Aller au contenu

[LOGICIEL] [Centralisation] .:::: Hijackthis ::::.

snooky

Par snooky
dans Microsoft Windows (Mobile)

Messages recommandés

nayl Nouveau

nayl

Posté(e)
Posté(e)

bonjour j'ai un problème aléatoire mon pc plante 'écran noir ventillo continu de tourner obliger de reboot)

dans l'observateur d'événement c'est service security center qui démare je trouve ca bizzard...

pouvez vous analyser ce rapport

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:24:54, on 21/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\documents and settings\nayl\local settings\application data\wypqzjk.exe

C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe

C:\WINDOWS\ATKKBService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL

O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll

O3 - Toolbar: Megaupload Toolbar - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [wypqzjk] "c:\documents and settings\nayl\local settings\application data\wypqzjk.exe" wypqzjk

O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start

O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Program Files\Fichiers communs\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.08\is\PhysX_9.09.0203_SystemSoftware.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichier...ion_3_1_2_0.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{5FE814E2-10B0-43B3-A394-5B2E295FEDB4}: NameServer = 192.168.1.1

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--

End of file - 6012 bytes

merci d'avance!

Lien vers le commentaire
Partager sur d’autres sites
  • Réponses 8,5 k
  • Créé
  • Dernière réponse
nayl Nouveau

nayl

Posté(e)
Posté(e)

merci pour ta réponse!

alors voila le rapport MBAB

Malwarebytes' Anti-Malware 1.34

Version de la base de données: 1881

Windows 5.1.2600 Service Pack 3

21/03/2009 17:28:52

mbam-log-2009-03-21 (17-28-46).txt

Type de recherche: Examen complet (C:\|)

Eléments examinés: 102525

Temps écoulé: 9 minute(s), 30 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 3

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 4

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\OOO (Rogue.LivePlayer) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\OOO (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

Fichier(s) infecté(s):

C:\Documents and Settings\Nayl\Local Settings\Application Data\wypqzjk_navps.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\Nayl\Local Settings\Application Data\wypqzjk_nav.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\Nayl\Local Settings\Application Data\wypqzjk.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\Nayl\Local Settings\Application Data\wypqzjk.exe (Adware.Navipromo.H) -> No action taken.

Lien vers le commentaire
Partager sur d’autres sites
nayl Nouveau

nayl

Posté(e)
Posté(e)

je viens de lancer clean en procédure 1 comme expliquer dans le tutau

mais il me met accès refusé.de plus il mouvre un message "Protection de fichiers windows" desfichier nécessaire au fonctionnement de windows sont nécessaire blablabla

il me propose recommencer,information ou annuler?

que dois-je faire ?

Lien vers le commentaire
Partager sur d’autres sites
nayl Nouveau

nayl

Posté(e)
Posté(e)

voila le rapport

ComboFix 09-03-19.02 - Nayl 2009-03-21 18:13:38.1 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1627 [GMT 1:00]

Lancé depuis: c:\documents and settings\Nayl\Bureau\ComboFix.exe

AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated)

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Nayl\Application Data\inst.exe

c:\windows\system32\pthreadGC2.dll

.

((((((((((((((((((((((((((((( Fichiers créés du 2009-02-21 au 2009-03-21 ))))))))))))))))))))))))))))))))))))

.

2009-03-21 17:57 . 2009-03-21 17:57 <REP> d-------- c:\windows\system32\NtmsData

2009-03-21 17:44 . 2008-12-02 12:35 254,604 --a------ C:\clean.cmd

2009-03-21 17:40 . 2009-03-21 17:45 58 --a------ C:\SCRIPT.CLN

2009-03-21 17:18 . 2009-03-21 17:18 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-03-21 17:18 . 2009-03-21 17:18 <REP> d-------- c:\documents and settings\Nayl\Application Data\Malwarebytes

2009-03-21 17:18 . 2009-03-21 17:18 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-21 17:18 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-21 17:18 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-03-21 15:33 . 2009-03-21 15:33 144 --a------ c:\windows\wininit.ini

2009-03-21 15:15 . 2009-03-21 18:10 <REP> d-------- c:\program files\Arovax AntiSpyware

2009-03-21 15:15 . 2009-03-21 15:15 <REP> d-------- c:\documents and settings\All Users\Application Data\Arovax

2009-03-21 15:10 . 2009-03-21 15:11 <REP> d-------- c:\program files\Spybot - Search & Destroy

