Virus issas

pluton007 Messages postés 58 Statut Membre -  
ep44 Messages postés 7415 Date d'inscription   Statut Contributeur Dernière intervention   -
Bonjour,

dabord merci pour les efforts que vous fournissez pour la diffusion de la connaissance...

j'ai un probleme viral....il y a 2 jours jai trouve une bare d'outil inconue, qui a disparue apres que j'ai lance smitfraudfix, mais maintenant jai un message qui s'affiche dans le genre POP UP.... un qui dit que mon pc est infecte avec trojandownloader.xs et un autre qui dis que jai un probleme system plus du triangle jaune dans la bare d'outil....
aussi sur la liste des processus je trouve issas.exe
NB; avant de creer ce rapport, jai lance spybot, adaware, smitfraudfix, ccleaner en mode sans echec.

ne sachant pas lire les rapports hijackthis, je compte sur votre aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:33 AM, on 3/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\kvzfstdo.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.aol.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [kvzfstdo] C:\WINDOWS\system32\kvzfstdo.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.aol.com/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = zioui
O17 - HKLM\Software\..\Telephony: DomainName = zioui
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = zioui
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = zioui
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9369 bytes

Merci.
Configuration: Windows XP
Internet Explorer 7.0

4 réponses

  1. ep44 Messages postés 7415 Date d'inscription   Statut Contributeur Dernière intervention   3
     
    Bonjour

    quand tu as lancer smitfraudfix as tu choisit l'option 1 ou 2 ?
    si tu as lancé la 1 il faut le refaire en mode sans echec et choisir la 2
    poste le rapport

    ensuite
    Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    et sauvegarde le sur ton bureau et pas ailleurs!

    Double-clic sur combofix,
    Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

    @+
    0
    1. pluton007 Messages postés 58 Statut Membre 4
       
      Bonjour,

      Merci pour votre interet ...
      jai lancer ce programme en mode sans ecchec.

      le rapport est le suivant :


      =======================================

      ComboFix 08-03-24.1 - 2008-03-24 17:47:30.1 - NTFSx86 MINIMAL
      Microsoft Windows XP Professional [GMT -4:00]
      Running from: C:\Documents and Settings\Zaim\Desktop\ComboFix.exe

      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
      .
      -- Script messages for sUBs --
      VFind -td "C:\WINDOWS\system32\baiso*"
      CF13603.exe /c " VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\WINDOWS\* >Windir.dat"
      VFind.exe -ltf -s-1300000 -d+2007-12-24 C:\WINDOWS\*
      CF13603.exe /c " VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*" >progfile.dat"
      VFind.exe -ltf -s-1000000 -d+2007-12-24 "C:\Program Files\*"
      CF13603.exe /c " dir /a/s/b C:\_desktop.ini C:\desktop_.ini C:\cnsmin* C:\_install.exe >DirRoot"

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\WINDOWS\dwnrpofk.dll
      D:\Autorun.inf

      .
      ((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
      .

