[Proxy.Horst.AV + W32/Tdibd-B.] Hijack rappor

Question

Merci d'avance pour votre aide

Mes problemes :
1-Dans la racine de mes disques durs, presence de setup.exe. Si je les supprimer, ils reviennent automatiquement
2-AntiVir detecte souvent Proxy.Horst.AV mais impossible de s'en debarasser

ci joint log Hijack
ogfile of HijackThis v1.99.1
Scan saved at 23:19:03, on 25/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\modem ADSL USB\modem ADSL USB\dslmon.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\oodag.exe
f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\Explorer.EXE
F:\Download\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - F:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - f:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Regis59 · Answer

Salut

¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).

Lance un scan d antivir, sauvegarde le rapport, redemarre et donne le moi.

a+

greg.nelly · Answer

Salut Regis,Merci de ton aideVoila le rapport Antivir en mode sans echecAntiVir PersonalEdition ClassicReport file date: samedi 26 août 2006  16:52Scanning for 486845 virus strains and unwanted programs.Licensed to:      AntiVir PersonalEdition ClassicSerial number:    0000149996-WURGE-0001Platform:         Windows XPWindows version:  (Service Pack 2)  [5.1.2600]Username:         Greg & NellyComputer name:    CHAMBREVersion informations:AVSCAN.EXE   : 7.0.0.42    376872   20/08/2006 21:59:12AVSCAN.DLL   : 7.0.0.42    53288    20/08/2006 21:59:12LUKE.DLL     : 7.0.0.42    110632   20/08/2006 21:59:14LUKERES.DLL  : 7.0.0.42    25640    20/08/2006 21:59:14ANTIVIR0.VDF : 6.35.0.1    7371264  20/08/2006 21:59:10ANTIVIR1.VDF : 6.35.1.122  1270784  20/08/2006 21:59:10ANTIVIR2.VDF : 6.35.1.123  2048     20/08/2006 21:59:10ANTIVIR3.VDF : 6.35.1.145  46080    20/08/2006 21:59:10AVEWIN32.DLL : 7.1.1.2     1782272  20/08/2006 21:59:11AVPREF.DLL   : 7.0.0.1     33832    20/08/2006 21:59:12AVREP.DLL    : 6.35.1.124  524328   20/08/2006 21:59:12AVRPBASE.DLL : 7.0.0.0     1544232  20/08/2006 21:59:12AVPACK32.DLL : 7.1.0.1     331816   20/08/2006 21:59:12AVREG.DLL    : 6.31.0.90   25128    20/08/2006 21:59:12NETNT.DLL    : 6.32.0.0    6696     20/08/2006 21:59:14NETNW.DLL    : 6.32.0.0    9768     20/08/2006 21:59:14RCIMAGE.DLL  : 7.0.0.71    1642536  20/08/2006 21:59:16RCTEXT.DLL   : 7.0.0.75    77864    20/08/2006 21:59:16Configuration settings for the scan:Jobname: '%s'.................: Manual SelectionConfiguration file............: C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avpBoot sectors..................: C,FScan memory...................: 1Process scan..................: 1Scan all files................: 2Scan archives.................: 1Recursion depth...............: 20Smart extensions..............: 1Macro heuristic...............: 1File heuristic................: -1Primary action................: 1Secondary action..............: 0Start of the scan: samedi 26 août 2006  16:52The scan over running processes will be started13 Processes was scannedStart scanning boot sectors:Boot sector 'C:\'      [NOTE]      No virus was found!Boot sector 'F:\'      [NOTE]      No virus was found!Starting to scan the registry.The registry was scanned ( 15 files ).Starting the file scan:C:\pagefile.sys      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\NTUSER.DAT      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly
tuser.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat      [WARNING]   The file could not be opened!C:\Documents and Settings\Greg & Nelly\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\NTUSER.DAT      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService
tuser.dat.LOG      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat      [WARNING]   The file could not be opened!C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\default      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\default.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SAM      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SAM.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SECURITY      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\SECURITY.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\software      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\software.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\system      [WARNING]   The file could not be opened!C:\WINDOWS\system32\config\system.LOG      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\sptd.sys      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\sptd1933.sys      [WARNING]   The file could not be opened!C:\WINDOWS\system32\drivers\vaxscsi.sys      [WARNING]   The file could not be opened!End of the scan: samedi 26 août 2006  17:32Used time: 39:38 minThe scan has been done completely.   3510 Scanning directories 127662 Files were scanned      0 viruses and/or unwanted programs was found      0 files were deleted      0 files were repaired      0 files were moved to quarantine      0 files were renamed    976 Archives were scanned     22 Warnings      1 NotesA+