2009-03-21 15:10 . 2009-03-21 17:13 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-21 15:00 . 2009-03-21 15:00 <REP> d--h----- c:\windows\system32\GroupPolicy

2009-03-21 14:55 . 2009-03-21 14:55 <REP> d-------- c:\windows\Sun

2009-03-21 14:52 . 2009-03-21 14:52 <REP> d-------- c:\program files\Java

2009-03-21 14:52 . 2009-03-21 14:52 410,984 --a------ c:\windows\system32\deploytk.dll

2009-03-21 14:52 . 2009-03-21 14:52 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-03-21 14:24 . 2009-03-21 14:24 <REP> d-------- c:\program files\Trend Micro

2009-03-20 21:55 . 2009-03-20 23:06 <REP> d-------- c:\program files\ASUS

2009-03-20 21:55 . 2009-03-20 21:55 12,288 --a------ c:\windows\system32\drivers\EIO64_xp.sys

2009-03-20 21:48 . 2009-03-20 21:54 <REP> d-------- c:\windows\SxsCaPendDel

2009-03-20 21:48 . 2009-03-20 21:48 <REP> d-------- C:\5c7625d5e8cc7c2fed63ea19a7

2009-03-20 21:40 . 2009-03-20 21:40 <REP> d-------- c:\program files\Windows Media Connect 2

2009-03-20 21:39 . 2009-03-20 21:39 <REP> d-------- c:\windows\system32\LogFiles

2009-03-20 21:39 . 2009-03-20 21:39 <REP> d-------- c:\windows\system32\drivers\UMDF

2009-03-20 12:02 . 2008-07-29 12:33 446,464 --a------ c:\windows\system32\nvunrm.exe

2009-03-20 12:02 . 2008-07-29 12:30 6,045 --a------ c:\windows\system32\nvnrm.nvu

2009-03-20 12:02 . 2008-07-08 00:45 4,984 --a------ c:\windows\system32\drivers\nvphy.bin

2009-03-19 19:45 . 2009-03-19 19:45 <REP> d-------- c:\documents and settings\All Users\Application Data\vsosdk

2009-03-19 19:09 . 2006-05-11 19:21 626,688 --a------ c:\windows\system32\vp7vfw.dll

2009-03-19 19:09 . 2006-09-29 12:24 217,127 --a------ c:\windows\system32\drv43260.dll

2009-03-19 19:09 . 2006-09-29 12:25 208,935 --a------ c:\windows\system32\drv33260.dll

2009-03-19 19:09 . 2006-09-29 12:26 176,165 --a------ c:\windows\system32\drv23260.dll

2009-03-19 19:09 . 2002-12-10 02:20 102,439 --a------ c:\windows\system32\sipr3260.dll

2009-03-19 19:09 . 2007-03-18 20:37 65,602 --a------ c:\windows\system32\cook3260.dll

2009-03-19 18:49 . 2009-03-21 17:45 <REP> d-------- c:\documents and settings\All Users\Application Data\Vso

2009-03-19 18:47 . 2009-03-19 19:09 <REP> d-------- c:\program files\VSO

2009-03-19 18:47 . 2009-03-19 20:26 <REP> d-------- c:\documents and settings\Nayl\Application Data\Vso

2009-03-19 18:47 . 2009-03-19 18:47 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys

2009-03-19 18:47 . 2009-03-19 18:47 47,360 --a------ c:\documents and settings\Nayl\Application Data\pcouffin.sys

2009-03-19 18:19 . 2009-03-20 21:51 <REP> d-------- c:\windows\system32\XPSViewer

2009-03-19 18:19 . 2009-03-19 18:19 <REP> d-------- c:\program files\Reference Assemblies

2009-03-19 18:19 . 2009-03-19 18:19 <REP> d-------- c:\program files\MSBuild

2009-03-19 18:19 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll

2009-03-19 18:17 . 2006-05-01 11:52 90,800 -ra------ c:\windows\system32\drivers\se2Bunic.sys

2009-03-19 18:17 . 2006-05-01 11:54 88,688 -ra------ c:\windows\system32\drivers\SE2Bmgmt.sys

2009-03-19 18:17 . 2006-05-01 11:52 18,704 -ra------ c:\windows\system32\drivers\se2Bnd5.sys

2009-03-19 18:17 . 2006-05-01 11:52 4,128 -ra------ c:\windows\system32\drivers\se2Bcr.sys

2009-03-19 18:16 . 2006-05-01 11:54 97,184 -ra------ c:\windows\system32\drivers\SE2Bmdm.sys

