Problème redirection google rapport hijackthi

Résolu
olivier -  
 DeNeCKoS -
Bonjour,

J'ai un problème de redirection des pages depuis IE et firefox alors que je les ai désinstallé et réinstallé (ça a rien changé). Deplus j'ai pleins de pages inaccessibles : par exemple, pour poster sur ce forum, j'ai du utiliser un autre pc...

Bon, j'ai trouvé quelque part qu'il fallait faire un rapport hijackthis, alors le voila. Par avance, merci aux personnes de bonne volonté!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:22:16, on 26/08/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal



Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\StacSV.exe

C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe

C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\msdtc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe

C:\Program Files\Wave Systems Corp\SecureUpgrade.exe

C:\WINDOWS\system32\KADxMain.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe

C:\Program Files\FullSave\FullSaveTasksManager.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\spider.exe

c:\progra~1\fichie~1\instal~1\update~1\isuspm.exe

C:\Program Files\Fichiers communs\InstallShield\UpdateService\agent.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\AVG\AVG8\aAvgApi.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=1080228

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row-rel&channel=fr&ibd=1080228

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe

O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe

O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe

O4 - HKLM\..\Run: [FullSave] C:\Program Files\FullSave\FullSaveTasksManager.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Bluetooth Manager.lnk = ?

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html

O17 - HKLM\System\CCS\Services\Tcpip\..\{5D08B6FC-EC34-42DB-83B2-BFA1728D2CB4}: NameServer = 195.220.59.2,195.220.59.6

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - AppInit_DLLs: avgrsstx.dll

O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll

O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe

O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe

O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe

O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe


A voir également:

6 réponses

DeNeCKoS
 
Salut !

Ta machine me semble infecté par des petits spywares pour cela il faut que tu passes un coup d'ADaware et Spybot et fait un test antivirus soit en ligne soit a jour et en mode sans échec en n'oubliant pas de désactivé la restauration du système.

Fais déjà ce que je viens de te marquer et a mon avis ta tour fonctionnera déjà mieux !

Bonne journée :)
0
olivier
 
merci DeNeCKos, je vais faire ça, je te tiens au courant :)
0
olivier
 
bon, je n'ai réussi à faire tourner ni l'un ni l'autre.
adaware a planté en milieu de détection. Quand j'essaye de le relancer, il me dit "scanner is busy" les robots font la grêve?
quand à spybot, il me dit qu'il n'arrive pas à se connecter au serveur.
A noter que AVG me dit également que l'update ne marche pas.

bon, c'est un peu la loose. Je suis en train de me demander si je ne vais pas sauver mes documents importants et formater tout ça... :(
0
DeNeCKoS
 
as tu essayer en mode sans echec ?

Sinon moi je te conseillerai de telecharger Avast familliale (gratos) et tu l'installes il va te demander si tu veux planifier un test antivirus au demarrage et tu met ok et tu relance ta machine ^^

Allez a plutard ^^
0
olivier
 
bon, le seul que j'ai réussi à faire tourner et qui arrive à télécharger son update, c'est antivir (les autres sont bloqués). Par ailleurs, je n'ai accès à aucun antivirus en ligne: ie et firefox refusent d'accéder à toutes les pages d'antivirus (franchement, ces types qui créent des virus ont l'air d'avoir du talent, c'est bien dommage qu'ils l'emploient à ces merdes qui m'ont déjà fait perdre deux jours de congés).
antivirus a trouvé 12 fichiers infectés.
Ceci dit, ça ne marche toujours pas.
bon, je met le rapport de l'antivirus, si jamais c'était d'une utilité quelconque.





Avira AntiVir Personal

Report file date: mardi 26 août 2008 12:40



Scanning for 1574174 virus strains and unwanted programs.



Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: CGSO9



Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:38:52

ANTIVIR2.VDF : 7.0.6.60 2802176 Bytes 24/08/2008 10:39:11

ANTIVIR3.VDF : 7.0.6.70 75264 Bytes 26/08/2008 10:39:12

Engineversion : 8.1.1.23

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.68 315770 Bytes 26/08/2008 10:39:36

