virus win32 Fermé

Question

[sdfix version 1 58 14 01 2007 16 47 52 56 microsoft windows xp version 5 1 2600 running from c sdfix safe mode checking services name path restoring windows registry entries restoring default hosts file rebooting normal mode checking files files will be copied to backups folder then removed c windows system32 erasem 2 exe deleted c windows system32 phr exe deleted c windows system32 eraseme 00343 exe deleted c docume 1 riton locals 1 temp tmp10 tmp deleted c docume 1 riton locals 1 temp tmp11 tmp deleted c docume 1 riton locals 1 temp tmp12 tmp deleted c docume 1 riton locals 1 temp tmp13 tmp deleted c docume 1 riton locals 1 temp tmp14 tmp deleted c docume 1 riton locals 1 temp tmp15 tmp deleted c docume 1 riton locals 1 temp tmp16 tmp deleted c docume 1 riton locals 1 temp tmp17 tmp deleted c docume 1 riton locals 1 temp tmp2b tmp deleted c docume 1 riton locals 1 temp tmp5 tmp deleted c docume 1 riton locals 1 temp tmp6 tmp deleted c docume 1 riton locals 1 temp tmp7 tmp deleted c docume 1 riton locals 1 temp tmp8 tmp deleted c docume 1 riton locals 1 temp tmp9 tmp deleted c docume 1 riton locals 1 temp tmpa tmp deleted c docume 1 riton locals 1 temp tmpb tmp deleted c docume 1 riton locals 1 temp tmpc tmp deleted c docume 1 riton locals 1 temp tmpd tmp deleted c docume 1 riton locals 1 temp tmpe tmp deleted c docume 1 riton locals 1 temp tmpf tmp deleted c windows system32 i deleted c windows system32 tftp2600 deleted c windows system32 tftp2784 deleted alternate stream check c windows system32 no streams found final check remaining services authorized application key export hkey local machine system currentcontrolset services sharedaccess parameters firewallpolicy standardprofile authorizedapplications list windir system32 sessmgr exe windir system32 sessmgr exe enabled xpsp2res dll 22019 c program files msn messenger msnmsgr exe c program files msn messenger msnmsgr exe enabled msn messenger 7 5 c windows system32 nerofil exe c windows system32 nerofil exe enabled nerofil c program files the all seeing eye eye exe c program files the all seeing eye eye exe enabled yahoo all seeing eye c program files activision call of duty 2 cod2mp s exe c program files activision call of duty 2 cod2mp s exe enabled cod2mp s c program files emule emule exe c program files emule emule exe enabled emule c windows system32 p2p networking p2p networking exe c windows system32 p2p networking p2p networking exe enabled p2p networking c windows system32 rundll32 exe c windows system32 rundll32 exe disabled executer une dll en tant qu application c windows system32 dpvsetup exe c windows system32 dpvsetup exe enabled microsoft directplay voice test c program files tribalweb net tribalweb exe c program files tribalweb net tribalweb exe enabled tribalweb net reseau prive sur internet c program files nero nero 7 nero home nerohome exe c program files nero nero 7 nero home nerohome exe enabled nero home c program files ea games mohda mohaa exe c program files ea games mohda mohaa exe enabled medal of honor allied assault tm c program files focus techland call of juarez coj exe c program files focus techland call of juarez coj exe disabled the call of juarez c program files bittornado btdownloadgui exe c program files bittornado btdownloadgui exe enabled btdownloadgui c program files skype phone skype exe c program files skype phone skype exe enabled skype hkey local machine system currentcontrolset services sharedaccess parameters firewallpolicy domainprofile authorizedapplications list windir system32 sessmgr exe windir system32 sessmgr exe enabled xpsp2res dll 22019 c program files msn messenger msnmsgr exe c program files msn messenger msnmsgr exe enabled msn messenger 7 5 remaining files backups folder c sdfix backups backups zip listing files with hidden attributes c ntdetect com c windows system32 asycfilt dll c windows system32 comctl32 dll c windows system32 mfc42 dll c windows system32 mfc42loc dll c windows system32 msjint32 dll c windows system32 msjt3032 dll c windows system32 msjter32 dll c windows system32 msvcp60 dll c windows system32 msvcrt dll c windows system32 msvcrt20 dll c windows system32 oleaut32 dll c windows system32 olepro32 dll c windows system32 vbajet32 dll c windows system32 vbar2232 dll c windows system32 vbar332 dll c windows system32 cdplayer exe manifest c windows system32 logonui exe manifest c io sys c msdos sys c ntbootdd sys c pagefile sys finished SDFix: Version 1.58

14/01/2007 - 16:47:52,56

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:

Checking Services: 

Name: 


Path:



Restoring Windows Registry Entries
Restoring Default Hosts File

Rebooting

Normal Mode:

Checking Files:


Files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\ERASEM~2.EXE  - Deleted
C:\WINDOWS\SYSTEM32\PHR.EXE  - Deleted
C:\WINDOWS\system32\eraseme_00343.exe  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp10.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp11.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp12.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp13.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp14.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp15.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp16.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp17.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp2B.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp5.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp6.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp7.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp8.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mp9.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpA.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpB.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpC.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpD.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpE.tmp  - Deleted
C:\DOCUME~1iton\LOCALS~1\Temp	mpF.tmp  - Deleted
C:\WINDOWS\system32\i  - Deleted
C:\WINDOWS\system32\TFTP2600  - Deleted
C:\WINDOWS\system32\TFTP2784  - Deleted



Alternate Stream Check:

C:\WINDOWS\system32
No streams found.
                                 Final Check:

