Aide pour supprimer un trojan TR/Crypt.XPACK. Fermé

Question

Bonjour,

Depuis une semaine j'ai des alertes récurrentes concernant un cheval de troie qui est coriace

En effet, étant sous Avast j'avais des messages, je suis donc passé sous Antivir et du coup ce dernier me détecte toutes les 10 min ce cheval de troie : TR/Crypt.XPACK.Gen

 Le chemin d'accès de cette petite bête ennuyeuse est le suivant : C:\Windows\Temp\llva.tmp\svchost.exe

Pouvez-vous m'indiquer comment m'en débarrasser, sachant que les antispywares classiques (asquared, antimalware) n'ont pas réussi à le virer.

Là je commence à sécher et je ne sais plus trop quoi faire, donc un peu d'aide ne serait pas de refus !

En tout cas, merci d'avance à tous !

Miragien · Answer

Téléchargez Hijackthis 2.0.2
http://www.trendsecure.com/portal/fr/_download/HJTInstall.exe

> Installez le, une fois l'installation terminé, cliquez sur l'icône.

> Cliquez sur "Do a system scan and save a logfile".

> Attendre jusqu'à ce que le rapport s'affiche.

> Postez le sur le forum.

yofaz78 · Answer

Bonjour,

voici le rapport demandé :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:15:51, on 04/02/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Sony\Network Utility\LANUtil.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\RAMRush\RAMRush.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [NSUFloatingUI] "C:\Program Files\Sony\Network Utility\LANUtil.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ftweak_RAMRush] C:\Program Files\RAMRush\RAMRush.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Yohann\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Hercules DJ Control MP3 (HerculesDJControlMP3) - Unknown owner - C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NSUService - Sony Corporation - C:\Program Files\Sony\Network Utility\NSUService.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PS3 Media Server - Unknown owner - C:\Program Files\PS3 Media Server\win32\service\wrapper.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Miragien · Answer

1) Affiche les fichiers et dossiers cachés …
Pour ce faire, tu vas dans un dossier, par ex. "Mes Images".
Ensuite, clique sur > Outils > Options des dossiers ...
clique sur l' onglet « Affichage » et ...
coche ---> Afficher les fichiers et dossiers cachés
décoche > Masquer les extensions des fichiers dont le type est connu
décoche > Masquer les fichiers protégés du système d' exploitation (recommandé).
« Appliquer » et « OK ».

2) Désactive toute protection résidente ( antivirus…) !
Déconnecte-toi d’internet, ferme tous les programmes en cours et laisse combofix travailler : ne fais donc pas autre chose en même temps !

Télécharge Combofix de sUBs
Et suis ce tutoriel :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

