Probemes trojan ou autre flashy"
smokemon72
-
smokemon72 -
smokemon72 -
Bonjour,
depuis quelques jours, j'ai sur ma cle usb, lecteur mp3 et carte photos quelques choses qui transforment mes dossiers en .exe et les rend inaccessibles. De plus, des sous dossiers sont crees et egalement inacessibles. Quand je vide ma caret memoire compact flash de mon appareil photo, le virus ou autre reste. Ma cle usb s'ouvre difficilement et mon lecteur mp3 aussi. J'ai teste macle et mon lecteur avec norton mais il ne repere rien. J'ai egalement teste ma carte CF avec multicleaner2007 et rien non plus. Un autre m'a indique que c'etait un trojan au nom de flashy.exe et win.exe ou fun.exe mais ne pouvait pas les nettoyer. Please help me car je suis au japon et j'ai deja perdu quelques photos de mon voyage.
par avance merci
depuis quelques jours, j'ai sur ma cle usb, lecteur mp3 et carte photos quelques choses qui transforment mes dossiers en .exe et les rend inaccessibles. De plus, des sous dossiers sont crees et egalement inacessibles. Quand je vide ma caret memoire compact flash de mon appareil photo, le virus ou autre reste. Ma cle usb s'ouvre difficilement et mon lecteur mp3 aussi. J'ai teste macle et mon lecteur avec norton mais il ne repere rien. J'ai egalement teste ma carte CF avec multicleaner2007 et rien non plus. Un autre m'a indique que c'etait un trojan au nom de flashy.exe et win.exe ou fun.exe mais ne pouvait pas les nettoyer. Please help me car je suis au japon et j'ai deja perdu quelques photos de mon voyage.
par avance merci
A voir également:
- Probemes trojan ou autre flashy"
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Anti trojan - Télécharger - Antivirus & Antimalwares
- Trojan b901 system32 win config 34 ✓ - Forum Virus
- Csrss.exe trojan fr ✓ - Forum Virus
- Trojan win32 - Forum Virus
30 réponses
slt,
voici le rapport de combofix :
le pc fonctionne mieux, c sur mais l'antivirus detecte toujours les memes fichiers au memes moments 8demarrage du pc, ouverture d'internet explorer...) Doisje garder cet antivirus ou en changer?
Sinon, pour ma cle usb, y a t il une solution (cf message precedent)
merci et a +
ComboFix 07-12-21.4 - ゲスト１ 2007-12-22 11:58:54.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Home Edition 5.1.2600.2.932.1.1041.18.115 [GMT 9:00]
Running from: C:\Documents and Settings\ゲスト１\デスクトップ\ComboFix.exe
Command switches used :: C:\Documents and Settings\ゲスト１\デスクトップ\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\SYSTEM32\29733.exe
C:\WINDOWS\SYSTEM32\66061.exe
C:\WINDOWS\SYSTEM32\7661.dll
C:\WINDOWS\system32\drivers\sicgoe14.sys)
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_MS_2FAX
-------\LEGACY_SICGOE14
-------\ms_2fax
-------\sicgoe14
((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.
