infection de virus( popuper, Wp, manifest) Fermé

Question

bonjour à tous, je me bats depuis plusieurs jours avec différents virus. Grace à certain post du forum j'ai pu en éliminer certains. Mais je pense qu'il en reste. J'ai passé spy bot et ad aware et voici le resultat hijack. Pour info j'ai mis le DD qui est infecter sur un autre PC . J'ai peur que le resultat hijack ne donne que des infos de mon PC et non du DD infecter. Merci pour votre aideLogfile of HijackThis v1.99.1Scan saved at 20:06:39, on 06/06/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exeC:\PROGRA~1\Wanadoo\CnxMon.exeC:\PROGRA~1\Wanadoo	askbaricon.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeC:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEC:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXEC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exeC:\Program Files\Microsoft Office\Office\OUTLOOK.EXEC:\Program Files\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo	askbaricon.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeO4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver2\LVCOMS.EXEO4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /sO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\france.exe -NO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure/connexion/archives/ie4n4/teleir_cert.cabO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exeO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{E9C774F6-90EB-4968-9A38-09C190DB6842}: NameServer = 80.10.246.130 80.10.246.3O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe" -z (file missing)O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

jean38 · Answer

Ta reponse et judicieuse, le log corespond à ce qu'il y a et non ce qu'il y aurait du y avoir,cependant pendant que tu y es, fixe celàO4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\france.exe -N bien des traces de tes cochonneries mais...A+Jean

dpelu · Answer

Re bonjour,voici le resultat pour le DD infecter, D'avance merci.Logfile of HijackThis v1.99.1Scan saved at 21:23:09, on 06/06/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXEC:\WINDOWS\soundman.exeC:\WINDOWS\System32\LVCOMSX.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\System32\TrayIcon.exeC:\PROGRA~1\WANADOO\CnxMon.exeC:\WINDOWS\System32\GSICON.EXEC:\WINDOWS\System32\dslagent.exeC:\PROGRA~1\WANADOO\TaskbarIcon.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Logitech\Video\ManifestEngine.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exeC:\Program Files\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://web.all-find.orgR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.orgR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.orgR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://web.all-find.orgR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://qfind.net/bar/index.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://web.all-find.orgR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.orgR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.all-find.orgR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://web.all-find.orgR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.quicknavigate.com/search.php?qq=%1R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.quicknavigate.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: auto.search.msn.com 127.0.0.1O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: (no name) - {DE23A040-D6AA-43ca-9B86-D9BE3DAA6FE7} - C:\WINDOWS\system32\javafix4.dllO2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF} - C:\WINDOWS\System32\hp9366.tmp (file missing)O3 - Toolbar: Virtual Maid - {77B2F8DE-CB3F-4b6b-839B-807DD1ADBA1C} - C:\PROGRA~1\VIRTUA~1\VIRTUA~1.DLL (file missing)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /sO4 - HKLM\..\Run: [SoundMan] soundman.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXEO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [DisplayTrayIcon] C:\WINDOWS\System32\TrayIcon.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\WANADOO\CnxMon.exeO4 - HKLM\..\Run: [GSICONEXE] GSICON.EXEO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exeO4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" bootO4 - Global Startup: Exif Launcher.lnk = ?O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O9 - Extra button: Microsoft AntiSpyware helper - {3364B0C1-591E-46E2-AFBD-61BE5FF52656} - (no file) (HKCU)O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3364B0C1-591E-46E2-AFBD-61BE5FF52656} - (no file) (HKCU)O9 - Extra button: Microsoft AntiSpyware helper - {57FC6EB8-8D82-487F-9666-36E755E9AF90} - (no file) (HKCU)O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {57FC6EB8-8D82-487F-9666-36E755E9AF90} - (no file) (HKCU)O9 - Extra button: Microsoft AntiSpyware helper - {97D9DC02-2FCB-484F-91F1-95969CA2A435} - (no file) (HKCU)O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {97D9DC02-2FCB-484F-91F1-95969CA2A435} - (no file) (HKCU)O13 - DefaultPrefix: http://web.all-find.org/best.php?url=O13 - WWW Prefix: http://web.all-find.org/best.php?url=O13 - Home Prefix: http://web.all-find.org/best.php?url=O13 - Mosaic Prefix: http://web.all-find.org/best.php?url=O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exeO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www2.incredimail.com/contents/setup/downloader/imloader.cabO20 - AppInit_DLLs: 3ku6poigr6j1.dllO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exeO23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe

Infection de virus( popuper, Wp, manifest)

2 réponses

Discussions similaires