2009-03-19 18:16 . 2006-05-01 11:55 86,560 -ra------ c:\windows\system32\drivers\SE2Bobex.sys

2009-03-19 18:16 . 2006-05-01 11:53 61,600 -ra------ c:\windows\system32\drivers\SE2Bbus.sys

2009-03-19 18:16 . 2006-05-01 11:53 9,360 -ra------ c:\windows\system32\drivers\SE2Bmdfl.sys

2009-03-19 18:16 . 2006-05-01 11:55 6,240 -ra------ c:\windows\system32\drivers\SE2Bcmnt.sys

2009-03-19 18:16 . 2006-05-01 11:55 6,240 -ra------ c:\windows\system32\drivers\SE2Bcm.sys

2009-03-19 18:16 . 2006-05-01 11:53 5,872 -ra------ c:\windows\system32\drivers\SE2Bwhnt.sys

2009-03-19 18:16 . 2006-05-01 11:53 5,872 -ra------ c:\windows\system32\drivers\se2Bwh.sys

2009-03-16 20:40 . 2009-03-16 20:40 <REP> d-------- c:\documents and settings\All Users\Application Data\Blizzard

2009-03-14 16:00 . 2009-03-20 21:51 <REP> d-------- c:\windows\system32\fr-fr

2009-03-14 16:00 . 2009-03-14 16:00 <REP> d-------- c:\windows\system32\fr

2009-03-14 16:00 . 2009-03-14 16:00 <REP> d-------- c:\windows\system32\bits

2009-03-14 16:00 . 2009-03-14 16:00 <REP> d-------- c:\windows\l2schemas

2009-03-14 15:58 . 2009-03-14 15:58 <REP> d-------- c:\windows\ServicePackFiles

2009-03-14 15:45 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll

2009-03-14 15:45 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll

2009-03-14 15:45 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui

2009-03-14 13:49 . 2009-03-16 19:55 <REP> d-------- c:\program files\Fichiers communs\Blizzard Entertainment

2009-03-13 03:47 . 2009-03-13 03:47 <REP> d-------- c:\documents and settings\Nayl\Application Data\Media Player Classic

2009-03-13 03:47 . 2009-03-13 03:47 50 --a------ c:\windows\MegaManager.INI

2009-03-12 22:50 . 2009-03-12 22:50 <REP> d-------- c:\program files\Megaupload

2009-03-12 22:50 . 2009-03-12 22:50 <REP> d-------- c:\documents and settings\Nayl\Application Data\Megaupload

2009-03-12 22:50 . 2009-03-12 22:50 <REP> d-------- c:\documents and settings\Nayl\Application Data\InstallShield

2009-03-12 15:46 . 2009-03-21 18:10 <REP> d-------- c:\documents and settings\Nayl\Tracing

2009-03-12 15:30 . 2009-03-12 15:30 <REP> d-------- c:\program files\Microsoft

2009-03-12 15:29 . 2009-03-12 15:29 <REP> d-------- c:\program files\Windows Live SkyDrive

2009-03-12 15:29 . 2009-03-12 15:30 <REP> d-------- c:\program files\Windows Live

2009-03-12 15:24 . 2009-03-12 15:24 <REP> d-------- c:\program files\Fichiers communs\Windows Live

2009-03-11 20:38 . 2009-03-11 20:38 <REP> d-------- c:\windows\system32\AGEIA

2009-03-11 20:38 . 2009-03-11 20:39 <REP> d-------- c:\windows\NV30323036.TMP

2009-03-11 20:38 . 2009-03-11 20:38 <REP> d-------- c:\program files\AGEIA Technologies

2009-03-11 20:38 . 2009-02-18 14:44 212,711 --a------ c:\windows\system32\nvapps.nvb

2009-03-11 20:35 . 2009-03-21 18:10 206,425 --a------ c:\windows\system32\nvapps.xml

2009-03-11 20:34 . 2009-03-11 20:39 <REP> d-------- c:\windows\nview

2009-03-11 20:34 . 2009-03-11 20:34 <REP> d-------- c:\program files\My Company Name

2009-03-11 20:34 . 2009-02-18 14:44 19,021 --a------ c:\windows\system32\nvdisp.nvu

2009-03-11 20:29 . 2009-03-11 20:29 <REP> d----c--- c:\windows\system32\DRVSTORE

2009-03-11 11:33 . 2009-03-11 11:33 <REP> d-------- c:\program files\Teamspeak2_RC2