      2008-03-23 22:51 . 2008-03-23 22:51 <DIR> d-------- C:\Program Files\Trend Micro
      2008-03-23 15:05 . 2008-03-24 17:32 1,966 --a------ C:\WINDOWS\system32\tmp.reg
      2008-03-23 00:50 . 2008-03-23 00:50 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
      2008-03-22 23:24 . 2008-03-22 23:24 <DIR> d-------- C:\Documents and Settings\Zaim\DoctorWeb
      2008-03-22 23:23 . 2008-03-22 23:23 <DIR> d-------- C:\Program Files\PC-Cleaner
      2008-03-22 19:31 . 2008-03-22 19:41 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
      2008-03-22 18:27 . 2008-03-22 18:27 <DIR> d-------- C:\Documents and Settings\Zaim\Desktopvirii
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\DesktopTrojan.Win32.BlackBird.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\DesktopFWebdEditor.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\Desktopfwebd.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\Desktopfkwp2.0.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\Desktopfkwp1.5.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\Desktopfilemanagerclient.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\DesktopEditorFKWP2.0.exe
      2008-03-22 18:27 . 2008-03-22 18:27 4,096 --a------ C:\Documents and Settings\Zaim\DesktopEditorFKWP1.5.exe
      2008-03-22 18:26 . 2008-03-22 17:57 245,760 --a------ C:\WINDOWS\kdftlboeakn.dll
      2008-03-16 14:30 . 2008-03-16 14:31 <DIR> d-------- C:\Program Files\RocketDock
      2008-03-07 14:03 . 2008-03-07 14:03 625,032 --a------ C:\WINDOWS\system32\SymNeti.dll
      2008-03-07 14:03 . 2008-03-07 14:03 242,056 --a------ C:\WINDOWS\system32\SymRedir.dll
      2008-03-07 13:40 . 2008-03-07 13:40 13,035 --a------ C:\WINDOWS\system32\drivers\SymRedir.cat
      2008-03-07 13:40 . 2008-03-07 13:40 1,358 --a------ C:\WINDOWS\system32\drivers\SymRedir.inf
      2008-03-07 13:39 . 2008-03-07 13:39 191,536 --a------ C:\WINDOWS\system32\drivers\symtdi.sys
      2008-03-07 13:39 . 2008-03-07 13:39 145,968 --a------ C:\WINDOWS\system32\drivers\symfw.sys
      2008-03-07 13:39 . 2008-03-07 13:39 39,984 --a------ C:\WINDOWS\system32\drivers\symids.sys
      2008-03-07 13:39 . 2008-03-07 13:39 37,936 --a------ C:\WINDOWS\system32\drivers\symndisv.sys
      2008-03-07 13:39 . 2008-03-07 13:39 35,120 --a------ C:\WINDOWS\system32\drivers\symndis.sys
      2008-03-07 13:39 . 2008-03-07 13:39 27,696 --a------ C:\WINDOWS\system32\drivers\symredrv.sys
      2008-03-07 13:39 . 2008-03-07 13:39 12,848 --a------ C:\WINDOWS\system32\drivers\symdns.sys
      2008-02-28 01:45 . 2008-03-16 20:11 <DIR> d-------- C:\Program Files\Microsoft Silverlight
      2008-02-28 01:40 . 2008-02-28 01:42 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 9.0
      2008-02-28 01:40 . 2008-02-28 01:41 <DIR> d-------- C:\Program Files\Common Files\Merge Modules
      2008-02-28 01:39 . 2008-02-28 01:39 <DIR> d-------- C:\Program Files\Microsoft SDKs
      2008-02-28 01:37 . 2008-02-28 01:37 <DIR> d-------- C:\WINDOWS\system32\fr-FR
      2008-02-28 01:35 . 2008-02-28 01:35 <DIR> d-------- C:\Program Files\MSBuild
      2008-02-28 01:34 . 2008-02-28 01:34 <DIR> d-------- C:\Program Files\Reference Assemblies
      2008-02-26 17:21 . 2002-12-18 14:23 115,016 -ra------ C:\WINDOWS\system32\MSINET.OCX
      2008-02-26 17:21 . 2002-12-18 14:23 89,360 -ra------ C:\WINDOWS\system32\VB5DB.DLL
      2008-02-26 17:21 . 2002-12-18 14:23 69,632 -ra------ C:\WINDOWS\system32\xmltok.dll
      2008-02-26 17:21 . 2002-12-18 14:23 36,864 -ra------ C:\WINDOWS\system32\xmlparse.dll
      2008-02-26 17:21 . 2002-12-18 14:23 35,840 -ra------ C:\WINDOWS\system32\comdlg32.oca
      2008-02-26 17:21 . 2002-12-18 14:23 29,184 -ra------ C:\WINDOWS\system32\MSINET.oca
      2008-02-26 17:21 . 2002-12-19 03:20 26,096 -ra------ C:\WINDOWS\system32\xmlinst.exe
      2008-02-26 17:21 . 2002-12-18 14:23 24,576 -ra------ C:\WINDOWS\system32\msxml3a.dll
      2008-02-26 17:13 . 2008-02-26 17:21 <DIR> d-------- C:\Program Files\Ubi Soft
      2008-02-25 14:44 . 2008-02-25 14:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
      2008-02-25 14:08 . 2008-02-25 14:08 <DIR> d-------- C:\Program Files\DIFX

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-03-24 21:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
      2008-03-24 20:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared
      2008-03-24 07:38 --------- d-----w C:\Program Files\eMule
      2008-03-24 03:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
      2008-03-21 18:15 --------- d-----w C:\Program Files\Common Files\Adobe
      2008-03-21 06:36 --------- d-----w C:\Documents and Settings\Zaim\Application Data\Skype
      2008-03-13 02:34 73,000 ----a-w C:\Documents and Settings\Zaim\Application Data\GDIPFONTCACHEV1.DAT
      2008-03-11 01:04 --------- d-----w C:\Program Files\Norton Internet Security
      2008-02-28 05:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
      2008-02-28 05:41 --------- d-----w C:\Program Files\Microsoft.NET
      2008-02-28 04:32 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
      2008-02-26 21:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-02-23 11:57 --------- d-----w C:\Program Files\Microsoft SQL Server
      2008-02-17 15:47 --------- d-----w C:\Program Files\iTunes
      2008-02-17 04:19 --------- d-----w C:\Documents and Settings\Zaim\Application Data\iLike
      2008-02-12 17:17 --------- d-----w C:\Program Files\Spybot - Search & Destroy
      2008-02-12 17:08 691,545 ----a-w C:\WINDOWS\unins000.exe
      2008-02-03 17:00 --------- d-----w C:\Program Files\QuickTime
      2008-02-03 17:00 --------- d-----w C:\Documents and Settings\Zaim\Application Data\Apple Computer
      2008-02-03 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
      2008-02-03 16:58 --------- d-----w C:\Program Files\iPod
      2008-02-02 00:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
      2008-02-02 00:50 --------- d-----w C:\Program Files\Lavasoft
      2008-02-02 00:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
      2008-01-11 05:53 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
      2008-01-07 19:50 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
      2007-10-23 15:59 0 -c--a-w C:\Documents and Settings\Zaim\Application Data\wklnhst.dat
      2007-09-03 04:43 251 -c----w C:\Program Files\wt3d.ini
      2006-12-23 05:38 22 -csh--w C:\WINDOWS\SMINST\HPCD.sys
      .

