[Virus] Comment lire les rapports ?

débutante_ Messages postés 66 Statut Membre -  
incognito02 Messages postés 3487 Statut Contributeur -
Bonjour à tous,
depuis quelques jours mon pc est très lent et au bout d'un certain temps, il ne répond plus...
Alors j'ai suivi la méthode préliminaire de désinfection postée par Séb08 et voici les rapports que j'ai obtenu

1/ après scan par Ewido Security Suite :
---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:35:38 15/08/2006

+ Scan result:

HKLM\SOFTWARE\Gator.com -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\AppInfo -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\AppInfo\DateManager -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\AppInfo\PrecisionTime -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Date Manager -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\GInternet -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\GInternet\Proxy -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gatorcme -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gatortime -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\dyn\GUS -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\Gator\stat -> Adware.Gator : No action taken.
HKLM\SOFTWARE\Gator.com\PrecisionTime -> Adware.Gator : No action taken.
HKU\S-1-5-21-1606980848-152049171-1343024091-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\GAIN -> Adware.Gator : No action taken.
C:\WINDOWS\NDNuninstall4_80.exe -> Adware.NewDotNet : No action taken.
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected\MSDM.EXE -> Backdoor.Delf.il : No action taken.
E:\WINDOWS\system32\rtnfs.exe -> Backdoor.Rbot : No action taken.
HKLM\SOFTWARE\Classes\EGDHTML.EGDialHTML -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\EGDHTML.EGDialHTML.1 -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\EGDHTML.EGDialHTML\CLSID -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\P2ECOM.EGP2ECOM -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\P2ECOM.EGP2ECOM.1 -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\P2ECOM.EGP2ECOM\CLSID -> Dialer.Generic : No action taken.
HKLM\SOFTWARE\Classes\P2ECOM.EGP2ECOM\CurVer -> Dialer.Generic : No action taken.
HKU\S-1-5-21-1606980848-152049171-1343024091-1005\Software\EGDHTML -> Dialer.Generic : No action taken.
C:\Documents and Settings\amani\Cookies\amani@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\amani\Cookies\amani@247realmedia[2].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\Invité\Cookies\invité@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@112.2o7[2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@2o7[2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@sfr.122.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\amani\Cookies\amani@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\amani\Cookies\amani@atdmt[3].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\amani\Cookies\amani@bluestreak[2].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\amani\Cookies\amani@bluestreak[3].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\amani\Cookies\amani@casinotropez[1].txt -> TrackingCookie.Casinotropez : No action taken.
C:\Documents and Settings\amani\Cookies\amani@casinotropez[2].txt -> TrackingCookie.Casinotropez : No action taken.
C:\Documents and Settings\amani\Cookies\amani@promo.casinotropez[1].txt -> TrackingCookie.Casinotropez : No action taken.
C:\Documents and Settings\amani\Cookies\amani@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : No action taken.
C:\Documents and Settings\amani\Cookies\amani@estat[1].txt -> TrackingCookie.Estat : No action taken.
C:\Documents and Settings\amani\Cookies\amani@as-eu.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\amani\Cookies\amani@as1.falkag[2].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\amani\Cookies\amani@as1.falkag[3].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\amani\Cookies\amani@sel.as-eu.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\amani\Cookies\amani@sel.as-eu.falkag[2].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-abcnetmarketing.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-noven.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-ogilvyinteractive.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-systran.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-warnerbrothers.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ehg-yvesrocher.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ivwbox[1].txt -> TrackingCookie.Ivwbox : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ads.pointroll[2].txt -> TrackingCookie.Pointroll : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ads.pointroll[3].txt -> TrackingCookie.Pointroll : No action taken.
C:\Documents and Settings\amani\Cookies\amani@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken.
C:\Documents and Settings\amani\Cookies\amani@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : No action taken.
C:\Documents and Settings\amani\Cookies\amani@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\amani\Cookies\amani@serving-sys[1].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\amani\Cookies\amani@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\amani\Cookies\amani@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\amani\Cookies\amani@www.smartadserver[3].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\amani\Cookies\amani@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\amani\Cookies\amani@tradedoubler[3].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\amani\Cookies\amani@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\amani\Cookies\amani@weborama[1].txt -> TrackingCookie.Weborama : No action taken.
C:\Documents and Settings\amani\Cookies\amani@weborama[3].txt -> TrackingCookie.Weborama : No action taken.
C:\Documents and Settings\amani\Cookies\amani@wreport.weborama[2].txt -> TrackingCookie.Weborama : No action taken.
C:\Documents and Settings\amani\Cookies\amani@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.

::Report end

2/ après scan par Bitdefender
BitDefender Online Scanner - Real Time Virus Report

Generated at: Tue, Aug 15, 2006 - 14:52:37

--------------------------------------------------------------------------

Scan Info

Scanned Files
221023

Infected Files
8

Virus Detected

Trojan.P2e.BW
2

Backdoor.Rbot.UE
1

Backdoor.Delf.IL
1

Application.Joke.Justakiss.B
2

Backdoor.RTB
2

3/Et enfin voici le log de HijackThis :

Logfile of HijackThis v1.99.1
Scan saved at 14:56:19, on 15/08/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\WINDOWS\System32\Macromed\shockwave\Remote.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=explorer.exe nstask32.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [NDplDeamon] nstask32.exe
O4 - HKLM\..\Run: [Service] C:\Documents and Settings\amani\winJHQNXOV.exe
O4 - HKLM\..\Run: [VnCplUpdate] "C:\Program Files\Fichiers communs\MSDM\msdm.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [!ewido] "E:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [Skype] "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Shockwave Init.lnk = C:\WINDOWS\system32\Macromed\Shockwave\SwInit.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe
O4 - Global Startup: Date Manager.lnk = C:\Program Files\Date Manager\DateManager.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20020124/qtinstall.info.apple.com/qt505/fr/wi...
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

Merci beaucoup pour votre aide, car je n'y connais absolument rien!!
A voir également:

61 réponses

incognito02 Messages postés 3487 Statut Contributeur 138
 
Re,

Peux tu refaire un hijackthis stp.

A+
0