AESCN.DLL : 8.1.0.23 119156 Bytes 26/08/2008 10:39:34

AERDL.DLL : 8.1.0.20 418165 Bytes 26/08/2008 10:39:33

AEPACK.DLL : 8.1.2.1 364917 Bytes 26/08/2008 10:39:31

AEOFFICE.DLL : 8.1.0.22 192890 Bytes 26/08/2008 10:39:29

AEHEUR.DLL : 8.1.0.50 1388918 Bytes 26/08/2008 10:39:27

AEHELP.DLL : 8.1.0.15 115063 Bytes 26/08/2008 10:39:22

AEGEN.DLL : 8.1.0.36 315764 Bytes 26/08/2008 10:39:20

AEEMU.DLL : 8.1.0.7 430452 Bytes 26/08/2008 10:39:17

AECORE.DLL : 8.1.1.8 172406 Bytes 26/08/2008 10:39:15

AEBB.DLL : 8.1.0.1 53617 Bytes 26/08/2008 10:39:14

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 8.0.0.2 98344 Bytes 26/08/2008 10:39:13

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11



Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium



Start of the scan: mardi 26 août 2008 12:40



The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'searchfilterhost.exe' - '1' Module(s) have been scanned

Scan process 'avgrsx.exe' - '1' Module(s) have been scanned

Scan process 'avgwdsvc.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'searchprotocolhost.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'agent.exe' - '1' Module(s) have been scanned

Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'TosBtHSP.exe' - '1' Module(s) have been scanned

Scan process 'TosBtHid.exe' - '1' Module(s) have been scanned

Scan process 'TosA2dp.exe' - '1' Module(s) have been scanned

Scan process 'Dot1XCfg.exe' - '1' Module(s) have been scanned

Scan process 'WindowsSearch.exe' - '1' Module(s) have been scanned

Scan process 'DLG.exe' - '1' Module(s) have been scanned

Scan process 'TosBtMng.exe' - '1' Module(s) have been scanned

Scan process 'rapimgr.exe' - '1' Module(s) have been scanned

Scan process 'FNPLicensingService.exe' - '1' Module(s) have been scanned

Scan process 'wcescomm.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'avgtray.exe' - '1' Module(s) have been scanned

Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned

Scan process 'FullSaveTasksManager.exe' - '1' Module(s) have been scanned

Scan process 'stsystra.exe' - '1' Module(s) have been scanned

Scan process 'igfxpers.exe' - '1' Module(s) have been scanned

Scan process 'hkcmd.exe' - '1' Module(s) have been scanned

Scan process 'Acrotray.exe' - '1' Module(s) have been scanned

Scan process 'PDVDDXSrv.exe' - '1' Module(s) have been scanned

Scan process 'DrgToDsc.exe' - '1' Module(s) have been scanned

Scan process 'issch.exe' - '1' Module(s) have been scanned

Scan process 'KADxMain.exe' - '1' Module(s) have been scanned

Scan process 'SecureUpgrade.exe' - '1' Module(s) have been scanned

Scan process 'WavXDocMgr.exe' - '1' Module(s) have been scanned

Scan process 'ZCfgSvc.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'msdtc.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'searchindexer.exe' - '1' Module(s) have been scanned

Scan process 'WLKEEPER.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'TdmService.exe' - '1' Module(s) have been scanned

Scan process 'tcsd_win32.exe' - '1' Module(s) have been scanned

Scan process 'stacsv.exe' - '1' Module(s) have been scanned

Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned

Scan process 'NicConfigSvc.exe' - '1' Module(s) have been scanned

Scan process 'MDM.EXE' - '1' Module(s) have been scanned

Scan process 'EvtEng.exe' - '1' Module(s) have been scanned

Scan process 'AsfIpMon.exe' - '1' Module(s) have been scanned

Scan process 'scardsvr.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

70 processes with 70 modules were scanned



Starting master boot sector scan:

Master boot sector HD0

[INFO] No virus was found!

Master boot sector HD1

[INFO] No virus was found!



Start scanning boot sectors:

Boot sector 'C:\'

[INFO] No virus was found!



Starting to scan the registry.

The registry was scanned ( '45' files ).





Starting the file scan:



Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Admin\Local Settings\Temp\.tt3.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de4e.qua'!

C:\Documents and Settings\Admin\Local Settings\Temp\.tt4.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de4f.qua'!

C:\Documents and Settings\Admin\Local Settings\Temp\.tt7.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '48d2c458.qua'!

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt3.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de83.qua'!

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt4.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de84.qua'!

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt5.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '48d2c48d.qua'!

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt6.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de86.qua'!

C:\Documents and Settings\Olivier\Local Settings\Temp\.ttBB.tmp.vbs

[DETECTION] Contains detection pattern of the VBS script virus VBS/Agent.1002

[NOTE] The file was moved to '4927de85.qua'!