2007-12-30 21:41 . 2007-12-30 21:41 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199018514.h
2007-12-30 21:30 . 2007-12-30 21:30 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199017819.h
2007-12-28 12:32 . 2007-12-28 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-28 12:31 . 2007-12-28 12:31 <DIR> d-------- C:\Program Files\Trojan Remover
2007-12-25 12:52 . 2005-07-14 04:31 38,912 --a------ C:\WINDOWS\SYSTEM32\sha3l3xu.dll
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\WINDOWS\UX-MF25_50_60
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\Program Files\Sharp
2007-12-22 12:09 . 44,032 C:\Program Files\avp.exe
2007-12-22 11:38 . 2007-12-22 11:38 47,605 --ahs---- C:\WINDOWS\SYSTEM32\WUpdate$!.TMP
2007-12-22 11:38 . 2007-12-22 11:38 17,280 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\opengl.sys
2007-11-27 14:49 . 2007-11-27 14:49 <DIR> d-------- C:\Program Files\iPod
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 03:07 94,208 ---h--w C:\WINDOWS\SYSTEM32\29733.exe
2007-12-22 03:07 30,311 --sha-w C:\WINDOWS\SYSTEM32\smartdrv.exe
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-21 12:31 0 ----a-w C:\WINDOWS\FONTS\cuy.dl
2007-11-21 07:12 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Favorites
2007-11-21 06:28 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-21 06:28 --------- d-----w C:\Program Files\Windows Live
2007-11-21 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-14 07:26 450,560 ------w C:\WINDOWS\SYSTEM32\dllcache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 08:13 --------- d-----w C:\Documents and Settings\ゲスト１\Application Data\U3
2007-10-30 10:15 3,079,680 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:42 1,275,904 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:42 1,275,904 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-25 16:54 8,360,448 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-23 08:49 583,680 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 02:31 51,224 ----a-w C:\WINDOWS\SYSTEM32\sirenacm.dll
2007-10-11 06:12 96,256 ------w C:\WINDOWS\SYSTEM32\dllcache\inseng.dll
2007-10-11 06:12 649,728 ------w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-11 06:12 611,328 ------w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-11 06:12 473,600 ------w C:\WINDOWS\SYSTEM32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-10-11 06:12 250,880 ------w C:\WINDOWS\SYSTEM32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-11 06:12 151,040 ------w C:\WINDOWS\SYSTEM32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-11 06:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\dllcache\shdocvw.dll
2007-10-11 06:12 1,051,136 ------w C:\WINDOWS\SYSTEM32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\SYSTEM32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ----a-w C:\WINDOWS\SYSTEM32\dllcache\iedw.exe
2007-09-17 06:56 62,024 ----a-w C:\Documents and Settings\NEC-PCuser\Application Data\GDIPFONTCACHEV1.DAT
2002-05-28 07:24 7,717 ----a-w C:\Program Files\DeIsL1.isu
2001-03-07 01:44 271 --sh--w C:\Program Files\desktop.ini
2001-03-07 01:44 23,659 ---ha-w C:\Program Files\folder.htt
2002-12-16 11:29 8 --sh--w C:\WINDOWS\DRM\pdrm.dat
.
((((((((((((((((((((((((((((( snapshot@2005-12-21_11.45.24.86 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-24 08:35:20 16,384 ----a-w C:\WINDOWS\1542.exe
- 2007-12-29 00:12:34 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2008-01-04 00:33:04 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2006-07-11 00:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-12-21 11:44:22 93,392 ----a-w C:\WINDOWS\SYSTEM32\[u]0[/u]31.exe
+ 2005-12-22 05:45:24 92,672 ----a-w C:\WINDOWS\SYSTEM32\978FD.exe
+ 2005-12-24 08:35:18 16,384 ----a-w C:\WINDOWS\SYSTEM32\admin6_ver1231.exe
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-12-22 05:51:34 20,541 ----a-w C:\WINDOWS\SYSTEM32\detoured.dll
+ 2007-08-09 04:04:12 40,768 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
+ 2007-07-18 05:22:20 21,312 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2005-12-21 14:49:42 61,632 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys
+ 2007-04-16 15:53:08 11,776 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\sicgoe14.sys
+ 2007-03-01 01:34:38 28,352 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys
+ 2005-12-24 08:08:40 21,120 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\winsys.sys
+ 2005-05-16 10:34:48 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2006-03-20 04:17:20 798,720 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8F776B2A-72DF-40C1-BD69-EDB642A706D7}]
