Sujet Précédent Sujet Suivant

SVP URGENT Nettoyage de config

pmccm Messages postés 167 Statut Membre -  
pmccm Messages postés 167 Statut Membre -
Bonjour tout le monde...

quelqu'un pourrait-il m'aider à faire le grand ménage la dedans ; c'est plein de virus, trojan, spyware....

Si possible indiquez moi les critères pour enlever telle ou telle chose et surtout comment.

Un grand merci !

Amicalement

Logfile of HijackThis v1.99.1
Scan saved at 19:55:25, on 16/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\apiff32.exe
C:\WINDOWS\system32\atltd.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\yvhhf.dll/sp.html#83556
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {4992E461-38DD-211A-FDE8-64A8C67647AD} - C:\WINDOWS\d3rp32.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [] C:\WINDOWS\System32\myproxy.exe
O4 - HKLM\..\Run: [atltd.exe] C:\WINDOWS\system32\atltd.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O8 - Extra context menu item: Barre RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Bloquer ce serveur... - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Bloquer cette publicité... - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Ouvrir tous les liens de la page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Rechercher sur le Web... - C:\Program Files\Avant Browser\Search.htm
O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Surligner - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Traduire cette page - C:\WINDOWS\web\powertoy.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3DD8A0D-AF8D-4D70-9679-CBBB53BA81A8}: NameServer = 192.168.0.1
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\apiff32.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
A voir également:

1 réponse

Réponse 1 / 1
jean38 Messages postés 2534 Date d'inscription   Statut Contributeur Dernière intervention   47
 
salut,

pour plus de securite, peux tu tester les fichiers suivants sur

http://virusscan.jotti.org
et colle les rapports

fichiers à tester:
C:\WINDOWS\system32\apiff32.exe
C:\WINDOWS\system32\atltd.exe
C:\WINDOWS\d3rp32.dll

POUR LE RESTE, on verra après ta reponse

A+
0
pmccm Messages postés 167 Statut Membre 68
 
Bonjour Jean,

Tout d'abord, un grand merci pour ta réponse rapide.
Tu trouveras ci-dessous ce que tu m'as demandé.

Merci encore

Amicalement

Philippe



================================= C:\WINDOWS\system32\apiff32.exe
Service load:

0% 100%
File: apiff32.exe Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 aa847c41687d80586530676b382d0cf0 Packers detected:
PE-CRYPT.SUE, UPX
Scanner results AntiVir
Found TR/Agent.BI ArcaVir
Found Trojan.Agent.Bi Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found GenPack:Trojan.Agent.BI ClamAV
Found nothing Dr.Web
Found nothing F-Prot Antivirus
Found W32/Agent.SH Fortinet
Found W32/Agent.BI-tr Kaspersky Anti-Virus
Found Trojan.Win32.Agent.bi NOD32
Found Win32/TrojanDownloader.Agent.BQ Norman Virus Control
Found nothing UNA
Found nothing VBA32
Found Trojan.Win32.Agent.bi
Last file scanned at least one scanner reported something about: Dropped:Exploit.LSASS.C in wintbp.zip, detected by:


Scanner Malware name
AntiVir X
ArcaVir X
Avast X
AVG Antivirus X
BitDefender Dropped:Exploit.LSASS.C
ClamAV X
Dr.Web X
F-Prot Antivirus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 probably unknown NewHeur_PE
Norman Virus Control Sandbox: W32/Malware
UNA X
VBA32 X


You're free to (mis)interpret these automated, flawed statistics at your own discretion


================================= C:\WINDOWS\system32\atltd.exe

Service load:

0% 100%
File: atltd.exe Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5 e3b8c7e6d0904e927ea70a6263fe2b66 Packers detected:
-
Scanner results AntiVir
Found TR/Dldr.Small.bcj.1 ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found GenPack:Trojan.Downloader.Agent.BQ ClamAV
Found nothing Dr.Web
Found Trojan.DownLoader.3312 F-Prot Antivirus
Found W32/Agent.QZ Fortinet
Found PossibleThreat Kaspersky Anti-Virus
Found nothing NOD32
Found Win32/TrojanDownloader.Agent.BQ Norman Virus Control
Found nothing UNA
Found nothing VBA32
Found Trojan.DownLoader.3312
Last file scanned at least one scanner reported something about: BDS/Prosti.A.2 in 543543.exe, detected by:


Scanner Malware name
AntiVir BDS/Prosti.A.2
ArcaVir Trojan.Prosti.B
Avast Win32:Trojan-gen. {Other}
AVG Antivirus BackDoor.Small.17.AP
BitDefender Backdoor.Prosti.B
ClamAV Trojan.Prosti.B
Dr.Web Trojan.MulDrop.1466
F-Prot Antivirus X
Fortinet W32/Prosti.B-bdr
Kaspersky Anti-Virus Backdoor.Win32.Prosti.b
NOD32 Win32/Prosti.B
Norman Virus Control X
UNA Backdoor.Prosti
VBA32 Backdoor.Win32.Prosti.b


================================= C:\WINDOWS\d3rp32.dll
Service load:

0% 100%
File: d3rp32.dll Status:
POSSIBLY INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: this file was only flagged as malware by heuristic detection(s). This might be a false positive. Therefore, results of this scan will not be stored in the database) MD5 513b3a2446e8cbeaf9b2d698fc60ba7d Packers detected:
PE-CRYPT.SUE, UPX
Scanner results AntiVir
Found nothing ArcaVir
Found nothing Avast
Found nothing AVG Antivirus
Found nothing BitDefender
Found nothing ClamAV
Found nothing Dr.Web
Found nothing F-Prot Antivirus
Found nothing Fortinet
Found nothing Kaspersky Anti-Virus
Found nothing NOD32
Found nothing Norman Virus Control
Found nothing UNA
Found nothing VBA32
Found Embedded.TrojanDownloader.Win32.Agent.bc (probable variant)
Last file scanned at least one scanner reported something about: BDS/Prosti.A.2 in 553.exe, detected by:


Scanner Malware name
AntiVir BDS/Prosti.A.2
ArcaVir X
Avast Win32:Trojan-gen. {Other}
AVG Antivirus BackDoor.Small.17.AP
BitDefender Backdoor.Prosti.B
ClamAV Trojan.Prosti.B
Dr.Web Trojan.MulDrop.1466
F-Prot Antivirus X
Fortinet W32/Prosti.B-bdr
Kaspersky Anti-Virus Backdoor.Win32.Prosti.b
NOD32 X
Norman Virus Control X
UNA Backdoor.Prosti
VBA32 Backdoor.Win32.Prosti.b
0

Discussions similaires

Site Easywifi.config inaccessible /
Charly -
Repeteurwifi -

8 réponses
Meilleure application pour nettoyer IPhone et photos
Berline -
Berline -

3 réponses
Impossible de se connecter a 192.168.1.1
papemane -
Quels -

5 réponses