yofaz78 · Answer

Voici le rapport combofix : ComboFix 10-02-04.03 - Yohann 05/02/2010 11:30:40.3.2 - x86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.2038.967 [GMT 11:00] Lancé depuis: c:\users\Yohann\Desktop\ComboFix.exe SP: AVG Anti-Spyware *disabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\404Fix.exe c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe c:\windows\system32 mp.reg c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\WS2Fix.exe Une copie infectée de c:\windows\system32\drivers\atapi.sys a été trouvée et désinfectée Copie restaurée à partir de - Kitty ate it :p . ((((((((((((((((((((((((((((( Fichiers créés du 2010-01-05 au 2010-02-05 )))))))))))))))))))))))))))))))))))) . 2010-02-05 00:45 . 2010-02-05 00:48 -------- d-----w- c:\users\Yohann\AppData\Local emp 2010-02-05 00:45 . 2010-02-05 00:45 -------- d-----w- c:\users\Public\AppData\Local emp 2010-02-05 00:45 . 2010-02-05 00:45 -------- d-----w- c:\users\Default\AppData\Local emp 2010-02-03 23:14 . 2010-02-03 23:14 -------- d-----w- c:\program files\Trend Micro 2010-02-02 19:47 . 2009-11-25 00:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-02-02 19:47 . 2009-03-29 22:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-02-02 19:47 . 2010-02-02 19:47 -------- d-----w- c:\programdata\Avira 2010-02-02 19:47 . 2010-02-02 19:47 -------- d-----w- c:\program files\Avira 2010-02-02 06:16 . 2010-02-02 06:17 -------- d-----w- c:\program files\Navilog1 2010-02-02 00:01 . 2010-02-02 00:01 -------- d-----w- c:\users\Yohann\AppData\Roaming\Grisoft 2010-02-02 00:01 . 2010-02-02 00:01 -------- d-----w- c:\programdata\Grisoft 2010-02-01 06:04 . 2010-02-01 09:16 -------- d-----w- c:\program files\a-squared Free 2010-02-01 05:24 . 2010-02-01 05:24 47664 ----a-w- c:\windows\system32\drivers\pxrts.sys 2010-02-01 05:23 . 2010-02-01 05:24 -------- d-----w- c:\programdata\PrevxCSI 2010-01-27 11:57 . 2010-01-27 11:56 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-01-27 11:38 . 2010-01-27 11:38 -------- d-----w- c:\users\Yohann\AppData\Roaming\Malwarebytes 2010-01-27 11:37 . 2010-01-27 11:37 -------- d-----w- c:\programdata\Malwarebytes 2010-01-27 11:37 . 2010-02-02 06:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-26 05:53 . 2010-01-26 06:04 -------- d-----w- C:\MyBackup 2010-01-12 23:17 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32 2embed.dll 2010-01-12 23:17 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll 2010-01-12 19:54 . 2010-01-12 19:54 -------- d-----w- c:\users\Yohann\AppData\Roaming\dvdcss 2010-01-10 02:18 . 2007-12-24 02:47 7680 ----a-w- c:\windows\system32\ff_vfw.dll 2010-01-10 02:18 . 2007-11-29 01:52 60273 ----a-w- c:\windows\system32\pthreadGC2.dll 2010-01-10 02:18 . 2010-01-10 02:18 -------- d-----w- c:\program files\ffdshow 2010-01-10 02:17 . 2010-01-10 02:17 -------- d-----w- c:\users\Yohann\AppData\Local\TVersity . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-05 00:46 . 2009-11-11 22:52 12 ----a-w- c:\windows\bthservsdp.dat 2010-02-05 00:30 . 2009-09-13 10:37 19944 ----a-w- c:\windows\system32\drivers\atapi.sys 2010-02-03 23:13 . 2008-10-01 01:13 -------- d-----w- c:\users\Yohann\AppData\Roaming\uTorrent 2010-02-03 01:14 . 2008-10-01 08:55 -------- d-----w- c:\users\Yohann\AppData\Roaming\Skype 2010-02-03 00:08 . 2008-12-25 07:31 -------- d-----w- c:\users\Yohann\AppData\Roaming\skypePM 2010-02-02 19:44 . 2008-09-30 13:23 109536 ----a-w- c:\users\Yohann\AppData\Local\GDIPFONTCACHEV1.DAT 2010-02-02 09:52 . 2010-02-02 09:48 691 ----a-w- c:\users\Yohann\AppData\Roaming\GetValue.vbs 2010-02-02 09:52 . 2010-02-02 09:48 35 ----a-w- c:\users\Yohann\AppData\Roaming\SetValue.bat 2010-02-02 09:52 . 2010-02-02 09:48 35 ----a-w- c:\users\Yohann\AppData\Roaming\SetValue.bat 2010-02-01 07:14 . 2009-08-04 06:31 -------- d-----w- c:\users\Yohann\AppData\Roaming\VSO 2010-01-29 05:10 . 2006-11-02 15:48 672322 ----a-w- c:\windows\system32\perfh00C.dat 2010-01-29 05:10 . 2006-11-02 15:48 124434 ----a-w- c:\windows\system32\perfc00C.dat 2010-01-28 11:47 . 