C:\WINDOWS\SYSTEM32\bho.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:55]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG9.0"="C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.exe" [2005-03-17 14:40]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe" [2007-04-27 15:44]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2005-12-24 17:43]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 16:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-21 18:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2005-12-21 23:49]
"BootClean"="smartdrv.exe" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"McAfeeVirusScanService"="" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [2004-08-04 16:55 C:\WINDOWS\SYSTEM32\ctfmon.exe]
C:\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ\
QuickShelf.lnk - C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\qshelf.exe [2000-12-20 19:06:14]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= C:\Program Files\DigitalAdventure\imorning\start.htm
FriendlyName= アイモーニング
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm
FriendlyName= BIGLOBE ACTIVE DESKTOP
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"Hidserv"=Hidserv.exe run
"NMFTASK"=NMFTASK.EXE /RESET
"NECTVRC"=C:\PROGRA~1\nectvrc\tvrc.exe
"Alogserv"=C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
"NECMFK"=C:\PROGRA~1\necmfk\necmfk.exe
"LoadQM"=loadqm.exe
R0 36n9pih2;36n9pih;C:\WINDOWS\system32\DRIVERS\36n9pih2.sys [2004-08-04 16:55]
R2 bwcdrv;BUFFALO Wireless Configuration;C:\WINDOWS\system32\DRIVERS\bwcdrv.sys [2003-12-21 17:21]
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-24 12:40]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-11-01 17:13]
R3 Ptserli;PCTEL Serial Device Driver for INTEL;C:\WINDOWS\system32\DRIVERS\ptserli.sys [2001-08-17 13:28]
S2 584823C8;584823C8;C:\WINDOWS\system32\279F07D0.EXE -k []
S2 6F906650;6F906650;C:\WINDOWS\system32\2E1A7558.EXE -g []
S2 978FD;978FD;C:\WINDOWS\system32\978FD.exe [2005-12-22 14:45]
S2 rbwzjc14;rbwzjc14;C:\WINDOWS\system32\drivers\rbwzjc14.sys []
S2 sysloader;System Event loader;"C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe" []
S2 WinCOM;COM+ Windows System;C:\WINDOWS\system32\wincom.exe []
S2 YahooSvr;Yahoo Service;C:\WINDOWS\system32\13242\svchost.exe []
S2 Yiqilai;ﾒｻﾆｴﾒﾖﾖ摠ﾖ;"C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe" [2005-12-21 19:04]
S3 BT848;NEC TV Tuner Unit/ Bt878 WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys [2001-08-23 13:59]
S3 BTTUNER;NEC TV Tuner Unit/ Bt878 WDM Tv Tuner;C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-08-23 13:59]
S3 BTXBAR;NEC TV Tuner Unit/ Bt878 WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys [2001-08-23 13:59]
S3 Ndisprot;Network Monitor Protocol Driver;C:\WINDOWS\system32\DRIVERS\winsys.sys [2005-12-24 17:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3532da70-b087-11dc-978f-001601234175}]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\Open\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1d4cec1-af7e-11dc-978d-001601234175}]
\Shell\AutoRun\command - G:\autorun.exe
\Shell\Open\command - G:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 14:00:02 C:\WINDOWS\Tasks\アプリケーションの起動チューンアップ.job"
"2007-12-22 02:52:02 C:\WINDOWS\Tasks\有効期間の確認通知のアンインストール.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2007-12-22 02:37:04 C:\WINDOWS\Tasks\データ収集の PCHealth スケジューラ.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2007-12-29 14:35:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-12-22 02:41:02 C:\WINDOWS\Tasks\Windows Live Toolbar の更新プログラムを確認します.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 12:09:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\OpenGL]
"ImagePath"="system32\DRIVERS\opengl.sys"
.
Completion time: 2007-12-22 12:10:56 - machine was rebooted [ゲスト１]
C:\ComboFix2.txt ... 2005-12-21 11:47
.
2007-12-22 14:26:36 --- E O F ---
voici le rapport de combofix :
le pc fonctionne mieux, c sur mais l'antivirus detecte toujours les memes fichiers au memes moments 8demarrage du pc, ouverture d'internet explorer...) Doisje garder cet antivirus ou en changer?
Sinon, pour ma cle usb, y a t il une solution (cf message precedent)
merci et a +
ComboFix 07-12-21.4 - ゲスト１ 2007-12-22 11:58:54.6 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Home Edition 5.1.2600.2.932.1.1041.18.115 [GMT 9:00]
Running from: C:\Documents and Settings\ゲスト１\デスクトップ\ComboFix.exe
Command switches used :: C:\Documents and Settings\ゲスト１\デスクトップ\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\SYSTEM32\29733.exe
C:\WINDOWS\SYSTEM32\66061.exe
C:\WINDOWS\SYSTEM32\7661.dll
C:\WINDOWS\system32\drivers\sicgoe14.sys)
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_MS_2FAX
-------\LEGACY_SICGOE14
-------\ms_2fax
-------\sicgoe14
((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.