2009-03-11 11:33 . 2009-03-11 11:33 <REP> d-------- c:\documents and settings\Nayl\Application Data\teamspeak2

2009-03-11 11:33 . 2009-03-11 11:33 34,064 --a------ c:\windows\system32\lhacm.acm

2009-03-11 11:07 . 2009-03-11 11:07 <REP> d-------- c:\program files\TuneUp Utilities 2009

2009-03-11 11:07 . 2009-03-11 11:07 <REP> d-------- c:\documents and settings\Nayl\Application Data\TuneUp Software

2009-03-11 11:07 . 2009-03-11 11:07 <REP> d-------- c:\documents and settings\All Users\Application Data\TuneUp Software

2009-03-11 11:07 . 2009-03-11 11:07 <REP> d--hs---- c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}

2009-03-11 11:07 . 2009-03-11 11:07 603,904 --a------ c:\windows\system32\TUProgSt.exe

2009-03-11 11:07 . 2009-03-11 11:07 360,192 --a------ c:\windows\system32\TuneUpDefragService.exe

2009-03-11 11:07 . 2008-12-11 13:31 27,904 --a------ c:\windows\system32\uxtuneup.dll

2009-03-11 10:54 . 2009-03-11 10:54 <REP> d-------- c:\program files\SystemRequirementsLab

2009-03-11 10:35 . 2009-03-11 10:35 <REP> d-------- c:\program files\ESET

2009-03-11 10:35 . 2009-03-11 10:35 <REP> d-------- c:\documents and settings\All Users\Application Data\ESET

2009-03-11 10:24 . 2008-11-18 12:18 12,416 --a------ c:\windows\system32\drivers\asusgsb.sys

2009-03-11 10:21 . 2006-06-14 13:44 12,288 -ra------ c:\windows\system32\drivers\EIO_XP.sys

2009-03-11 01:51 . 2009-03-21 17:45 <REP> d-------- c:\windows\Logs

2009-03-11 01:51 . 2009-03-11 01:51 <REP> d-------- c:\documents and settings\Nayl\Application Data\The Creative Assembly

2009-03-11 01:12 . 2009-03-11 01:12 <REP> d-------- c:\program files\K-Lite Codec Pack

2009-03-11 01:12 . 2008-11-06 17:37 3,596,288 --a------ c:\windows\system32\qt-dx331.dll

2009-03-11 00:40 . 2009-03-11 11:16 <REP> d-------- c:\program files\DNA

2009-03-11 00:40 . 2009-03-11 00:40 <REP> d-------- c:\program files\BitTorrent

2009-03-11 00:40 . 2009-03-21 17:45 <REP> d-------- c:\documents and settings\Nayl\Application Data\DNA

2009-03-11 00:40 . 2009-03-21 17:45 <REP> d-------- c:\documents and settings\Nayl\Application Data\BitTorrent

2009-03-11 00:31 . 2009-03-11 02:12 <REP> d-------- c:\program files\Empire Total War

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-20 22:06 --------- d--h--w c:\program files\InstallShield Installation Information

2009-03-20 22:06 --------- d-----w c:\program files\Fichiers communs\InstallShield

2009-03-20 20:17 --------- d-----w c:\program files\ma-config.com

2009-03-20 20:17 --------- d-----w c:\documents and settings\All Users\Application Data\ma-config.com

2009-03-10 22:44 --------- d-----w c:\documents and settings\Nayl\Application Data\DAEMON Tools Lite

2009-03-10 22:41 --------- d-----w c:\documents and settings\Nayl\Application Data\DAEMON Tools Pro

2009-03-10 22:41 --------- d-----w c:\documents and settings\Nayl\Application Data\DAEMON Tools

2009-03-10 22:41 --------- d-----w c:\documents and settings\Nayl\Application Data\Acreon

2009-03-10 22:40 --------- d-----w c:\program files\DAEMON Tools Lite

2009-03-10 22:40 --------- d-----w c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2009-03-10 22:39 717,296 ----a-w c:\windows\system32\drivers\sptd.sys

