[Proxy.Horst.AV + W32/Tdibd-B.] Hijack rappor

Question

Merci d'avance pour votre aideMes problemes : 1-Dans la racine de mes disques durs, presence de setup.exe. Si je les supprimer, ils reviennent automatiquement2-AntiVir detecte souvent Proxy.Horst.AV mais impossible de s'en debarasserci joint log Hijackogfile of HijackThis v1.99.1Scan saved at 23:19:03, on 25/08/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXEC:\Program Files\Java\jre1.5.0_07\bin\jusched.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\system32\LVCOMSX.EXEC:\Program Files\AntiVir PersonalEdition Classic\avgnt.exeC:\Program Files\a-squared Anti-Malware\a2guard.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exeC:\Program Files\AntiVir PersonalEdition Classic\sched.exeC:\Program Files\AntiVir PersonalEdition Classic\avguard.exeC:\WINDOWS\system32\oodag.exef:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\WINDOWS\Explorer.EXEF:\Download\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=sslR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%sR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /minO4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: DSLMON.lnk = ?O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLLO9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dllO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exeO23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NBService - Nero AG - F:\Program Files\Nero 7\Nero BackItUp\NBService.exeO23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exeO23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe (file missing)O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Regis59 · Answer

Salut¤Démarre en mode sans échec : Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5).  Lance un scan d antivir, sauvegarde le rapport, redemarre et donne le moi.a+

greg.nelly · Answer

Salut Regis,Merci de ton aideVoila le rapport Antivir en mode sans echecAntiVir PersonalEdition ClassicReport file date: samedi 26 août 2006  16:52Scanning for 486845 virus strains and unwanted programs.Licensed to:      AntiVir PersonalEdition ClassicSerial number:    0000149996-WURGE-0001Platform:         Windows XPWindows version:  (Service Pack 2)  [5.1.2600]Username:         Greg & NellyComputer name:    CHAMBREVersion informations:AVSCAN.EXE   : 7.0.0.42    376872   20/08/2006 21:59:12AVSCAN.DLL   : 7.0.0.42    53288    20/08/2006 21:59:12LUKE.DLL     : 7.0.0.42    110632   20/08/2006 21:59:14LUKERES.DLL  : 7.0.0.42    25640    20/08/2006 21:59:14ANTIVIR0.VDF : 6.35.0.1    7371264  20/08/2006 21:59:10ANTIVIR1.VDF : 6.35.1.122  1270784  20/08/2006 21:59:10ANTIVIR2.VDF : 6.35.1.123  2048     20/08/2006 21:59:10ANTIVIR3.VDF : 6.35.1.145  46080    20/08/2006 21:59:10AVEWIN32.DLL : 7.1.1.2     1782272  20/08/2006 21:59:11AVPREF.DLL   : 7.0.0.1     33832    20/08/2006 21:59:12AVREP.DLL    : 6.35.1.124  524328   20/08/2006 21:59:12AVRPBASE.DLL : 7.0.0.0     1544232  20/08/2006 21:59:12AVPACK32.DLL : 7.1.0.1     331816   20/08/2006 21:59:12AVREG.DLL    : 6.31.0.90   25128    20/08/2006 21:59:12NETNT.DLL    : 6.32.0.0    6696     20/08/2006 21:59:14NETNW.DLL    : 6.32.0.0    9768     20/08/2006 21:59:14RCIMAGE.DLL  : 7.0.0.71    1642536  20/08/2006 21:59:16RCTEXT.DLL   : 7.0.0.75    77864    20/08/2006 21:59:16Configuration settings for the scan:Jobname: '%s'.................: Manual SelectionConfiguration file............: C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avpBoot sectors..................: C,FScan memory...................: 1Process scan..................: 1Scan all files................: 2Scan archives.................: 1Recursion depth...............: 20Smart extensions..............: 1Macro heuristic...............: 1File heuristic................: -1Primary action................: 1Secondary action..............: 0Start of the scan: samedi 26 août 2006  16:52The scan over running processes will be started13 Processes was scannedStart scanning boot sectors:Boot sector 'C:\'      [NOTE]      No virus was found!Boot sector 'F:\'      [NOTE]      No virus was found!Starting to scan the registry.The registry was scanned ( 15 files ).Starting the file scan:C:\pagefile.sys      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\NTUSER.DAT      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly
tuser.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\NTUSER.DAT      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService
tuser.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\default      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\default.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SAM      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SAM.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SECURITY      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SECURITY.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\software      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\software.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\system      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\system.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\sptd.sys      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\sptd1933.sys      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\vaxscsi.sys      [WARNING]   The file could not be opened!End of the scan: samedi 26 août 2006  17:32Used time: 39:38 minThe scan has been done completely.   3510 Scanning directories 127662 Files were scanned      0 viruses and/or unwanted programs was found      0 files were deleted      0 files were repaired      0 files were moved to quarantine      0 files were renamed    976 Archives were scanned     22 Warnings      1 NotesA+