2009-07-20 08:22 -------- d-----w- c:\users\Yohann\AppData\Roaming\FrostWire 2010-01-27 11:56 . 2007-08-03 10:06 -------- d-----w- c:\program files\Java 2010-01-26 19:23 . 2009-01-01 12:17 -------- d-----w- c:\program files\eMule 2010-01-21 19:37 . 2008-10-02 07:29 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-20 07:20 . 2008-10-01 06:17 -------- d-----w- c:\programdata\Messenger Plus! 2010-01-20 07:20 . 2008-10-01 06:08 -------- d-----w- c:\program files\Messenger Plus! Live 2010-01-14 00:12 . 2009-10-03 08:21 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-01-13 04:24 . 2007-08-03 09:54 -------- d-----w- c:\programdata\Microsoft Help 2010-01-12 23:57 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-01-02 06:38 . 2010-01-21 19:27 916480 ----a-w- c:\windows\system32\wininet.dll 2010-01-02 06:32 . 2010-01-21 19:27 109056 ----a-w- c:\windows\system32\iesysprep.dll 2010-01-02 06:32 . 2010-01-21 19:27 71680 ----a-w- c:\windows\system32\iesetup.dll 2010-01-02 04:57 . 2010-01-21 19:27 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-12-18 07:25 . 2008-10-01 01:42 -------- d-----w- c:\users\Yohann\AppData\Roaming\Apple Computer 2009-12-18 07:18 . 2008-10-01 01:38 -------- d-----w- c:\programdata\Apple 2009-12-03 23:03 . 2009-12-03 23:03 251376 ----a-w- c:\users\Yohann\AppData\Roaming\Mozilla\plugins pgoogletalk.dll 2009-11-27 07:36 . 2009-11-27 07:37 38208 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2009-11-09 12:31 . 2009-12-09 00:25 24064 ----a-w- c:\windows\system32 shhttp.dll 2009-11-09 12:30 . 2009-12-09 00:25 30720 ----a-w- c:\windows\system32\httpapi.dll 2009-11-09 10:36 . 2009-12-09 00:25 411648 ----a-w- c:\windows\system32\drivers\http.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-07-16 262144] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616] "ftweak_RAMRush"="c:\program files\RAMRush\RAMRush.exe" [2009-08-17 667136] "Google Update"="c:\users\Yohann\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-12-16 135664] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-30 137752] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-30 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-30 133656] "Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-10 118784] "RtHDVCpl"="RtHDVCpl.exe" [2007-06-26 4489216] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-11 317560] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-27 149280] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\VESWinlogon] 2007-07-24 17:26 98304 ----a-w- c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux6"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys] @="FSFilter System Recovery" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hercules DJ Series] 2009-07-09 00:41 505128 ----a-w- c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):3b,2f,31,7e,8d,34,ca,01 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3068229251-2152353204-2134518297-1000] "EnableNotificationsRef"=dword:00000001 R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [01/02/2010 17:04 1858144] R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [03/02/2010 06:47 108289] R2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE [08/08/2009 10:33 17408] R2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [01/10/2008 03:49 204800] R2 pxrts;pxrts;c:\windows\System32\drivers\pxrts.sys [01/02/2010 16:24 47664] R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [25/08/2009 01:51 185640] R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\System32\drivers eamviewervpn.sys [25/01/2008 20:12 25088] R3 ti21sony;ti21sony;c:\windows\System32\drivers i21sony.sys [03/08/2007 12:07 812544] S3 Bulk;HDJBulk;c:\windows\System32\drivers\HDJBulk.sys [08/08/2009 10:33 125440] S3 FontCache;Service de cache de police Windows;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [02/10/2008 16:31 21504] S3 HDJMidi;Hercules DJ Control Steel MIDI;c:\windows\System32\drivers\HDJMidi.sys [08/08/2009 10:33 123904] S3 PS3 Media Server;PS3 Media Server;c:\program files\PS3 Media Server\win32\service\wrapper.exe [17/08/2008 19:40 