[Trojan] Iedriver, Starpage, hldrrr.exe
Résolu
Bonsoir,
J'utilise l'Antivirus Trend et en passant le webscanner de kaspersky, j'obtiens le rapport suivant :
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, February 22, 2007 6:00:05 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 21/02/2007
Enregistrements dans la base antivirus Kaspersky : 256634
-------------------------------------------------------------------------------
Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai
Cible de l'analyse - Zones critiques:
C:\WINDOWS
c:\TEMP\
Statistiques de l'analyse:
Total d'objets analysés: 19688
Nombre de virus trouvés: 2
Nombre d'objets infectés: 4 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 00:58:51
Nom de l'objet infecté / Nom du virus / Dernière action
C:\WINDOWS\Debug\Netlogon.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\Internet Logs\tvDebug.log L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\1scenicid.exe Infecté : Trojan.Win32.StartPage.ame ignoré
C:\WINDOWS\system32\3scenices.exe/iedriver.exe Infecté : Trojan-Clicker.Win32.Iedriver.a ignoré
C:\WINDOWS\system32\3scenices.exe InstallCreator: infecté - 1 ignoré
C:\WINDOWS\system32\3scenices.exe UPX: infecté - 1 ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\JET40F8.tmp L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
Analyse terminée.
Merci de me m'aider car je ne sais plus quoi faire !!!!
J'utilise l'Antivirus Trend et en passant le webscanner de kaspersky, j'obtiens le rapport suivant :
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, February 22, 2007 6:00:05 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 21/02/2007
Enregistrements dans la base antivirus Kaspersky : 256634
-------------------------------------------------------------------------------
Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai
Cible de l'analyse - Zones critiques:
C:\WINDOWS
c:\TEMP\
Statistiques de l'analyse:
Total d'objets analysés: 19688
Nombre de virus trouvés: 2
Nombre d'objets infectés: 4 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 00:58:51
Nom de l'objet infecté / Nom du virus / Dernière action
C:\WINDOWS\Debug\Netlogon.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\Internet Logs\tvDebug.log L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\1scenicid.exe Infecté : Trojan.Win32.StartPage.ame ignoré
C:\WINDOWS\system32\3scenices.exe/iedriver.exe Infecté : Trojan-Clicker.Win32.Iedriver.a ignoré
C:\WINDOWS\system32\3scenices.exe InstallCreator: infecté - 1 ignoré
C:\WINDOWS\system32\3scenices.exe UPX: infecté - 1 ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\Temp\JET40F8.tmp L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
Analyse terminée.
Merci de me m'aider car je ne sais plus quoi faire !!!!
Configuration: Windows XP Firefox 2.0.0.1
12 réponses
-
ModérateurSalut
Télécharge ceci sur ton bureau :
Lien : hijackthis
Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm
Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.
++ -
Bonsoir,
Fixwareout report files me donne ce résultat (apres avoir du renommer le fichier .cmd en .bat car XP n'a pas voulu le lancer la 1ere fois...)
Fixwareout Last edited 2/11/2007
Post this report in the forums please
...
»»»»»Prerun check
»»»»» System restarted
»»»»» Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
»»»»» Misc files.
....
»»»»» Checking for older varients.
....
Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.
Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or https://virusscan.jotti.org/
»»»»» Other
»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RegProt"="d:\\program files\\diamondcs\\regprot.exe /start"
"Apoint"="C:\\Program Files\\Apoint\\Apoint.exe"
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"FinePrint Dispatcher v5"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\fpdisp5a.exe"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hldrrr"="C:\\WINDOWS\\system32\\hldrrr.exe"
"SpybotSD TeaTimer"="D:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»
Hijack logfile :
Logfile of HijackThis v1.99.1
Scan saved at 21:00:53, on 22/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\program files\diamondcs\regprot.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\LVComsX.exe
D:\Install\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nt2000s:81/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = c:\der_proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;10.241.0.0;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RegProt] d:\program files\diamondcs\regprot.exe /start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Moniteur de réseau sans fil G.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: fdjeux -
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{F246C158-F1EC-4EA1-ABF1-BC9C26691D89}: NameServer = 213.36.80.1
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHIE~1\Stardock\mcpstub.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AutoIP Auto Bootp - Alexandria Software Consulting - C:\Program Files\AutoIP\autoipservice.exe
O23 - Service: AutoIP Ping Daemon (AutoIPPingDaemon) - Unknown owner - C:\Program Files\AutoIP\daemon.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Program Files\Canon\DIAS\CnxDIAS.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: Apache Tomcat etomcat (etomcat) - Unknown owner - C:\Program Files\AutoIP\tomcat5\bin\tomcat5.exe" //RS//etomcat (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hirschmann Industrial HiVision 2.00 Master Service (HiMasterService 2.00) - Unknown owner - C:\Program Files\Hirschmann\Industrial HiVision 2.0\services\HiMasterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IntravueScanner - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueScanner.exe
O23 - Service: IntravueServer - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueServer.exe
O23 - Service: IntravueSupervisor - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueSupervisor.exe
O23 - Service: MySql - Unknown owner - D:\mysql\bin\mysqld-nt (file missing)
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: S7 Global Services (s7asysvx) - SIEMENS AG - C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\S7IEPG\s7oiehsx.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
End of logfile...