2007-12-30 21:41 . 2007-12-30 21:41 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199018514.h
2007-12-30 21:30 . 2007-12-30 21:30 3,502 --a------ C:\WINDOWS\SYSTEM32\llk1199017819.h
2007-12-28 12:32 . 2007-12-28 12:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-28 12:31 . 2007-12-28 12:31 <DIR> d-------- C:\Program Files\Trojan Remover
2007-12-25 12:52 . 2005-07-14 04:31 38,912 --a------ C:\WINDOWS\SYSTEM32\sha3l3xu.dll
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\WINDOWS\UX-MF25_50_60
2007-12-25 12:51 . 2007-12-25 12:51 <DIR> d-------- C:\Program Files\Sharp
2007-12-22 12:09 . 44,032 C:\Program Files\avp.exe
2007-12-22 11:38 . 2007-12-22 11:38 47,605 --ahs---- C:\WINDOWS\SYSTEM32\WUpdate$!.TMP
2007-12-22 11:38 . 2007-12-22 11:38 17,280 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\opengl.sys
2007-11-27 14:49 . 2007-11-27 14:49 <DIR> d-------- C:\Program Files\iPod
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 03:07 94,208 ---h--w C:\WINDOWS\SYSTEM32\29733.exe
2007-12-22 03:07 30,311 --sha-w C:\WINDOWS\SYSTEM32\smartdrv.exe
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-22 03:06 4,456,448 ---ha-w C:\Documents and Settings\ゲスト１\ntuser.dat
2007-12-21 12:31 0 ----a-w C:\WINDOWS\FONTS\cuy.dl
2007-11-21 07:12 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-11-21 06:49 --------- d-----w C:\Program Files\Windows Live Favorites
2007-11-21 06:28 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-21 06:28 --------- d-----w C:\Program Files\Windows Live
2007-11-21 06:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-14 07:26 450,560 ------w C:\WINDOWS\SYSTEM32\dllcache\jscript.dll
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 08:13 --------- d-----w C:\Documents and Settings\ゲスト１\Application Data\U3
2007-10-30 10:15 3,079,680 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:42 1,275,904 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:42 1,275,904 ------w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-25 16:54 8,360,448 ------w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-25 00:28 222,720 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-23 08:49 583,680 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-10-18 02:31 51,224 ----a-w C:\WINDOWS\SYSTEM32\sirenacm.dll
2007-10-11 06:12 96,256 ------w C:\WINDOWS\SYSTEM32\dllcache\inseng.dll
2007-10-11 06:12 649,728 ------w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-11 06:12 611,328 ------w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-11 06:12 473,600 ------w C:\WINDOWS\SYSTEM32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\SYSTEM32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtmsft.dll
2007-10-11 06:12 250,880 ------w C:\WINDOWS\SYSTEM32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-11 06:12 151,040 ------w C:\WINDOWS\SYSTEM32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-11 06:12 1,494,528 ------w C:\WINDOWS\SYSTEM32\dllcache\shdocvw.dll
2007-10-11 06:12 1,051,136 ------w C:\WINDOWS\SYSTEM32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\SYSTEM32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ----a-w C:\WINDOWS\SYSTEM32\dllcache\iedw.exe
2007-09-17 06:56 62,024 ----a-w C:\Documents and Settings\NEC-PCuser\Application Data\GDIPFONTCACHEV1.DAT
2002-05-28 07:24 7,717 ----a-w C:\Program Files\DeIsL1.isu
2001-03-07 01:44 271 --sh--w C:\Program Files\desktop.ini
2001-03-07 01:44 23,659 ---ha-w C:\Program Files\folder.htt
2002-12-16 11:29 8 --sh--w C:\WINDOWS\DRM\pdrm.dat
.