Remaining Services:
------------------


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\WINDOWS\system32\NeroFil.EXE"="C:\WINDOWS\system32\NeroFil.EXE:*:Enabled:NeroFil"
"C:\Program Files\The All-Seeing Eye\eye.exe"="C:\Program Files\The All-Seeing Eye\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe"="C:\Program Files\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\P2P Networking\P2P Networking.exe"="C:\WINDOWS\system32\P2P Networking\P2P Networking.exe:*:Enabled:P2P Networking"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Disabled:Exécuter une DLL en tant qu'application"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\TribalWeb.net\tribalweb.exe"="C:\Program Files\TribalWeb.net\tribalweb.exe:*:Enabled:TribalWeb.net : Réseau privé sur Internet"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\EA GAMES\MOHDA\MOHAA.exe"="C:\Program Files\EA GAMES\MOHDA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault(tm)"
"C:\Program Files\Focus\Techland\Call of Juarez\CoJ.exe"="C:\Program Files\Focus\Techland\Call of Juarez\CoJ.exe:*:Disabled:The Call of Juarez"
"C:\Program Files\BitTornado\btdownloadgui.exe"="C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"


Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Listing Files with hidden attributes:

C:\NTDETECT.COM
C:\WINDOWS\system32\asycfilt.dll
C:\WINDOWS\system32\comctl32.dll
C:\WINDOWS\system32\mfc42.dll
C:\WINDOWS\system32\mfc42loc.dll
C:\WINDOWS\system32\msjint32.dll
C:\WINDOWS\system32\msjt3032.dll
C:\WINDOWS\system32\msjter32.dll
C:\WINDOWS\system32\msvcp60.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\msvcrt20.dll
C:\WINDOWS\system32\oleaut32.dll
C:\WINDOWS\system32\olepro32.dll
C:\WINDOWS\system32\vbajet32.dll
C:\WINDOWS\system32\vbar2232.dll
C:\WINDOWS\system32\vbar332.dll
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\logonui.exe.manifest
C:\IO.SYS
C:\MSDOS.SYS
C:\NTBOOTDD.SYS
C:\pagefile.sys

                                 Finished]

philae83 · Accepted Answer

Bonsoir, * Télécharge CCleaner. https://www.pcastuces.com/logitheque/ccleaner.htm Installe le dans un répertoire dédié. Décoche pendant l'installation --- les deux cases "Ajouter l'option ... " --- Contrôler les mises à jour --- Ajouter la Barre d'Outils Yahoo! CCleaner ET * télécharge AVG Anti-Spyware (ewido) https://www.avg.com/en-ww/free-antivirus-download * tu l'installes * lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente on l'utilisera plus tard PUIS * redémarre en mode sans échec http://service1.symantec.com/support/inter/tsgeninfointl.nsf/fr_docid/20020905112131924 puis lance hijackthis et coche O2 - BHO: ShprRprts - {2A8A997F-BB9F-48F6-AA2B-2762D50F9289} - C:\Program Files\ShopperReports\Bin\2.0.20\ShprRprt.dll O4 - HKLM\..\Run: [Windowsz] rwnt.exe O4 - HKLM\..\Run: [NsUpdate] C:\WINDOWS\NsUpdate.exe UPDATE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\RunServices: [Windowsz] rwnt.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: MS_update_0612_KB74062.exe O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE14} - C:\Program Files\ShopperReports\Bin\2.0.20\ShprRprt.dll O9 - Extra button: ShopperReports - Compare travel rates - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\Program Files\ShopperReports\Bin\2.0.20\ShprRprt.dll O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://1145294406000.kit.sexequalite.com/19510/CD/StarsDuPorn.exe * ferme toutes les fenêtres ouvertes y compris Internet Explorer et clique sur "fixer objet" puis * via ajout et suppression de programme, supprime si tu le trouves ShopperReports puis * Assure toi d'avoir accès à tous les fichiers -démarrer -poste de travail ou autre dossier -menu outils -options de dossier -onglet affichage puis - activer la case : Afficher les fichiers et dossiers cachés - désactiver la case : Masquer les extensions des fichiers dont le type est connu - désactiver la case : Masquer les fichier protégés du système d'exploitation Puis - Appliquer * et Supprime le(s) fichier(s) ci dessous si il(s) est (sont) présent(s) : C:\WINDOWS\NsUpdate.exe MS_update_0612_KB74062.exe -----fait une recherche pour le supprimer rwnt.exe vraisemblablement dans c:\windows\system32 sinon regarde dans c:\windows C:\Program Files\ShopperReports\ * Dans l'Explorateur Windows recache les fichiers système afin de ne pas faire d'erreur à l'avenir. Retourne à la fenêtre Paramètres de dossiers et sélectionne Ne pas afficher les fichiers cachés ou les fichiers système * lance AVG pour un scan complet et poste le rapport ensuite Clique sur le bouton Analyse (de la barre d'outils) Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine. Reviens à l'onglet Analyse. Clique sur Analyse complète du système. A la fin du scan, choisis l'option 3 "Appliquer toutes les actions " en bas. Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. poste le * lance Ccleaner pour un nettoyage complet * poste un nouveau rapport hijackthis ainsi que celui d'AVG

philae83 · Answer

Bonjour

* Télécharge HijackThis et poste le rapport stp

http://pchelpbordeaux.free.fr/logiciels.html
Tutorial
http://pchelpbordeaux.free.fr/tuto.html
Démo en image
http://pageperso.aol.fr/balltrap34/demohijack.htm

Virus win32

2 réponses

Discussions similaires