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-16 00:00 15360]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512]
      "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-22 16:17 94208]
      "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-22 16:13 77824]
      "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-22 16:17 118784]
      "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 22:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
      "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59 115816]
      "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-09-05 22:22 26248]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
      "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
      "UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
      "LightScribeService"=2 (0x2)

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\WINDOWS\\system32\\mqsvc.exe"=
      "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
      "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "C:\\Program Files\\eMule\\emule.exe"=
      "C:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
      "C:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
      "C:\\WINDOWS\\system32\\dpvsetup.exe"=
      "C:\\WINDOWS\\system32\\rundll32.exe"=
      "C:\\Program Files\\Messenger\\msmsgs.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
      "C:\\Program Files\\iTunes\\iTunes.exe"=
      "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
      "67:UDP"= 67:UDP:DHCP Discovery Service

      S2 SQLWriter;Enregistreur VSS SQL Server;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 06:29]
      S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;C:\WINDOWS\system32\Drivers\5U870CAP.sys [2006-06-06 16:39]
      S3 MemStPCI;Sony Memory Stick controller (PCI);C:\WINDOWS\system32\DRIVERS\MemStPCI.SYS [2004-08-04 00:00]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b79c41fb-ee04-11db-bcd6-0018de7faeae}]
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b79c41fc-ee04-11db-bcd6-0018de7faeae}]
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe

      *Newly Created Service* - CATCHME
      *Newly Created Service* - COMHOST
      *Newly Created Service* - MDMXSDK
      .
      Contents of the 'Scheduled Tasks' folder
      "2008-03-06 03:00:02 C:\WINDOWS\Tasks\avast! Antivirus.job"
      - C:\PROGRA~1\ALWILS~1\Avast4\ashAvast.exe
      "2008-02-09 04:29:19 C:\WINDOWS\Tasks\ccleaner.job"
      - C:\Program Files\CCleaner\ccleaner.exe
      "2008-02-26 03:17:09 C:\WINDOWS\Tasks\Disk Cleanup.job"
      - C:\WINDOWS\system32\cleanmgr.exe
      "2008-03-24 21:48:28 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
      - C:\Program Files\Windows Defender\MpCmdRun.exe
      "2008-03-22 00:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Zaim.job"
      - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
      "2008-03-14 19:49:20 C:\WINDOWS\Tasks\Windows Defender.job"
      - C:\PROGRA~1\WIFD1F~1\MSASCui.exe
      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-03-24 17:49:50
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************
      .
      Completion time: 2008-03-24 17:50:17
      ComboFix-quarantined-files.txt 2008-03-24 21:50:09
      .
      2008-03-20 19:47:46 --- E O F ---

      =========================================================


      Merci...
      0
  2. ep44 Messages postés 7415 Date d'inscription   Statut Contributeur Dernière intervention   3
     
    Télécharge sur le bureau : [url=http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe]navilog.exe[/url]

    = installe le
    = Double-Clic navilog1 qui est sur le bureau
    = Appuyer sur une touche jusqu' arriver aux options
    = Choisir option 1 ( = taper 1 )
    ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

    le rapport se trouve dans c: fixnavi.txt

    tu postes ce rapport.

    ---------------------
    Télecharge http://www.malekal.com/download/clean.zip sur le bureau
    Dézippe sur le bureau.
    = ouvrir le dossier clean
    = clique sur le symbole roue dentée avec le nom clean
    = choisir l'option 1 et laisser clean travailler jusqu'à l'apparition du texte "appuyer sur une touche pour continuer"
    = ensuite colle le rapport que tu trouveras dans C:

    @+
    0
  3. DqM Messages postés 30 Statut Membre
     
    j'ai choppé un virus via msn ,( quel idiot) , un de mes contact m'envoi "http.monadresse.1fp9.info" ou un truc du genre , je vous ai donc fait un rapport avec hijackthis : aidez moi svp!

    Logfile of HijackThis v1.99.1
    Scan saved at 17:59:20, on 18/04/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
    C:\WINDOWS\Mixer.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\SuperCopier2\SuperCopier2.exe
    C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Documents and Settings\DaMien\Bureau\w3hph.exe
    C:\PROGRA~1\Grisoft\AVG7\avgwb.dat
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\DaMien\Bureau\log\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\DaMien\OctoshapeClient.exe" -inv:bootrun
    O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
    O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
    O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {18226BF8-DC0B-4D81-80E9-A41AE37BB73A} - http://www.pplive.com/zh-cn/other/live/install.cab
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    0
  4. ep44 Messages postés 7415 Date d'inscription   Statut Contributeur Dernière intervention   3
     
    Bonsoir DqM,

    il faut créer ton propre sujet
    Merci

    @+

    0