action

Infected objects

[ ] Ignore

[X] Disinfect

[ ] Delete

[ ] Move to quarantine

[ ] Prompt user

Second action

[ ] Ignore

[ ] Delete

[X] Move to quarantine

[ ] Prompt user

Virus scan options

[X] Enable warnings

[X] Enable heuristics

[ ] Show all files in log

[X] Report file: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1187556546.log

Spyware scan options

[X] Scan for riskware

[ ] Skip dial and applications from scan

[X] Registry keys

[X] Cookies

Summary:

<System>=>C:\Program Files\Save\Save.exe (disk) Detected: Adware.Whenu.I

<System>=>C:\Program Files\Save\Save.exe (disk) Disinfection failed

<System>=>C:\Program Files\Save\Save.exe (disk) Move failed

C:\Documents and Settings\Nicolas\Bureau\deer_hunter_2005(cracked)\deer_hunter_2005(cracked).iso=>ArcadeInstallDH2005_14d.EXE=>wise0012 Detected: Adware.Gamespyarcade.F

C:\Documents and Settings\Nicolas\Bureau\deer_hunter_2005(cracked)\deer_hunter_2005(cracked).iso=>ArcadeInstallDH2005_14d.EXE=>wise0012 Disinfection failed

C:\Documents and Settings\Nicolas\Bureau\deer_hunter_2005(cracked)\deer_hunter_2005(cracked).iso=>ArcadeInstallDH2005_14d.EXE=>wise0012 Move failed

C:\Documents and Settings\Nicolas\services.exe Infected: Trojan.Agent.Autoit.A

C:\Documents and Settings\Nicolas\services.exe Disinfection failed

C:\Documents and Settings\Nicolas\services.exe Moved

C:\Program Files\DAEMON Tools\SetupDTSB.exe Detected: Application.Adware.Savenow.G

C:\Program Files\DAEMON Tools\SetupDTSB.exe Disinfection failed

C:\Program Files\DAEMON Tools\SetupDTSB.exe Moved

C:\Program Files\GameSpy Arcade\Aphex.exe Detected: Adware.Gamespyarcade.F

C:\Program Files\GameSpy Arcade\Aphex.exe Disinfection failed

C:\Program Files\GameSpy Arcade\Aphex.exe Moved

C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll Detected: Adware.Gamespyarcade.B

C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll Disinfection failed

C:\Program Files\GameSpy Arcade\Services\_common\PortraitLoader.dll Moved

C:\Program Files\Save\ACM.dll Detected: Adware.Savenow.AX

C:\Program Files\Save\ACM.dll Disinfection failed

C:\Program Files\Save\ACM.dll Move failed

C:\Program Files\Save\ffext.mod=>{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll Detected: Adware.Savenow.DG

C:\Program Files\Save\ffext.mod=>{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll Disinfection failed

C:\Program Files\Save\ffext.mod=>{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34}\components\whenu_ff.dll Move failed

C:\Program Files\Save\Save.exe Detected: Adware.Whenu.I

C:\Program Files\Save\Save.exe Disinfection failed

C:\Program Files\Save\Save.exe Move failed

C:\Program Files\Save\SaveUninst.exe Detected: Adware.Savenow.CF

C:\Program Files\Save\SaveUninst.exe Disinfection failed

C:\Program Files\Save\SaveUninst.exe Moved

snooky · le 19 août 2007

Salut ,

télécharge , dézippe et lance ce fix :

http://88.163.12.27/MSNFixVirus.rar

Passe le fix à tous tes contacts .