Remarque :
J'ai remis la conf de mon serveur DNS ...
les clefs O16 et O17 correspondent à quoi ?
Il ne reste plus que les point suivants:
1 - Les files missing dans les sections O23
2 - O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
et puis ...
Merci d'avance -
1. Suppression des fichiers potentiellement dangereux avec CCleaner
2 passes --> [OK] -
Point 2 : Scan avec un Anti-Spyware
Rapport :
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 11:29:42 23/02/2007
+ Résultat de l'analyse:
:mozilla.408:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.409:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.410:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.411:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.268:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.269:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.270:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.271:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.272:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.273:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.274:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.275:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.276:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.277:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.278:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.279:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.280:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.281:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.282:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.283:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.284:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.285:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.286:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.287:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.288:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.289:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.290:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.291:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.292:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.293:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.294:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.295:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.296:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.297:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.298:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.299:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.300:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.301:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.302:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.303:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.304:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.305:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.306:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.307:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.308:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.309:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.310:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.311:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.312:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.313:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.314:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.315:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.316:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.317:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.611:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.431:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.432:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.433:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.800:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Belstat : Nettoyé.
:mozilla.801:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Belstat : Nettoyé.
:mozilla.80:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.81:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Com : Nettoyé.
:mozilla.746:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.747:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.748:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.96:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.97:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.328:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Etracker : Nettoyé.
:mozilla.447:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Falkag : Nettoyé.
:mozilla.566:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Hotlog : Nettoyé.
:mozilla.778:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Information : Nettoyé.
:mozilla.780:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.781:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.782:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Onestat : Nettoyé.
:mozilla.612:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.613:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.189:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.190:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.743:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.751:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.752:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.753:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.754:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.660:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.889:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.673:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.48:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.714:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.724:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.725:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.726:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.727:C:\Documents and Settings\Der\Application Data\Mozilla\Firefox\Profiles\0z0d2ab1.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
Fin du rapport
Point suivant ce soir .... -
BitDefender Online Scanner
Scan report generated at: Fri, Feb 23, 2007 - 23:53:46
Scan path: C:\;D:\;E:\;F:\;
Statistics
Time 02:51:02
Files 948539
Folders 8938
Boot Sectors 4
Archives 2980
Packed Files 70461
Results
Identified Viruses 2
Infected Files 2
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 2
Engines Info: Virus Definitions 393278
Engine build : AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Scan plugins: 1A
Archive plugins: 38
Unpack plugins: 6
E-mail plugins: 6
System plugins: 1
Scan Settings
First Action
Disinfect
Second Action
Delete
Heuristics
Yes
Enable Warnings
Yes
Scanned Extensions
*;
Exclude Extensions
Scan Emails
Yes
Scan Archives
Yes
Scan Packed
Yes
Scan Files
Yes
Scan Boot
Yes
Scanned File
Status
C:\Program Files\NetZoom\NetZoom Universal for Visio 2003 5.0.exe
Infected with: Win32.Bagle.JA@mm
C:\Program Files\NetZoom\NetZoom Universal for Visio 2003 5.0.exe
Disinfection failed
C:\Program Files\NetZoom\NetZoom Universal for Visio 2003 5.0.exe
Deleted
D:\Users\Denis\Outlook\outlook.pst=>[Subject: Netzoom !!!!][From: Cano]=>NetZoom Universal for Visio 2003 5.0.zip=>NetZoom Universal for Visio 2003 5.0.exe
Infected with: Win32.Bagle.JA@mm
D:\Users\Denis\Outlook\outlook.pst=>[Subject: Netzoom !!!!][From: Cano]=>NetZoom Universal for Visio 2003 5.0.zip=>NetZoom Universal for Visio 2003 5.0.exe
Disinfection failed
D:\Users\Denis\Outlook\outlook.pst=>[Subject: Netzoom !!!!][From: Cano]=>NetZoom Universal for Visio 2003 5.0.zip=>NetZoom Universal for Visio 2003 5.0.exe
Deleted
D:\Users\Denis\Outlook\outlook.pst=>[Subject: Netzoom !!!!][From: Cano]=>NetZoom Universal for Visio 2003 5.0.zip
Updated
D:\Users\Denis\Outlook\outlook.pst
Updated
Maintenant le point 4...