2009-03-10 22:19 --------- d-----w c:\program files\Realtek

2009-03-10 22:10 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard

2009-03-10 21:50 --------- d-----w c:\program files\microsoft frontpage

2009-03-10 21:49 --------- d-----w c:\program files\Services en ligne

2009-02-16 22:17 453,152 ----a-w c:\windows\system32\NVUNINST.EXE

2009-02-13 15:59 17,508,864 ----a-w c:\windows\RTHDCPL.EXE

2009-02-13 15:49 5,029,376 ----a-w c:\windows\system32\drivers\RtkHDAud.sys

2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll

2009-02-09 14:05 1,846,912 ----a-w c:\windows\system32\win32k.sys

2009-02-09 13:34 35,840 ----a-w c:\windows\system32\RtkCoInstXP.dll

2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll

2009-01-21 14:54 1,206,816 ----a-w c:\windows\RtlUpd.exe

2009-01-16 17:24 70,936 ----a-w c:\windows\system32\PhysXLoader.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2009-01-23 1171456]

"HijackThis startup scan"="c:\program files\Trend Micro\HijackThis\HijackThis.exe" [2009-03-21 396288]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"Arovax AntiSpyware"="c:\program files\Arovax AntiSpyware\arovaxantispyware.exe" [2007-09-21 1966080]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"WiseStubReboot"="MSIEXEC" [X]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016]

"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-12-22 380928]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-21 148888]

"RTHDCPL"="RTHDCPL.EXE" [2009-02-13 c:\windows\RTHDCPL.EXE]

"nwiz"="nwiz.exe" [2009-02-18 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun

"BitTorrent DNA"="c:\program files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

"nwiz"=nwiz.exe /install

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\jeux\\World of Warcraft\\BackgroundDownloader.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\jeux\\World of Warcraft\\WoW-3.0.1-to-3.0.2-frFR-Win-Update-downloader.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800]

R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2007-12-21 468224]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-03-11 603904]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-03-10 1684736]

S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-03-15 216232]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contenu du dossier 'Tâches planifiées'

2009-03-21 c:\windows\Tasks\Maintenance en 1 clic.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-12 15:04]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://google.fr/

TCP: {5FE814E2-10B0-43B3-A394-5B2E295FEDB4} = 192.168.1.1

FF - ProfilePath - c:\documents and settings\Nayl\Application Data\Mozilla\Firefox\Profiles\wmpazqg1.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: keyword.URL - hxxp://fr.search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

---- PARAMETRES FIREFOX ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-21 18:14:17

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

Heure de fin: 2009-03-21 18:14:58

ComboFix-quarantined-files.txt 2009-03-21 17:14:56

Avant-CF: 236 940 959 744 octets libres

Après-CF: 236,928,790,528 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

246 --- E O F --- 2009-03-11 02:01:41

Lien vers le commentaire
Partager sur d’autres sites
nayl Nouveau

nayl

Posté(e)
Posté(e)

sdfix effectué je colle le rapport

SDFix: Version 1.240

Run by Nayl on 21/03/2009 at 21:16

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Restoring Default Security Values

Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-21 21:20:38

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:2df9c43f

"s2"=dword:110480d0

"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:f4,5d,da,e6,7d,89,c0,d2,f9,ca,bf,e2,26,65,20,1f,ae,b0,9b,be,19,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,1c,7d,bb,64,8d,af,49,dc,f4,b2,d6,5a,40,a4,4f,f7,72,..

"khjeh"=hex:a4,f3,7f,8c,71,14,f1,73,ec,43,1d,16,51,4e,42,f7,9c,95,7d,c1,71,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:f6,2a,9e,e0,1f,12,cf,ac,32,20,7f,33,c6,a3,ca,eb,97,72,d1,60,7c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]

"khjeh"=hex:bc,9a,10,48,dc,b8,f9,36,99,a7,99,b8,af,a0,15,19,30,a4,22,f1,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:f4,5d,da,e6,7d,89,c0,d2,f9,ca,bf,e2,26,65,20,1f,ae,b0,9b,be,19,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,1c,7d,bb,64,8d,af,49,dc,f4,b2,d6,5a,40,a4,4f,f7,72,..

"khjeh"=hex:a4,f3,7f,8c,71,14,f1,73,ec,43,1d,16,51,4e,42,f7,9c,95,7d,c1,71,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:f6,2a,9e,e0,1f,12,cf,ac,32,20,7f,33,c6,a3,ca,eb,97,72,d1,60,7c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]

"khjeh"=hex:bc,9a,10,48,dc,b8,f9,36,99,a7,99,b8,af,a0,15,19,30,a4,22,f1,ad,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:f4,5d,da,e6,7d,89,c0,d2,f9,ca,bf,e2,26,65,20,1f,ae,b0,9b,be,19,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,1c,7d,bb,64,8d,af,49,dc,f4,b2,d6,5a,40,a4,4f,f7,72,..