((((((((((((((((((((((((((((( snapshot@2005-12-21_11.45.24.86 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-12-24 08:35:20 16,384 ----a-w C:\WINDOWS\1542.exe
- 2007-12-29 00:12:34 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2008-01-04 00:33:04 53,248 ----a-r C:\WINDOWS\7d01.exe
+ 2006-07-11 00:41:36 345,656 ----a-w C:\WINDOWS\Downloaded Program Files\ewidoOnlineScan.dll
+ 2005-12-21 11:44:22 93,392 ----a-w C:\WINDOWS\SYSTEM32\[u]0[/u]31.exe
+ 2005-12-22 05:45:24 92,672 ----a-w C:\WINDOWS\SYSTEM32\978FD.exe
+ 2005-12-24 08:35:18 16,384 ----a-w C:\WINDOWS\SYSTEM32\admin6_ver1231.exe
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Cookies\index.dat
- 2005-12-31 02:09:14 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-01-04 01:37:50 32,768 ----a-w C:\WINDOWS\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-12-22 05:51:34 20,541 ----a-w C:\WINDOWS\SYSTEM32\detoured.dll
+ 2007-08-09 04:04:12 40,768 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
+ 2007-07-18 05:22:20 21,312 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2005-12-21 14:49:42 61,632 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys
+ 2007-04-16 15:53:08 11,776 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\sicgoe14.sys
+ 2007-03-01 01:34:38 28,352 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys
+ 2005-12-24 08:08:40 21,120 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\winsys.sys
+ 2005-05-16 10:34:48 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2006-03-20 04:17:20 798,720 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8F776B2A-72DF-40C1-BD69-EDB642A706D7}]
C:\WINDOWS\SYSTEM32\bho.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 16:55]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG9.0"="C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.exe" [2005-03-17 14:40]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Mini\3.2\Apps\apdproxy.exe" [2007-04-27 15:44]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2005-12-24 17:43]
"BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 16:19]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-21 18:57]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2005-12-21 23:49]
"BootClean"="smartdrv.exe" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"McAfeeVirusScanService"="" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="ctfmon.exe" [2004-08-04 16:55 C:\WINDOWS\SYSTEM32\ctfmon.exe]
C:\Documents and Settings\All Users\スタート メニュー\プログラム\スタートアップ\
QuickShelf.lnk - C:\Program Files\Microsoft Reference\Microsoft Bookshelf 3.0\qshelf.exe [2000-12-20 19:06:14]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
Source= C:\Program Files\DigitalAdventure\imorning\start.htm
FriendlyName= アイモーニング
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\3]
Source= C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm
FriendlyName= BIGLOBE ACTIVE DESKTOP
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"Hidserv"=Hidserv.exe run
"NMFTASK"=NMFTASK.EXE /RESET
"NECTVRC"=C:\PROGRA~1\nectvrc\tvrc.exe
"Alogserv"=C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
"NECMFK"=C:\PROGRA~1\necmfk\necmfk.exe
"LoadQM"=loadqm.exe
R0 36n9pih2;36n9pih;C:\WINDOWS\system32\DRIVERS\36n9pih2.sys [2004-08-04 16:55]
R2 bwcdrv;BUFFALO Wireless Configuration;C:\WINDOWS\system32\DRIVERS\bwcdrv.sys [2003-12-21 17:21]
R2 Pctspk;PCTEL Speaker Phone;C:\WINDOWS\system32\pctspk.exe [2001-08-24 12:40]
R3 CBBCM43;BUFFALO WLI-CB-XXX Series Wireless LAN Adapter;C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2005-11-01 17:13]