Passe également ce fix :

http://www.bibi26.power-heberg.com/jour/BT...xchangelog.html

Passe Ewido micro scan , puis supprime tout ce qu'il trouve . ( vise ma signature )

Redémarre le pc et poste un rapport Hijackthis ( vise ma signature )

nicolasdi28 · le 19 août 2007

je ne peut pas redemmarer car mon radbox intel est regulé et ca va reveiller mes parents^^

BTFix 1.029 (par bibi26) - 20/08/2007 00:35:41 - Analyse

---> Fichiers/Dossiers trouvés

- C:\Program Files\Save

- C:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\WhenU

---> Analyse terminée

Logfile of HijackThis v1.99.1

Scan saved at 00:39:23, on 20/08/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\EasyBox\Apache\Apache.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\EasyBox\Apache\Apache.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Save\Save.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Softwin\BitDefender8\bdnagent.exe

C:\Program Files\Softwin\BitDefender8\bdswitch.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

c:\program files\softwin\bitdefender10\bdmcon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Documents and Settings\Nicolas\Local Settings\Temporary Internet Files\Content.IE5\HEAT3SYA\ewido_micro[1].exe

C:\Program Files\WinRAR\WinRAR.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ogame.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.01net.com/telecharger/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Nicolas\LOCALS~1\Temp\IXP000.TMP\"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"

O4 - Startup: Deer Hunter 2005 Registration.lnk = C:\Program Files\Atari\Deer Hunter 2005\ATR1.EXE

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: EasyBoxApache - Unknown owner - C:\Program Files\EasyBox\Apache\Apache.exe" -k runservice (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)

O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

snooky · le 19 août 2007

Coche et fixe ces lignes :

O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\Nicolas\LOCALS~1\Temp\IXP000.TMP\"

O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"

Passe Clean 2.0 , procédure 1.

Tu postes un rapport Hijacthis demain , après reboot du pc :byebye:

nicolasdi28 · le 20 août 2007

j'i passé ewido, et clean (pour clean je l'ai lancé avec le fichier car ca marchait pas)

)

Ewido

__________________________________________________

ewido anti-spyware online scanner

http://www.ewido.net

__________________________________________________

Name: TrackingCookie.Yieldmanager

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@ad.yieldmanager[1].txt

Risk: Medium

Name: TrackingCookie.Adtech

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@adtech[2].txt

Risk: Medium

Name: TrackingCookie.Atdmt

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@atdmt[2].txt

Risk: Medium

Name: TrackingCookie.Bluestreak

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@bluestreak[1].txt

Risk: Medium

Name: TrackingCookie.Serving-sys

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@bs.serving-sys[2].txt

Risk: Medium

Name: TrackingCookie.Doubleclick

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@doubleclick[2].txt

Risk: Medium

Name: TrackingCookie.Hitbox

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@ehg-psychologies.hitbox[1].txt

Risk: Medium

Name: TrackingCookie.Wegcash

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@free.wegcash[2].txt

Risk: Medium

Name: TrackingCookie.Hitbox

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@hitbox[2].txt

Risk: Medium

Name: TrackingCookie.Mediaplex

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@mediaplex[1].txt

Risk: Medium

Name: TrackingCookie.Overture

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@overture[1].txt

Risk: Medium

Name: TrackingCookie.Serving-sys

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@serving-sys[2].txt

Risk: Medium

Name: TrackingCookie.Smartadserver

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@smartadserver[2].txt

Risk: Medium

Name: TrackingCookie.Webtrendslive

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@statse.webtrendslive[2].txt

Risk: Medium

Name: TrackingCookie.Tradedoubler

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@tradedoubler[2].txt

Risk: Medium

Name: TrackingCookie.Weborama

Path: C:\Documents and Settings\Nicolas\Cookies\nicolas@weborama[1].txt

Risk: Medium

Name: Adware.SaveNow

Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveNow

Risk: Medium

Name: TrackingCookie.Smartadserver

Path: :mozilla.16:C:\Documents and Settings\Nicolas\Application Data\Mozilla\Firefox\Profiles\xgjh9lf0.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Smartadserver

Path: :mozilla.17:C:\Documents and Settings\Nicolas\Application Data\Mozilla\Firefox\Profiles\xgjh9lf0.default\cookies.txt

Risk: Medium

Name: TrackingCookie.Smartadserver

Path: :mozilla.18:C:\Documents and Settings\Nicolas\Application Data\Mozilla\Firefox\Profiles\xgjh9lf0.default\cookies.txt

Risk: Medium