"khjeh"=hex:a4,f3,7f,8c,71,14,f1,73,ec,43,1d,16,51,4e,42,f7,9c,95,7d,c1,71,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:f6,2a,9e,e0,1f,12,cf,ac,32,20,7f,33,c6,a3,ca,eb,97,72,d1,60,7c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]

"khjeh"=hex:bc,9a,10,48,dc,b8,f9,36,99,a7,99,b8,af,a0,15,19,30,a4,22,f1,ad,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"

"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"

"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"

"C:\\jeux\\World of Warcraft\\BackgroundDownloader.exe"="C:\\jeux\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\jeux\\World of Warcraft\\WoW-3.0.1-to-3.0.2-frFR-Win-Update-downloader.exe"="C:\\jeux\\World of Warcraft\\WoW-3.0.1-to-3.0.2-frFR-Win-Update-downloader.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\ma-config.com\\maconfservice.exe"="C:\\Program Files\\ma-config.com\\maconfservice.exe:LocalSubNet:Enabled:maconfservice"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"

"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

Remaining Files :

Files with Hidden Attributes :

Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"

Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"

Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

Fri 20 Mar 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

voila , je n'ai toujours pas le bouton arreter , redémarrer mais peut que c'est moi qui est fais une boulette(y a t'il moyen de régler ca dans le registre?)

pense tu que mon pc soit propre maintenant?

Lien vers le commentaire
Partager sur d’autres sites
neodyme Passionné

neodyme

Posté(e)
Posté(e)

Salut Snooky !

Pourrais-tu jeter un rapide coup d'½il sur mon rapport hijack s'il te plait pour voir s'il n'y a pas des lignes à virer...

Logfile of HijackThis v1.99.1

Scan saved at 15:42:10, on 22/03/2009

Platform: Unknown Windows (WinNT 6.00.1905 SP1)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe

C:\Windows\sttray.exe

C:\Program Files\BOINC\boincmgr.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Rk-Launcher\RKLauncher.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\BOINC\boinc.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\VLC\vlc.exe

C:\Program Files\Internet Explorer\IELowutil.exe

C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [boincmgr] "C:\Program Files\BOINC\boincmgr.exe" /a /s

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - Startup: RK Launcher.lnk = ?

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{F97D24BE-B522-4C9A-BFE8-16A91B644F50}: NameServer = 192.168.1.1

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Merci beaucoup ! :francais:

Lien vers le commentaire
Partager sur d’autres sites
_Iam-Nap_ Apprenti

_Iam-Nap_

Posté(e)
Posté(e)

Bonsoir ici, Je reposte dans la centralisation comme demandé par tiduster.

Bon je me retrouve avec une machine vérolée... Comme indiqué dans le titre. Aucune idée de comment ce virus a pu atterrir dans la machine vu que l'utilisateur n'est pas un nul en la matière et est plutôt prudent.

Voilà, j'ai identifié à la racine de windows les fichiers "freddy39.exe", "pp04.exe", "ld02.exe", "tt_02148980.exe" Tous en programme cachés, un coup d'Avira Antivir me les supprime et m'en trouve d'autres dans les dossiers cachés 'restore' des SVI (système volume info) la variante toute fraiche toute neuve du ver "KoobFace.FH", son générateur "KoobFace.A.12" ainsi que la Backdoor BDS/Lithium.DY.46

Tout ce beau monde a donc été éradiqué, mais es ce suffisant ?

Je m'en remet à vos expériences et vous laisse un rapport HiJackThis après scan d'antivir.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:11:40, on 23/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

E:\Programmes\Ad Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ATI Tray Tools\atitray.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe

C:\WINDOWS\system32\HPZipm12.exe

E:\Programmes\Alcohol\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Raxco\PerfectDisk\PDSched.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\HIJACKthis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [GEST] m’|\ü

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\ATI Tray Tools\atitray.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1217343166677

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Programmes\Ad Aware\aawservice.exe

O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiViR\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe

O23 - Service: Google Update Service (gupdate1c9a72027a94dae) (gupdate1c9a72027a94dae) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe

O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - E:\Programmes\Alcohol\Alcohol 120\StarWind\StarWindService.exe

--

End of file - 6240 bytes

EDIT : Topic original >> http://www.pcinpact.com/forum/index.php?sh...p;#entry2307432

Lien vers le commentaire
Partager sur d’autres sites

Archivé

Ce sujet est désormais archivé et ne peut plus recevoir de nouvelles réponses.

Aller sur la liste des sujets
×
×
  • Créer...