Regis59 · Answer

Salutrien n est détecté !Lance ce scan en ligne: http://www.bitdefender.fr/scan8/ie.html  Copie/colle le rapporta+

greg.nelly · Answer

Ci joint re rapport, rien a signaler

*BitDefender Online Scanner*
*Scan report generated at: Sat, Aug 26, 2006 - 18:59:49*
* *
*Scan path: *C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;
* *
*Statistics*
Time
00:27:43
Files
170044
Folders
3673
Boot Sectors
5
Archives
1674
Packed Files
11602
*Results*
Identified Viruses
0
Infected Files
0
Suspect Files
0
Warnings
0
Disinfected
0
Deleted Files
0
*Engines Info*
Virus Definitions
450834
Engine build
AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
Scan plugins
13
Archive plugins
39
Unpack plugins
5
E-mail plugins
6
System plugins
1
*Scan Settings*
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
*Scanned File*
* Status*
No virus found.
* *
* *

Mais les fichiers setup.exe sont jrs la

Merci de ton aide

Regis59 · Answer

Salutou se situent ils exactement?a+

greg.nelly · Answer

SAlutJ'ai deux disques durs et trois partitions C: F: I:Sur F: et I: j'ai ces fichiers pas sur c:. Ils sont directement dans la racinemercia+

Regis59 · Answer

SalutRend toi sur ce site :http://www.virustotal.com/xhtml/virustotal_en.html Clik sur parcourirRecherche leClik send et colle le rapport stpA+

greg.nelly · Answer

Salut

oulalala y a pas mal de monde la dedans.....

Complete scanning result of "setup.exe", received in VirusTotal at 08.27.2006, 01:01:38 (CET).

Antivirus Version Update Result
AntiVir 6.35.1.3 08.26.2006 HEUR/Trojan.Downloader
Authentium 4.93.8 08.25.2006 W32/Methodbod.gen
Avast 4.7.844.0 08.24.2006 no virus found
AVG 386 08.25.2006 no virus found
BitDefender 7.2 08.27.2006 no virus found
CAT-QuickHeal 8.00 08.26.2006 no virus found
ClamAV devel-20060426 08.26.2006 no virus found
DrWeb 4.33 08.26.2006 Trojan.Spambot
eTrust-InoculateIT 23.72.107 08.25.2006 no virus found
eTrust-Vet 30.3.3039 08.25.2006 no virus found
Ewido 4.0 08.25.2006 no virus found
Fortinet 2.77.0.0 08.27.2006 W32/Horst.AV!tr
F-Prot 3.16f 08.25.2006 W32/Methodbod.gen
F-Prot4 4.2.1.29 08.26.2006 W32/Methodbod.gen
Ikarus 0.2.65.0 08.25.2006 no virus found
Kaspersky 4.0.2.24 08.27.2006 Trojan-Proxy.Win32.Horst.av
McAfee 4838 08.25.2006 no virus found
Microsoft 1.1560 08.27.2006 no virus found
NOD32v2 1.1727 08.26.2006 a variant of Win32/Medbot.BJ
Norman 5.90.23 08.25.2006 no virus found
Panda 9.0.0.4 08.26.2006 Suspicious file
Sophos 4.08.0 08.26.2006 no virus found
Symantec 8.0 08.26.2006 no virus found
TheHacker 5.9.8.200 08.25.2006 no virus found
UNA 1.83 08.27.2006 no virus found
VBA32 3.11.1 08.25.2006 no virus found
VirusBuster 4.3.7:9 08.26.2006 no virus found

Aditional Information
File size: 48640 bytes
MD5: b28688c79ce69def9db3a95788b771f6
SHA1: 6015303c81a80c22c0e94b94c3321c96d3ec10a4
packers: UPX
packers: UPX

Comment virer tout ca ?

merci d'vance

a+

Regis59 · Answer

Salutsur le fichier que tu as scanne, clik droit dessu et choisis supprimerVide ensuite ta poubellea+

greg.nelly · Answer

Salut Regis

Ca y est j'ai supprimé les fichiers setup.exe

Il y avait aussi des fichiers autorunf.inf qui contenait
[autorun]
open=setup.exe
icon=setup.exe,0

Je les ai viré aussi

C'est tout? tu crois que c'est ok maintenant ?

merci

Regis59 · Answer

SalutOu en sont tes soucis maintenant, c est ok?a+

greg.nelly · Answer

Salut regisapres 24h ca a l'air okles fichiers ne sont pas reapparusmerci de ton aidea+

Regis59 · Answer

salutok content pour toibonne continuationa+

[Proxy.Horst.AV + W32/Tdibd-B.] Hijack rappor

13 réponses

Discussions similaires

Newsletters