Regis59 · Answer

Salutrien n est détecté !Lance ce scan en ligne: http://www.bitdefender.fr/scan8/ie.html  Copie/colle le rapporta+

greg.nelly · Answer

Ci joint re rapport, rien a signaler*BitDefender Online Scanner**Scan report generated at: Sat, Aug 26, 2006 - 18:59:49** **Scan path: *C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;* **Statistics*Time00:27:43Files170044Folders3673Boot Sectors5Archives1674Packed Files11602*Results*Identified Viruses0Infected Files0Suspect Files0Warnings0Disinfected0Deleted Files0*Engines Info*Virus Definitions450834Engine buildAVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)Scan plugins13Archive plugins39Unpack plugins5E-mail plugins6System plugins1*Scan Settings*First ActionDisinfectSecond ActionDeleteHeuristicsYesEnable WarningsYesScanned Extensions*;Exclude ExtensionsScan EmailsYesScan ArchivesYesScan PackedYesScan FilesYesScan BootYes*Scanned File** Status*No virus found.* ** *Mais les fichiers setup.exe sont jrs laMerci de ton aide

Regis59 · Answer

Salutou se situent ils exactement?a+

greg.nelly · Answer

SAlutJ'ai deux disques durs et trois partitions C: F: I:Sur F: et I: j'ai ces fichiers pas sur c:. Ils sont directement dans la racinemercia+

Regis59 · Answer

SalutRend toi sur ce site :http://www.virustotal.com/xhtml/virustotal_en.html Clik sur parcourirRecherche leClik send et colle le rapport stpA+

greg.nelly · Answer

Salutoulalala y a pas mal de monde la dedans.....Complete scanning result of "setup.exe", received in VirusTotal at 08.27.2006, 01:01:38 (CET).Antivirus	Version	Update	ResultAntiVir	6.35.1.3	08.26.2006	HEUR/Trojan.DownloaderAuthentium	4.93.8	08.25.2006	W32/Methodbod.genAvast	4.7.844.0	08.24.2006	no virus foundAVG	386	08.25.2006	no virus foundBitDefender	7.2	08.27.2006	no virus foundCAT-QuickHeal	8.00	08.26.2006	no virus foundClamAV	devel-20060426	08.26.2006	no virus foundDrWeb	4.33	08.26.2006	Trojan.SpamboteTrust-InoculateIT	23.72.107	08.25.2006	no virus foundeTrust-Vet	30.3.3039	08.25.2006	no virus foundEwido	4.0	08.25.2006	no virus foundFortinet	2.77.0.0	08.27.2006	W32/Horst.AV!trF-Prot	3.16f	08.25.2006	W32/Methodbod.genF-Prot4	4.2.1.29	08.26.2006	W32/Methodbod.genIkarus	0.2.65.0	08.25.2006	no virus foundKaspersky	4.0.2.24	08.27.2006	Trojan-Proxy.Win32.Horst.avMcAfee	4838	08.25.2006	no virus foundMicrosoft	1.1560	08.27.2006	no virus foundNOD32v2	1.1727	08.26.2006	a variant of Win32/Medbot.BJNorman	5.90.23	08.25.2006	no virus foundPanda	9.0.0.4	08.26.2006	Suspicious fileSophos	4.08.0	08.26.2006	no virus foundSymantec	8.0	08.26.2006	no virus foundTheHacker	5.9.8.200	08.25.2006	no virus foundUNA	1.83	08.27.2006	no virus foundVBA32	3.11.1	08.25.2006	no virus foundVirusBuster	4.3.7:9	08.26.2006	no virus foundAditional InformationFile size: 48640 bytesMD5: b28688c79ce69def9db3a95788b771f6SHA1: 6015303c81a80c22c0e94b94c3321c96d3ec10a4packers: UPXpackers: UPXComment virer tout ca ?merci d'vancea+

Regis59 · Answer

Salutsur le fichier que tu as scanne, clik droit dessu et choisis supprimerVide ensuite ta poubellea+

greg.nelly · Answer

Salut RegisCa y est j'ai supprimé les fichiers setup.exeIl y avait aussi des fichiers autorunf.inf qui contenait[autorun]open=setup.exeicon=setup.exe,0Je les ai viré aussiC'est tout? tu crois que c'est ok maintenant ?merci

Regis59 · Answer

SalutOu en sont tes soucis maintenant, c est ok?a+

greg.nelly · Answer

Salut regisapres 24h ca a l'air okles fichiers ne sont pas reapparusmerci de ton aidea+

Regis59 · Answer

salutok content pour toibonne continuationa+

[Proxy.Horst.AV + W32/Tdibd-B.] Hijack rappor

13 réponses

Discussions similaires

Newsletters