[virus] infecté par hidrag Fermé

Question

salutmauvaise surprise ce matin, svchost infecté pas Hidrag,avant toute chose je poste le log de HJT, si quelqu'un peux y jeter un coup d'oeil, c coolmerci d'avance.Logfile of HijackThis v1.99.1Scan saved at 09:06:06, on 06/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Apoint\Apoint.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\system32\ICO.EXEC:\WINDOWS\ATK0100\Hcontrol.exeC:\WINDOWS\system32\ezSP_Px.exeC:\Program Files\Sony\HotKey Utility\HKserv.exeC:\Program Files\sony\vaio power management\SPMgr.exeC:\Program Files\sony\vaio update 2\VAIOUpdt.exeC:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exeC:\Program Files\Sony\ISB Utility\ISBMgr.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exeC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\Logitech\Video\LogiTray.exeC:\WINDOWS\TPPALDR.EXEC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXEC:\WINDOWS\system32\LVComS.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Messenger\msmsgs.exeC:\Apple\Library\System\WindowServer.exeC:\Program Files\Apoint\Apntex.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\Sony\HotKey Utility\HKWnd.exeC:\Apple\Library\System\machd.exeC:\Program Files\FileZilla Server\FileZilla Server.exeC:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exeC:\WINDOWS\system32\invoker.exeC:\Apple\OpenBase\bin\openexec.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Timbuktu Pro	b2launch.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\WINDOWS\NetopiaRC\Tb2RCAssist.exeC:\Program Files\Timbuktu Pro	b2pro.exeC:\Apple\OpenBase\bin\openinfo.exeC:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exeC:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exeC:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exeC:\Apple\Library\System
mserver.exeC:\WINDOWS\system32\java.exeC:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exeC:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exeC:\Apple\OpenBase\bin\OpenBase.exeC:\Program Files\Timbuktu Pro\TNOTIFY.EXEC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\svchost.exeD:\F\installs\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://172.29.1.200/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.sony-europe.com/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.29.1.23:8080R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - (no file)O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXEO4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exeO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exeO4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exeO4 - HKLM\..\Run: [SonyPowerCfg] C:\Program Files\sony\vaio power management\SPMgr.exeO4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\sony\vaio update 2\VAIOUpdt.exe" /StationaryO4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exeO4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exeO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exeO4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXEO4 - HKLM\..\Run: [G5GeKMD] C:\WINDOWS\uolcqpan.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [LoginPath] C:\Program Files\Timbuktu Pro\login.exeO4 - HKLM\..\Run: [Tb2initPath] C:\Program Files\Timbuktu Pro	b2init.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /hO4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXEO4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Program Files\FileZilla Server\FileZilla Server Interface.exe"O4 - HKLM\..\Run: [KAVPersonal50] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimizeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXEO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Pasteboard Server.lnk = C:\Apple\Library\Frameworks\AppKit.framework\Resources\pbs.exeO4 - Global Startup: Window Server.lnk = C:\Apple\Library\System\WindowServer.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\j2re1.4.2_04\bin
pjpi142_04.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Java\j2re1.4.2_04\bin
pjpi142_04.dllO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll (file missing)O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll (file missing)O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/O15 - Trusted Zone: *.club-vaio.comO15 - Trusted Zone: *.sony-europe.comO15 - Trusted Zone: *.sonystyle-europe.comO15 - Trusted Zone: *.vaio-link.comO15 - Trusted Zone: http://ny.contentmatch.net (HKLM)O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialS...O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/infoO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://support.norton.com/sp/en/us/home/current/infoO16 - DPF: {D28C3640-A6D7-4668-A53C-07A9CF67D157} (CFnacComposantCtrl Object) - https://www.fnacmusic.com/telechargementFnacmusic/FnacComposant.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{A08480FC-F3FA-45A1-A415-390FAA5D2958}: NameServer = 193.107.80.148,193.107.80.63O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dllO23 - Service: Apple Mach Daemon (Apple_Mach_Daemon) - Unknown owner - C:\Apple\Library\System\machd.exeO23 - Service: Apple Netname Server (Apple_Netname_Server) - Unknown owner - %NEXT_ROOT%\Library\System
mserver.exe (file missing)O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - C:\Program Files\FileZilla Server\FileZilla Server.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exeO23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exeO23 - Service: openexec - Unknown owner - C:\WINDOWS\system32\invoker.exeO23 - Service: OracleDEFAULT_HOMAgent - Oracle Corporation - D:\orant\bin\agntsrvc.exeO23 - Service: OracleDEFAULT_HOMClientCache - Unknown owner - D:\orant\BIN\ONRSD.EXEO23 - Service: OracleDEFAULT_HOMHTTPServer - Unknown owner - D:\orant\Apache\Apache\apache.exe" --ntservice (file missing)O23 - Service: OracleDEFAULT_HOMPagingServer - Unknown owner - D:\orant/bin/pagntsrv.exeO23 - Service: OracleDEFAULT_HOMSNMPPeerEncapsulator - Unknown owner - D:\orant\BIN\ENCSVC.EXEO23 - Service: OracleDEFAULT_HOMSNMPPeerMasterAgent - Unknown owner - D:\orant\BIN\AGNTSVC.EXEO23 - Service: OracleDEFAULT_HOMTNSListener - Unknown owner - D:\orant\BIN\TNSLSNR.exeO23 - Service: OracleMTSRecoveryService - Oracle Corporation - D:\orant\bin\omtsreco.exeO23 - Service: OracleServiceDBDB - Oracle Corporation - d:\orant\bin\ORACLE.EXEO23 - Service: Timbuktu Launch (Tb2Launch) - Netopia, Inc. - C:\Program Files\Timbuktu Pro	b2launch.exeO23 - Service: Timbuktu Remote Control Assistant (Tb2RCAssist) - Netopia, Inc. - C:\WINDOWS\NetopiaRC\Tb2RCAssist.exeO23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exeO23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\vaio entertainment\VzTaskScheduler.exeO23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exeO23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exeO23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exeO23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exeO23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exeO23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exeO23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exeO23 - Service: Apple WebObjects Monitor 5 (WOMONITOR5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\JavaMonitor.woa\WOMonitorService.exeO23 - Service: Apple WebObjects Task Daemon 5 (WOTASKD5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exe

