[Virus] Programme inconnu Fermé

Question

Bonjour,

J'ai lancé Rootkit Reveal et il apparaît des fichiers qui ont attiré mon attention :

C:\WINNT\system32\vzcbkl.dat 04/09/2006 16:47 9.16 KB Hidden from Windows API.
C:\WINNT\system32\vzcbkl.exe 04/09/2006 10:34 252.50 KB Hidden from Windows API.
C:\WINNT\system32\vzcbkl_nav.dat 25/08/2006 18:36 274.65 KB Hidden from Windows API.
C:\WINNT\system32\vzcbkl_navps.dat 04/09/2006 16:47 4.24 KB Hidden from Windows API.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vzcbkl 04/09/2006 10:35 72 bytes Hidden from Windows API.

Lorsque je vais dans le dossier C:\WINNT\system32\ toutes ces entrées n'apparaissent pas, pourtant j'ai bien l'option afficher les fichiers et dossier caché. J'ai effectué une recherche sur google et aucune information n'apparaît, mon antivirus f-secure ne détecte rien de particulier, adaware et spybot non plus.
J'ai effectué ce scan car depuis peu, j'ai un popup qui s'ouvre avec de la publicité pour des services payant par audiotel ( sonnerie, rencontre, vidéo comique et sexy etc...)
Je ne sais donc plus trop quoi faire pour me débarrasser de ce popup et j'aimerais savoir aussi ,si le programme que Rootkit Reveal a détecté est un virus ou autre.

Je vous remercie d'avance pour votre aide

Utilisateur anonyme · Answer

Salut,

Télécharges Blacklight et sauvegarde le sur ton bureau.
https://www.f-secure.com/en
Double cliques sur " blbeta.exe " et acceptes la licence; clic sur "Scan" puis "Next"

Un rapport, va se créer sur ton bureau "fslb-....."

Copies et colles le contenu de ce rapport ici stp

Bertrand · Answer

Le voici :

09/04/06 18:50:07 [Info]: BlackLight Engine 1.0.46 initialized
09/04/06 18:50:07 [Info]: OS: 5.0 build 2195 (Service Pack 4)
09/04/06 18:50:07 [Note]: 7019 4
09/04/06 18:50:07 [Note]: 7005 0
09/04/06 18:50:15 [Note]: 7006 0
09/04/06 18:50:15 [Note]: 7011 1172
09/04/06 18:50:15 [Note]: 7026 0
09/04/06 18:50:15 [Note]: 7026 0
09/04/06 18:50:15 [Note]: 7024 3
09/04/06 18:50:15 [Info]: Hidden process: C:\winnt\system32\vzcbkl.exe
09/04/06 18:50:15 [Note]: FSRAW library version 1.7.1019
09/04/06 18:53:07 [Info]: Hidden file: c:\WINNT\system32\vzcbkl.dat
09/04/06 18:53:07 [Note]: 10002 1
09/04/06 18:53:08 [Info]: Hidden file: C:\winnt\system32\vzcbkl.exe
09/04/06 18:53:08 [Note]: 10002 1
09/04/06 18:53:09 [Info]: Hidden file: c:\WINNT\system32\vzcbkl_nav.dat
09/04/06 18:53:09 [Note]: 10002 1
09/04/06 18:53:10 [Info]: Hidden file: c:\WINNT\system32\vzcbkl_navps.dat
09/04/06 18:53:10 [Note]: 10002 1