R3 Ptserli;PCTEL Serial Device Driver for INTEL;C:\WINDOWS\system32\DRIVERS\ptserli.sys [2001-08-17 13:28]
S2 584823C8;584823C8;C:\WINDOWS\system32\279F07D0.EXE -k []
S2 6F906650;6F906650;C:\WINDOWS\system32\2E1A7558.EXE -g []
S2 978FD;978FD;C:\WINDOWS\system32\978FD.exe [2005-12-22 14:45]
S2 rbwzjc14;rbwzjc14;C:\WINDOWS\system32\drivers\rbwzjc14.sys []
S2 sysloader;System Event loader;"C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe" []
S2 WinCOM;COM+ Windows System;C:\WINDOWS\system32\wincom.exe []
S2 YahooSvr;Yahoo Service;C:\WINDOWS\system32\13242\svchost.exe []
S2 Yiqilai;ﾒｻﾆｴﾒﾖﾖ摠ﾖ;"C:\Program Files\Yiqilai\wmp\YiqilaiLyrics.exe" [2005-12-21 19:04]
S3 BT848;NEC TV Tuner Unit/ Bt878 WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.sys [2001-08-23 13:59]
S3 BTTUNER;NEC TV Tuner Unit/ Bt878 WDM Tv Tuner;C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-08-23 13:59]
S3 BTXBAR;NEC TV Tuner Unit/ Bt878 WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.sys [2001-08-23 13:59]
S3 Ndisprot;Network Monitor Protocol Driver;C:\WINDOWS\system32\DRIVERS\winsys.sys [2005-12-24 17:08]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3532da70-b087-11dc-978f-001601234175}]
\Shell\AutoRun\command - F:\autorun.exe
\Shell\Open\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1d4cec1-af7e-11dc-978d-001601234175}]
\Shell\AutoRun\command - G:\autorun.exe
\Shell\Open\command - G:\autorun.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 14:00:02 C:\WINDOWS\Tasks\アプリケーションの起動チューンアップ.job"
"2007-12-22 02:52:02 C:\WINDOWS\Tasks\有効期間の確認通知のアンインストール.job"
- C:\WINDOWS\System32\OOBE\oobebaln.exe
"2007-12-22 02:37:04 C:\WINDOWS\Tasks\データ収集の PCHealth スケジューラ.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2007-12-29 14:35:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-12-22 02:41:02 C:\WINDOWS\Tasks\Windows Live Toolbar の更新プログラムを確認します.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 12:09:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\OpenGL]
"ImagePath"="system32\DRIVERS\opengl.sys"
.
Completion time: 2007-12-22 12:10:56 - machine was rebooted [ゲスト１]
C:\ComboFix2.txt ... 2005-12-21 11:47
.
2007-12-22 14:26:36 --- E O F ---
salut,
un nouveau probleme sur le pc. au demarrage, une fenetre avec guardgui.exe bloque tout sur le bureau et quand on veut la fermer elle reapparait aussitot. la , j'ecris d'un autre pc. que peut on faire, j'ai l'impression que c l'antivirus antivir qui couille....la fenetre du bios apparait, c des kon arrive sur le bureau, plus rien ne bouge..
un nouveau probleme sur le pc. au demarrage, une fenetre avec guardgui.exe bloque tout sur le bureau et quand on veut la fermer elle reapparait aussitot. la , j'ecris d'un autre pc. que peut on faire, j'ai l'impression que c l'antivirus antivir qui couille....la fenetre du bios apparait, c des kon arrive sur le bureau, plus rien ne bouge..
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
re,
bon, antivir ne s'ouvrait plus aussi je l'ai desinstalle. dois je reinstalle de nouveau mais c lui qui beugue avec guardgui.exe.
un autre peu etre?
que penses tu pour ma cle usb et les fichiers .exe?
a +
bon, antivir ne s'ouvrait plus aussi je l'ai desinstalle. dois je reinstalle de nouveau mais c lui qui beugue avec guardgui.exe.
un autre peu etre?
que penses tu pour ma cle usb et les fichiers .exe?
a +
Piou grosse infection.
On va nettoyer manuellement va !
Remet un Hijackthis et un combofix et on supprimera manuellement.
A+
On va nettoyer manuellement va !
Remet un Hijackthis et un combofix et on supprimera manuellement.
A+
slt,
on continue....
