Bonjour
je suis infecté par le virus Win32.Trojan.gen
Avast a stocké 4 fichiers en quarantaine :
J'ai téléchargé HijackThis et voici le rapport :
Logfile of HijackThis v1.99.1
Scan saved at 11:15:16, on 03/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arnaud\LOGICIELS\Antivirus\aswUpdSv.exe
C:\Arnaud\LOGICIELS\Antivirus\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Arnaud\LOGICIELS\powerdvd\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Arnaud\LOGICI~1\ANTIVI~1\ashDisp.exe
C:\Arnaud\LOGICIELS\Antivirus\ashWebSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\lclock.exe
C:\WINDOWS\system32\svchost.exe
C:\Arnaud\LOGICIELS\Antivirus\ashSimpl.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Arnaud\LOGICIELS\Antivirus\ashChest.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Arnaud\LOGICIELS\sécurité vs bacdoor\hijach this\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://melanthios-ana.com/zcvisitor/1624d318-3614-11eb-87b9-12a1ab6c324d/72092e88-2c53-401c-b988-51ef43ce1034?campaignid=47f83760-f118-11ea-9bc8-0ac2bbf4ada7
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [RemoteControl] C:\Arnaud\LOGICIELS\powerdvd\PDVDServ.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Arnaud\LOGICIELS\firewall\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [avast!] C:\Arnaud\LOGICI~1\ANTIVI~1\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P] Warhammer Mark of Chaos
O4 - HKCU\..\Run: [LClock] lclock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\OFFICE\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Arnaud\LOGICIELS\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger sélection avec Free Download Manager - file://C:\Arnaud\LOGICIELS\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger tout avec Free Download Manager - file://C:\Arnaud\LOGICIELS\Free Download Manager\dlall.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\OFFICE\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\arnaud\logiciels\firewall\ashampoo firewall\spi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.girafoto.fr/uploaders/ImageUploader3.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) -
http://ww11.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - http://srvnotes.hardis.fr/dwa7W.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arnaud\LOGICIELS\Antivirus\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Arnaud\LOGICIELS\Antivirus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arnaud\LOGICIELS\Antivirus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Arnaud\LOGICIELS\Antivirus\ashWebSv.exe" /service (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Arnaud\bin\nSvcAppFlt.exe (file missing)
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Arnaud\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Arnaud\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Arnaud\bin\nSvcLog.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - Unknown owner - C:\WINDOWS\system32\oodag.exe (file missing)
O23 - Service: Service CANALPLAY - Unknown owner - C:\Arnaud\LOGICIELS\canal play\CanalPlayService.exe (file missing)
Afficher la suite