C:\RECYCLER\S-1-5-21-3886358896-2470406629-2495730686-1005\Dc3.exe

[DETECTION] Is the Trojan horse TR/Drop.FakeAlert.D

[NOTE] The file was moved to '48e6e28b.qua'!

C:\WINDOWS\system32\lphcjfbj0ev9g.exe

[DETECTION] Is the Trojan horse TR/Dldr.FraudLoad.cta

[NOTE] The file was moved to '491be428.qua'!

C:\WINDOWS\system32\phcjfbj0ev9g.bmp

[DETECTION] Is the Trojan horse TR/Fakealert.AAF

[NOTE] The file was moved to '4916e436.qua'!

C:\WINDOWS\system32\pphcjfbj0ev9g.exe

[DETECTION] Is the Trojan horse TR/Dldr.FraudLoa.NC

[NOTE] The file was moved to '491be43f.qua'!





End of the scan: mardi 26 août 2008 13:09

Used time: 28:37 min



The scan has been done completely.



7323 Scanning directories

254955 Files were scanned

12 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

12 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

254943 Files not concerned

3428 Archives were scanned

2 Warnings

12 Notes
0
DeNeCKoS
 
Il faudrais que tu vire deja tout les cookie et les temporaires desactive la restauration du systeme et que tu télécharge Malware Bytes (dsl j ai pas le lien avec moi ms dans Google tu le trouvera) tu l'installes et tu redemarres ton pc en mode sans echec (F8 au démarrage du pc).

Tu relace AntiVir et apres tu lance Malware Bytes.

On verra si c'est deja mieu ^^
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
olivier
 
wow malware a trouvé 47 infections... je suis presque fier de moi... lol. J'ai supprimé tous les fichiers. Comment on désactive la restauration du système?

bon, voila son rapport:

Malwarebytes' Anti-Malware 1.25

Database version: 1088

Windows 5.1.2600 Service Pack 2



00:16:33 27/08/2008

mbam-log-08-27-2008 (00-16-15).txt



Scan type: Full Scan (C:\|)

Objects scanned: 102680

Time elapsed: 1 hour(s), 34 minute(s), 33 second(s)



Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 13

Files Infected: 25



Memory Processes Infected:

(No malicious items detected)



Memory Modules Infected:

(No malicious items detected)



Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcnfbj0ev9g (Rogue.Multiple) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\rhcnfbj0ev9g (Rogue.Multiple) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.



Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.



Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\oembios.exe -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\oembios.exe -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\oembios.exe,) Good: (userinit.exe) -> No action taken.



Folders Infected:

C:\WINDOWS\system32\sysproc64 (Trojan.Agent) -> No action taken.

C:\Program Files\rhcnfbj0ev9g (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.

C:\Documents and Settings\Olivier\Application Data\rhcnfbj0ev9g\Quarantine\Packages (Rogue.Multiple) -> No action taken.



Files Infected:

C:\WINDOWS\system32\blphcjfbj0ev9g.scr (Trojan.FakeAlert) -> No action taken.

C:\WINDOWS\system32\sysproc64\sysproc32.sys (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\sysproc64\sysproc86.sys (Trojan.Agent) -> No action taken.

C:\Program Files\rhcnfbj0ev9g\MFC71.dll (Rogue.Multiple) -> No action taken.

C:\Program Files\rhcnfbj0ev9g\MFC71ENU.DLL (Rogue.Multiple) -> No action taken.

C:\Program Files\rhcnfbj0ev9g\msvcp71.dll (Rogue.Multiple) -> No action taken.

C:\Program Files\rhcnfbj0ev9g\msvcr71.dll (Rogue.Multiple) -> No action taken.

C:\Program Files\rhcnfbj0ev9g\rhcnfbj0ev9g.exe (Rogue.Multiple) -> No action taken.

C:\WINDOWS\system32\oembios.exe (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> No action taken.

C:\Documents and Settings\Olivier\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> No action taken.
0
olivier
 
Je pense que c'est bon, j'ai plus de problème. Merci pour ton aide DeNeCKos
0
DeNeCKoS
 
Re !

Juste un petit truc pour finir et apres je pense que sa sera bon !

Enleve AntiVir et met maintenant Avast tu l'installes et il va te demander de faire un scan au demarrage tu fais ok
il va scanner ton pc avant d arriver sur WINDOWS et il va surement en trouver d'autres ^^

Puis laisse Avast sur Ton pc


Tcho ^^
0