Juste une petite remarque, le webscanner de Kaspersky n'a rien vu...., Est une impression ou l'on se mord la queue ....
Merci -
Etape 4 - Hijack...
Logfile of HijackThis v1.99.1
Scan saved at 08:06:02, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\program files\diamondcs\regprot.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\WINDOWS\system32\wuauclt.exe
D:\install\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nt2000s:81/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = c:\der_proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;10.241.0.0;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RegProt] d:\program files\diamondcs\regprot.exe /start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - Startup: Moniteur de réseau sans fil G.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.actemium.com
O15 - Trusted Zone: *.google.fr
O16 - DPF: fdjeux -
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.5.0_05) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{F246C158-F1EC-4EA1-ABF1-BC9C26691D89}: NameServer = 213.36.80.1
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHIE~1\Stardock\mcpstub.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AutoIP Auto Bootp - Alexandria Software Consulting - C:\Program Files\AutoIP\autoipservice.exe
O23 - Service: AutoIP Ping Daemon (AutoIPPingDaemon) - Unknown owner - C:\Program Files\AutoIP\daemon.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Program Files\Canon\DIAS\CnxDIAS.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: Apache Tomcat etomcat (etomcat) - Unknown owner - C:\Program Files\AutoIP\tomcat5\bin\tomcat5.exe" //RS//etomcat (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hirschmann Industrial HiVision 2.00 Master Service (HiMasterService 2.00) - Unknown owner - C:\Program Files\Hirschmann\Industrial HiVision 2.0\services\HiMasterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IntravueScanner - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueScanner.exe
O23 - Service: IntravueServer - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueServer.exe
O23 - Service: IntravueSupervisor - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueSupervisor.exe
O23 - Service: MySql - Unknown owner - D:\mysql\bin\mysqld-nt (file missing)
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: S7 Global Services (s7asysvx) - SIEMENS AG - C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\S7IEPG\s7oiehsx.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
Voila...
Merci de votre aide et analyse -
ModérateurSalut
Juste une petite remarque, le webscanner de Kaspersky n'a rien vu...., Est une impression ou l'on se mord la queue ....
c'est à dire ???
tu peux changer ta page d'acceuil internet !
Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O15 - Trusted Zone: *.actemium.com
O15 - Trusted Zone: *.google.fr
O16 - DPF: fdjeux -
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.5.0_05) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
passe un coup de ccleaner + cleanup :
* CleanUp40 (qui élimine les fichiers temporaires + cookies : gratuit )
http://pageperso.aol.fr/Balltrap34/CleanUp40.exe
tuto : (merci à Balltrap) http://pageperso.aol.fr/balltrap34/democleanup.htm
precise tes soucis s'il en reste,@+ -
Royal !
Un service et une compétence inouie à point nommé !!
Hijack, ccleaner, webscan online, excellents outils !
Merci de votre aide
Il me reste plus qu'a choisir un bon AntiVirus....
"Faire des erreurs permet de tester des autres solutions" -
Modérateursuper ! :-)
un peu de lecture :
antivirus gratuit lequel choisir
https://sebsauvage.net/safehex.html
securite proteger un ordinateur contre les malwares d internet
@+
-
Voici le rapport :
Logfile of HijackThis v1.99.1
Scan saved at 15:18:58, on 22/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\program files\diamondcs\regprot.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Palm\Hotsync.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Palm\Palm.exe
c:\Program Files\Adobe\Acrobat 6.0\Distillr\AcroTray.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\LVComsX.exe
D:\Install\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nt2000s:81/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = c:\der_proxy.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.2.2:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;10.241.0.0;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [RegProt] d:\program files\diamondcs\regprot.exe /start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [hldrrr] C:\WINDOWS\system32\hldrrr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Moniteur de réseau sans fil G.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: *.actemium.com
O15 - Trusted Zone: *.google.fr
O16 - DPF: fdjeux -
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://mailze.domino.xxxx.com/iNotes.cab' target='_blank' rel='nofollow'>https://portail.xxxx.com/http://mailze.domino.xxxx.com/iNotes.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0) -
