virus small-EQY

Question

Bonjour, Mon ordi (windows XP SP2) est fortement perturbé par le cheval de troie small-EQY. Il est détecté par AVAST. J'ai suivi la procédure initiale que vous recommendez avec CCLEANER, AVG, BitDefender et HijackThis, dont voici les rapports dans l'ordre. AVG Anti-Spyware - Rapport d'analyse --------------------------------------------------------- + Créé à: 23:14:22 25/05/2007 + Résultat de l'analyse: C:\Documents and Settings\Anne-Sophie\Menu Démarrer\Programmes\WhenU -> Adware.SaveNow : Ignoré. C:\Documents and Settings\Anne-Sophie\Menu Démarrer\Programmes\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : Ignoré. C:\Documents and Settings\Anne-Sophie\Menu Démarrer\Programmes\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : Ignoré. C:\Documents and Settings\Anne-Sophie\Menu Démarrer\Programmes\WhenU\WhenU.com Website.url -> Adware.SaveNow : Ignoré. C:\WINDOWS\system32\drivers\uzcx.exe -> Downloader.Small.cul : Ignoré. C:\sysqpkw.exe -> Downloader.Small.cul : Ignoré. E:\Clémentine\MsgPlus-300.exe/sponsor2.exe -> Downloader.Swizzor.ag : Ignoré. C:\Documents and Settings\Jean-Pascal\Cookies\jean-pascal@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré. C:\Documents and Settings\Jean-Pascal\Cookies\jean-pascal@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré. Fin du rapport BitDefender Online Scanner -Scan Report

BitDefender Online Scanner

Scan report generated at: Sat, May 26, 2007 - 01:09:10

Scan path: A:\;C:\;D:\;E:\;F:\;G:\;H:\;

Statistics
Time	01:47:38
Files	600012
Folders	12616
Boot Sectors	5
Archives	72148
Packed Files	41720

Results
Identified Viruses	4
Infected Files	4
Suspect Files	1
Warnings	0
Disinfected	0
Deleted Files	4

Engines Info
Virus Definitions	508582
Engine build	AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Scan plugins	14
Archive plugins	38
Unpack plugins	6
E-mail plugins	6
System plugins	1

Scan Settings
First Action	Disinfect
Second Action	Delete
Heuristics	Yes
Enable Warnings	Yes
Scanned Extensions	*;
Exclude Extensions
Scan Emails	Yes
Scan Archives	Yes
Scan Packed	Yes
Scan Files	Yes
Scan Boot	Yes

Scanned File	Status
C:\=>Master Boot Record 81	Infected with: Parity_Boot.B (Boot image)
C:\=>Master Boot Record 81	Disinfection failed
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx=>(message 8)=>[Subject: Introduction on ADSL][Date: Wed, 2 Apr 2003 11:23:44 +0200 (CEST)]=>(MIME part)=>(message body)	Suspected of: Exploit.Iframe.Vulnerability
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx=>(message 8)=>[Subject: Introduction on ADSL][Date: Wed, 2 Apr 2003 11:23:44 +0200 (CEST)]=>(MIME part)=>(message body)	Disinfection failed
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx=>(message 8)=>[Subject: Introduction on ADSL][Date: Wed, 2 Apr 2003 11:23:44 +0200 (CEST)]=>(MIME part)=>(message body)	Deleted
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx=>(message 8)=>[Subject: Introduction on ADSL][Date: Wed, 2 Apr 2003 11:23:44 +0200 (CEST)]=>(MIME part)	Updated
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx=>(message 8)	Updated
C:\Documents and Settings\Clémentine\Local Settings\Application Data\Identities\{D3D9DC56-81ED-4EFB-855B-0C45074D78E7}\Microsoft\Outlook Express\Clémence (1).dbx	Update failed
C:\Program Files\Webteh\BSplayer\bsplayer212[1].941_clip.exe=>(NSIS o)=>zlib_nsis0011=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Infected with: Generic.Adw.SaveNow.E8ADC126
C:\Program Files\Webteh\BSplayer\bsplayer212[1].941_clip.exe=>(NSIS o)=>zlib_nsis0011=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Disinfection failed
C:\Program Files\Webteh\BSplayer\bsplayer212[1].941_clip.exe=>(NSIS o)=>zlib_nsis0011=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Deleted
C:\Program Files\Webteh\BSplayer\bsplayer212[1].941_clip.exe=>(NSIS o)=>zlib_nsis0011=>(CAB Sfx r)	Update failed
C:\Program Files\Webteh\BSplayer\BSplayer_WhenUSave_InstallerInstRe.exe=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Infected with: Generic.Adw.SaveNow.F72971F7
C:\Program Files\Webteh\BSplayer\BSplayer_WhenUSave_InstallerInstRe.exe=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Disinfection failed
C:\Program Files\Webteh\BSplayer\BSplayer_WhenUSave_InstallerInstRe.exe=>(CAB Sfx r)=>BSplayer_WhenUSave_Installer.exe	Deleted
C:\Program Files\Webteh\BSplayer\BSplayer_WhenUSave_InstallerInstRe.exe=>(CAB Sfx r)	Update failed
E:\System Volume Information\_restore{04145840-F5E0-4D8E-BD28-8FF67159EA53}\RP253\A0073772.exe	Infected with: Trojan.Downloader.Swizzor.AG
E:\System Volume Information\_restore{04145840-F5E0-4D8E-BD28-8FF67159EA53}\RP253\A0073772.exe	Disinfection failed
E:\System Volume Information\_restore{04145840-F5E0-4D8E-BD28-8FF67159EA53}\RP253\A0073772.exe	Deleted

Logfile of HijackThis v1.99.1 Scan saved at 07:57:23, on 26/05/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\MI3AA1~1 apimgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\winlogon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\AIM\aim.exe C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://jpascalphoto.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.girafoto.fr/uploaders/ImageUploader3.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O18 - Filter: application/xhtml+xml - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O18 - Filter: application/xhtml+xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O18 - Filter: application/xhtml+xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O18 - Filter hijack: text/xml - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32 vsvc32.exe Merci d'avance pour votre aide.

JAG_Info · Answer

Bjr,

As-tu essayé avec AVG et Zone Alarme ?
Dans ta configuration d'Avast, as-tu bien sélectionné l'option de suppression du virus lors de sa détection ?
Il faut aussi que tu le supprime de ta messgerie orange !!! sinon il reviendra toujours (j'ai eu le tour lorsque j'étais chez wanadoo)
Regarde aussi dans les forums, il y a plusieurs messages expliquants toutes les étapes à suivre pour se débarrasser correctement des virus.

chaville · Answer

Qu'est ce que tu veux dire par "le supprimer de ma messagerie orange" ? Je ne comprends pas.

Chaville

Virus small-EQY

2 réponses

Votre réponse

Discussions similaires

Newsletters