voici les 2 rapports :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:02, on 2007/12/24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Drivers\bwcsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOCUME~1\ゲスト１\LOCALS~1\Temp\HiJackThis.zip の一時ディレクトリ 1\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8F776B2A-72DF-40C1-BD69-EDB642A706D7} - C:\WINDOWS\SYSTEM32\bho.dll (file missing)
O2 - BHO: Windows Live サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Tekram USB Web Camera TM-506
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Bookshelfで検索(&L) - res://C:\PROGRAM FILES\MICROSOFT REFERENCE\MICROSOFT BOOKSHELF 3.0\BSDEF.DLL/#1001
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: このコンテンツを引用 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer でこのコンテンツに関する記事を書く(&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ﾒｻﾆｴﾒﾖﾉ酩・ - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: ﾒﾗﾈ､ｹｺﾎ・ - {FFB2385E-E812-4091-8C12-2370DC67F769} - http://www.eachnet.com/specials/digi.html?adid=dzcm_dza_000_soft0_digi (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5C945890-327C-11D5-995C-0090272E513E} (UpdateNecXPCtl Class) - file://E:\GuideXP\obj\UpNxp.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 584823C8 - Unknown owner - C:\WINDOWS\system32\279F07D0.EXE (file missing)
O23 - Service: 6F906650 - Unknown owner - C:\WINDOWS\system32\2E1A7558.EXE (file missing)
O23 - Service: 978FD - Unknown owner - C:\WINDOWS\system32\978FD.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BUFFALO Wireless Configuration Service (bwcsrv) - Unknown owner - C:\WINDOWS\System32\Drivers\bwcsrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: Yahoo Service (YahooSvr) - Unknown owner - C:\WINDOWS\system32\13242\svchost.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/ja-jp
O24 - Desktop Component 2: アイモーニング - C:\Program Files\DigitalAdventure\imorning\start.htm
O24 - Desktop Component 3: BIGLOBE ACTIVE DESKTOP - C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm
on continue....
voici les 2 rapports :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:02, on 2007/12/24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\Drivers\bwcsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOCUME~1\ゲスト１\LOCALS~1\Temp\HiJackThis.zip の一時ディレクトリ 1\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8F776B2A-72DF-40C1-BD69-EDB642A706D7} - C:\WINDOWS\SYSTEM32\bho.dll (file missing)
O2 - BHO: Windows Live サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [IMJPMIG9.0] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\IMJPMIG.EXE /Preload /Migration32
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Tekram USB Web Camera TM-506
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKLM\..\Policies\Explorer\Run: [heu] rundll32 "C:\WINDOWS\Downlo~1\heu.dll",Run
O4 - HKLM\..\Policies\Explorer\Run: [seb] rundll32 "C:\WINDOWS\Downlo~1\seb.dll",start
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] ctfmon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] ctfmon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] ctfmon.exe (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Bookshelfで検索(&L) - res://C:\PROGRAM FILES\MICROSOFT REFERENCE\MICROSOFT BOOKSHELF 3.0\BSDEF.DLL/#1001
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: このコンテンツを引用 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer でこのコンテンツに関する記事を書く(&B) - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ﾒｻﾆｴﾒﾖﾉ酩・ - {7DBC6ADB-5788-4FB9-AEC3-B40A58AC11DF} - http://www.yiqilai.com (file missing)
O9 - Extra button: リサーチ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: ﾒﾗﾈ､ｹｺﾎ・ - {FFB2385E-E812-4091-8C12-2370DC67F769} - http://www.eachnet.com/specials/digi.html?adid=dzcm_dza_000_soft0_digi (file missing)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5C945890-327C-11D5-995C-0090272E513E} (UpdateNecXPCtl Class) - file://E:\GuideXP\obj\UpNxp.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {D0FD5E32-CABD-4A6E-BD0F-94ACE89CCE03} (HGPluginJP23 Class) - http://down.hangame.co.jp/jp/dist/hgstart/HGPluginJP23.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: 584823C8 - Unknown owner - C:\WINDOWS\system32\279F07D0.EXE (file missing)
O23 - Service: 6F906650 - Unknown owner - C:\WINDOWS\system32\2E1A7558.EXE (file missing)
O23 - Service: 978FD - Unknown owner - C:\WINDOWS\system32\978FD.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BUFFALO Wireless Configuration Service (bwcsrv) - Unknown owner - C:\WINDOWS\System32\Drivers\bwcsrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: System Event loader (sysloader) - Unknown owner - C:\Documents and Settings\All Users\Application Data\Microsoft\Office\SYSTEM\sysloader.exe (file missing)
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: Yahoo Service (YahooSvr) - Unknown owner - C:\WINDOWS\system32\13242\svchost.exe (file missing)
O24 - Desktop Component 0: (no name) - https://www.microsoft.com/ja-jp
O24 - Desktop Component 2: アイモーニング - C:\Program Files\DigitalAdventure\imorning\start.htm
O24 - Desktop Component 3: BIGLOBE ACTIVE DESKTOP - C:\WINDOWS\WEB\Wallpaper\biglobe_adt.htm
Salut
Fais Démarrer > exécuter et tape cmd
puis valide avec ok
dans la fenêtre qui va s'ouvrir, copie et colle ceci:
del /a C:\WINDOWS\Tasks\アプリケーションの& #36215;動チューンアップ.job
et valide en appuyant sur entrée
Avant de supprimer d autres entrees. Analyses les.
Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
C:\WINDOWS\Installer\{90330411-6000-11D3-8CFE-0150048383C9}\cagico n.exe
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799
Pareil avec:
C:\WINDOWS\SYSTEM32\978FD.exe
C:\WINDOWS\SYSTEM32\llk1199018514.h << je sais pas si tu pourras celui la.
C:\WINDOWS\system32\DRIVERS\36n9pih2.sys
C:\WINDOWS\system32\279F07D0.EXE
A+
Fais Démarrer > exécuter et tape cmd
puis valide avec ok
dans la fenêtre qui va s'ouvrir, copie et colle ceci:
del /a C:\WINDOWS\Tasks\アプリケーションの& #36215;動チューンアップ.job
et valide en appuyant sur entrée
Avant de supprimer d autres entrees. Analyses les.
Vas sur le site https://virusscan.jotti.org/
- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
C:\WINDOWS\Installer\{90330411-6000-11D3-8CFE-0150048383C9}\cagico n.exe
- Clic sur submit toujours en haut à droite
- Le scan va se lancer, ça va prendre un petit instant
- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799
Pareil avec:
C:\WINDOWS\SYSTEM32\978FD.exe
C:\WINDOWS\SYSTEM32\llk1199018514.h << je sais pas si tu pourras celui la.
C:\WINDOWS\system32\DRIVERS\36n9pih2.sys
C:\WINDOWS\system32\279F07D0.EXE
A+
Re,
bon, g fait la premiere chose avec cmd.
Pour lasuite, je ne trouve pas le 1er lien
Voici les resultats pour ceux suivant :
Sinon, que penses tu pour ma cle usb et la transformation de dossiers en exe, les donnees sont elle perdues?
2eme pb, ma carte Xd, je n'arrive plus a la lire avec mon lecteur de carte, quand je veux l'ouvrir, cale m'affiche une fenetre pour l'ouvrir avec internet explorer ou autre programme, je l'ai scannee avec AVG et avast et des ficheris ont ete mis en quarantaine, depuis cela fait cela...qu'en penses tu egalement?
merci et a plus tard
Scanner results
Scan taken on 10 Jan 2008 07:27:59 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/Emogen-P
VirusBuster Found nothing
VBA32 Found Malware.VB.67 (paranoid heuristics) (probable variant)
-------------------
Scanner results
Scan taken on 10 Jan 2008 07:38:26 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Trojan.Downloader.Agent.YVW
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
------------------------------
pour ce lien, voici la reponse du scan : The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
-----------------------------
celui la, je ne le trouve pas non plus...
bon, g fait la premiere chose avec cmd.
Pour lasuite, je ne trouve pas le 1er lien
Voici les resultats pour ceux suivant :
Sinon, que penses tu pour ma cle usb et la transformation de dossiers en exe, les donnees sont elle perdues?
2eme pb, ma carte Xd, je n'arrive plus a la lire avec mon lecteur de carte, quand je veux l'ouvrir, cale m'affiche une fenetre pour l'ouvrir avec internet explorer ou autre programme, je l'ai scannee avec AVG et avast et des ficheris ont ete mis en quarantaine, depuis cela fait cela...qu'en penses tu egalement?
merci et a plus tard
Scanner results
Scan taken on 10 Jan 2008 07:27:59 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/Emogen-P
VirusBuster Found nothing
VBA32 Found Malware.VB.67 (paranoid heuristics) (probable variant)
-------------------
Scanner results
Scan taken on 10 Jan 2008 07:38:26 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Trojan.Downloader.Agent.YVW
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
------------------------------
pour ce lien, voici la reponse du scan : The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
-----------------------------
celui la, je ne le trouve pas non plus...