Bertrand · Answer

J'ai pu supprimer ces trois fichiers :c:\WINNT\system32\vzcbkl.dat.ren c:\WINNT\system32\vzcbkl_nav.dat.ren c:\WINNT\system32\vzcbkl_navps.dat.ren Je n'ai pas retrouvé celui-ci :c:\WINNT\system32\vzcbkl.exe.ren Le rapport de BFU sauvegardé :BFU v1.00.9Windows 2000 SP4 (WinNT 5.00.2195 SP4)Script started at 21:01:52, on 04/09/2006Option Delete files to Recycle Bin: YesFailed: RegDelValue HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices|MC (key not found)Failed: DllUnregister C:\WINNT\system32\MSWBM32.DLL|1 (file not found)Failed: DllUnregister C:\Program Files\MailSkinner\OESkinner.dll|1 (file not found)Failed: FolderDelete C:\Program Files\dialpass (folder not found)Failed: FolderDelete C:\Program Files\eghtmldialer (folder not found)Failed: FolderDelete C:\Program Files\egroup (folder not found)Failed: FolderDelete C:\Program Files\Instant Access (folder not found)Failed: FolderDelete C:\Program Files\MailSkinner (folder not found)Failed: FolderDelete C:\Program Files\InternetGameBox (folder not found)Failed: DllUnregister C:\WINNT\mslagent\2_mslagent.dll|1 (file not found)Failed: DllUnregister C:\WINNT
avmpc\2_navmpc.dll|1 (file not found)Failed: FolderDelete C:\WINNT\mslagent (folder not found)Failed: FolderDelete C:\WINNT
avmpc (folder not found)Failed: FolderDelete C:\WINNT\msskinner (folder not found)Failed: FolderDelete C:\WINNT\wintrim (folder not found)Failed: FolderDelete C:\WINNT\wincomp (folder not found)Failed: FolderDelete C:\WINNT\winmgts (folder not found)Failed: FolderDelete C:\WINNT\simcss (folder not found)Failed: FolderDelete C:\WINNT\mc (folder not found)Failed: FileDelete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fla167.tmp (operation failed)Failed: FileDelete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF9FB1.tmp (operation failed)Failed: FileDelete C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFDE57.tmp (operation failed)Failed: FileDelete C:\WINNT\Temp\ZLT04910.TMP (operation failed)Failed: FileDelete C:\WINNT\Temp\ZLT0491a.TMP (operation failed)Script completed.Le nouveau rapport de blacklight :09/04/06 21:36:08 [Info]: BlackLight Engine 1.0.46 initialized09/04/06 21:36:08 [Info]: OS: 5.0 build 2195 (Service Pack 4)09/04/06 21:36:08 [Note]: 7019 409/04/06 21:36:08 [Note]: 7005 009/04/06 21:36:11 [Note]: 7006 009/04/06 21:36:11 [Note]: 7011 103609/04/06 21:36:11 [Note]: 7026 009/04/06 21:36:11 [Note]: 7026 009/04/06 21:36:16 [Note]: FSRAW library version 1.7.101909/04/06 21:41:48 [Note]: 7007 0

Bertrand · Answer

Merci pour ton aide, voici le log apparemment il y est encore :Logfile of HijackThis v1.99.1Scan saved at 23:57:45, on 04/09/2006Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXEC:\WINNT\System32\svchost.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXEC:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exeC:\Program Files\F-Secure Internet Security\Common\FSMA32.EXEC:\Program Files\F-Secure Internet Security\Common\FSMB32.EXEC:\Program Files\F-Secure Internet Security\Common\FCH32.EXEC:\WINNT\system32
vsvc32.exeC:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXEC:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exeC:\WINNT\system32\ZoneLabs\vsmon.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exeC:\WINNT\Explorer.EXEC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\sstray.exeC:\Program Files\Creative\Mouse Optical\mouse_2k.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\F-Secure Internet Security\Common\FSM32.EXEC:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exeC:\WINNT\system32\internat.exeC:\Program Files\photo\Vidalia\vidalia.exeC:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exeC:\Program Files\photo\Privoxy\privoxy.exeC:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exeC:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exeC:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Winamp\winamp.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\Administrateur\Bureau\CCM\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [CreativeMouse ] C:\Program Files\Creative\Mouse Optical\mouse_2k.exeO4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startupO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKLM\..\Run: [vzcbkl] c:\winnt\system32\vzcbkl.exe vzcbklO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"O4 - HKCU\..\Run: [internat.exe] internat.exeO4 - HKCU\..\Run: [Vidalia] "C:\Program Files\photo\Vidalia\vidalia.exe"O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exeO4 - Global Startup: Privoxy.lnk = C:\Program Files\photo\Privoxy\privoxy.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htmO8 - Extra context menu item: Outil de dÃ©monstration Google AdSense - http://pagead2.googlesyndication.com/pagead/preview/fr/preview.htmlO9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dllO9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dllO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.htmlO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXEO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXEO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32
vsvc32.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcappcapd.exe" -d -f "%ProgramFiles%\WinPcappcapd.ini (file missing)O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

[Virus] Programme inconnu

4 réponses

Discussions similaires