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.5.0_05) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{464724DE-EDE3-49E5-8EB5-C73CD3BF8055}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{464724DE-EDE3-49E5-8EB5-C73CD3BF8055}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{7437DB91-1288-4046-882B-EBE04DB8C28A}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{7437DB91-1288-4046-882B-EBE04DB8C28A}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{A50A20A5-522C-426A-AE00-A97DB0F62AD4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF6AC68C-42D8-45F8-B3E0-C43B82DD1C44}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD7155F5-EC97-482B-B73C-C935353FF839}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{F246C158-F1EC-4EA1-ABF1-BC9C26691D89}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
O17 - HKLM\System\CS1\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CS1\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
O17 - HKLM\System\CS3\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CS3\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FICHIE~1\Stardock\mcpstub.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automation License Manager Service (almservice) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\sws\almsrv\almsrvx.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AutoIP Auto Bootp - Alexandria Software Consulting - C:\Program Files\AutoIP\autoipservice.exe
O23 - Service: AutoIP Ping Daemon (AutoIPPingDaemon) - Unknown owner - C:\Program Files\AutoIP\daemon.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Program Files\Canon\DIAS\CnxDIAS.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: Apache Tomcat etomcat (etomcat) - Unknown owner - C:\Program Files\AutoIP\tomcat5\bin\tomcat5.exe" //RS//etomcat (file missing)
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hirschmann Industrial HiVision 2.00 Master Service (HiMasterService 2.00) - Unknown owner - C:\Program Files\Hirschmann\Industrial HiVision 2.0\services\HiMasterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: IntravueScanner - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueScanner.exe
O23 - Service: IntravueServer - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueServer.exe
O23 - Service: IntravueSupervisor - Network Vision Software Inc. - D:\Program Files\IntraVUE\IntravueSupervisor.exe
O23 - Service: MySql - Unknown owner - D:\mysql\bin\mysqld-nt (file missing)
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: S7 Global Services (s7asysvx) - SIEMENS AG - C:\Program Files\Siemens\Step7\S7BIN\s7asysvx.exe
O23 - Service: SIMATIC IEPG Help Service (s7oiehsx) - SIEMENS AG - C:\Program Files\Fichiers communs\Siemens\S7IEPG\s7oiehsx.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
Remarque non négligeable :
Ce matin :
0 - Restauration systeme desactivée
1 - desinstallation de trend
2 - Installation de Kaspersky
3 - Nettoyage
Ce soir je refait un webscan ?
Merci
Merci d'avance -
Modérateurre
ces 017 démontrent une infection par wareout !
* Télécharge FixWareout d'un de ces deux sites sur le bureau:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe
* Lance le fix: clique sur Next, puis Install, puis assure toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais le. Ton système mettra un peu plus de temps au démarrage, c'est normal.
*Poste (Copie/colle) le contenu du rapport qui va s'afficher à l'écran (report.txt)
enuite :
# Relance HijackThis : choisis " do a scan only" coche la case devant les lignes ci-dessous et clique en bas sur "fix checked" :
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://mailze.domino.xxxx.com/iNotes.cab' target='_blank' rel='nofollow'>http://mailze.domino.xxxx.com/iNotes.cab' target='_blank' rel='nofollow'>https://portail.xxxx.com/http://mailze.domino.xxxx.com/iNotes.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0) -
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.5.0_05) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{464724DE-EDE3-49E5-8EB5-C73CD3BF8055}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{464724DE-EDE3-49E5-8EB5-C73CD3BF8055}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{7437DB91-1288-4046-882B-EBE04DB8C28A}: Domain = yyy
O17 - HKLM\System\CCS\Services\Tcpip\..\{7437DB91-1288-4046-882B-EBE04DB8C28A}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{A50A20A5-522C-426A-AE00-A97DB0F62AD4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF6AC68C-42D8-45F8-B3E0-C43B82DD1C44}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD7155F5-EC97-482B-B73C-C935353FF839}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\..\{F246C158-F1EC-4EA1-ABF1-BC9C26691D89}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
O17 - HKLM\System\CS1\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CS1\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
O17 - HKLM\System\CS3\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: Domain = yyy
O17 - HKLM\System\CS3\Services\Tcpip\..\{25F025C1-10CA-4269-AC21-1BD8265B09D4}: NameServer = 85.255.114.70,85.255.112.182
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.70 85.255.112.182
ensuite, reposte un nouveau hijack stp
@+
La sagesse, c'est d'avoir des rêves suffisamment grands pour ne pas les
perdre de vue lorsqu'on les poursuit. (Oscar Wilde) -
Modérateurre
les 016 : Correspondent au controles actives X présent sur le pc.
les 017 : Correspondent à l'adresse IP, DNS et nom de domaine.
fais les manips de ce lien stp :
virus methode preliminaire de desinfection version fr
@+
La sagesse, c'est d'avoir des rêves suffisamment grands pour ne pas les
perdre de vue lorsqu'on les poursuit. (Oscar Wilde)