217088] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [01/10/2008 03:39 292152] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [04/10/2008 08:23 87328] S4 sptd;sptd;c:\windows\System32\drivers\sptd.sys [14/11/2008 17:26 721904] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache bthsvcs REG_MULTI_SZ BthServ . Contenu du dossier 'Tâches planifiées' 2010-02-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3068229251-2152353204-2134518297-1000Core.job - c:\users\Yohann\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-16 08:55] 2010-02-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3068229251-2152353204-2134518297-1000UA.job - c:\users\Yohann\AppData\Local\Google\Update\GoogleUpdate.exe [2009-12-16 08:55] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\users\Yohann\AppData\Roaming\Mozilla\Firefox\Profiles\1hwfrskt.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MICWV2&q= FF - plugin: c:\program files\Microsoft\Office Live pOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins p-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins pFoxitReaderPlugin.dll FF - plugin: c:\program files\Mozilla Firefox\plugins pOGAPlugin.dll FF - plugin: c:\program files\Picasa2 pPicasa3.dll FF - plugin: c:\program files\Unity\WebPlayer\loader pUnity3D32.dll FF - plugin: c:\users\Yohann\AppData\Local\Google\Update\1.2.183.13 pGoogleOneClick8.dll FF - plugin: c:\users\Yohann\AppData\Roaming\Mozilla\plugins pgoogletalk.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: browser.xul.error_pages.enabled - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 3000000 FF - user.js: content.maxtextrun - 8191 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 750000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 750000 FF - user.js: network.http.max-connections - 32 FF - user.js: network.http.max-connections-per-server - 8 FF - user.js: network.http.max-persistent-connections-per-proxy - 8 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 0 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: general.useragent.extra.prevx - c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHELINS SUPPRIMES - - - - SafeBoot-dmboot.sys SafeBoot-dmio.sys SafeBoot-dmload.sys SafeBoot-dmadmin SafeBoot-dmserver SafeBoot-SRService ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-05 11:48 Windows 6.0.6002 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x85405856]<< kernel: MBR read successfully detected MBR rootkit hooks: \Driver\Disk -> CLASSPNP.SYS @ 0x883a7d24 \Driver\ACPI -> acpi.sys @ 0x82a99d68 \Driver\atapi -> ataport.SYS @ 0x82be2a2c IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:0000003d [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:0000003d . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'Explorer.exe'(1408) c:\program files\RocketDock\RocketDock.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\windows\system32\conime.exe c:\program files\Sony\VAIO Event Service\VESMgr.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe c:\windows\system32\DRIVERS\xaudio.exe c:\windows\system32\igfxext.exe c:\windows\system32\igfxsrvc.exe c:\program files\Sony\VAIO Event Service\VESMgrSub.exe c:\windows\system32\igfxext.exe c:\windows\system32\igfxsrvc.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\windows\system32\igfxsrvc.exe c:\windows\ehome\ehmsas.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Heure de fin: 2010-02-05 12:00:22 - La machine a redémarré ComboFix-quarantined-files.txt 2010-02-05 01:00 Avant-CF: 20 243 894 272 octets libres Après-CF: 20 209 463 296 octets libres - - End Of File - - C8F8EE5EB2BB33E07ABF2D7ADC00FAFF

Miragien · Answer

Ton problème c'est t' il arrangé ?

Quelque soit la réponse fais ceci :

Télécharge Hijackthis 2.0.2
http://www.trendsecure.com/portal/fr/_download/HJTInstall.exe

> Installez le, une fois l'installation terminé, cliquez sur l'icône.

> Cliquez sur "Do a system scan and save a logfile".

> Attendre jusqu'à ce que le rapport s'affiche.

> Postez le sur le forum.

Aide pour supprimer un trojan TR/Crypt.XPACK.

5 réponses

Discussions similaires