green day · Answer

Salut commence par ça stp :https://www.commentcamarche.net/faq/2490-supprimer-les-adwares-publicites-intempestives-pop-up-etc ++***Le deuxieme mot le plus important apres Aimer, c'est Aider! ...***

incognito02 · Answer

Bonsoir Dav,Tu as une config logiciel plutot rare !Dans un premier temps, fait déja tout cela : telecharge et execute ces antispywares ( pense a les mettre a jour avant de les lancer) (1) ad-aware version 1.06 (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite voir demo http://pageperso.aol.fr/balltrap34/adwseflash.zip *** (2) spybot version 1.4 (ici) http://www.florensac-chasse-trap.com/ section virus/logiciel de securite voir demo d utilisation http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm *** et aussi ceci (3) CleanUp40.exe http://www.florensac-chasse-trap.com/ section virus/logiciel de securite voir demo http://pageperso.aol.fr/balltrap34/democleanup.htm *** (4) Edwido http://download.ewido.net/ewido-setup.exe Pendant l'installation, sur la page "Additional Options", décoche les deux options "Install background guard" et "Install scan via context menu Ewido Security Suite. Clique sur mise à jour. Clique sur scanner puis sur scan complet du système. (5) Relance hijackthis et colle le log ici stp. Bon courage A+

incognito02 · Answer

Oups,Excuses moi Green Day  ;-)Je n'avais pas vu que tu avais déja réponduje te laisse ce post si tu veux....A++

green day · Answer

lol ! pas grave ;-) continue ++

incognito02 · Answer

On continu ensemble si tu veux ?A+

green day · Answer

go !***Le deuxieme mot le plus important apres Aimer, c'est Aider! ...***

[virus] infecté par hidrag

6 réponses

Discussions similaires