trojan Fermé

Question

Bonjour,voici le report je veux de l aide svp pour 
C\autorun.infWin32/PSW.OnLineGames.NNU trojan   et D\autorun.inf Win32/PSW.OnLineGames.NNU trojan


[b]SDFix: Version 1.221 [/b]
Run by HP_Sahibi on 04.09.2008 at 22:27

Microsoft Windows XP [Srm 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\DOCUME~1\HP_SAH~1\LOCALS~1\Temp	mp7.tmp - Deleted
C:\DOCUME~1\HP_SAH~1\LOCALS~1\Temp	mp7.tmp - Deleted
C:\WINDOWS\svchost.ini  - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-04 22:37:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:40,59,9a,33,76,fe,3b,27,f1,76,5b,70,cd,55,22,78,ed,f3,c7,fa,94,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f9,89,b5,c6,56,6a,4e,fe,19,02,3a,f2,87,0c,44,8e,cf,..
"khjeh"=hex:c3,ce,53,ec,bd,f5,09,89,eb,df,a5,20,57,2f,2b,94,4f,e8,08,3f,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ae,89,1a,31,4b,0d,43,bc,88,d8,26,b8,f2,27,b9,ff,eb,71,83,26,4e,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:76199a43
"s2"=dword:bbe52fd4
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:40,59,9a,33,76,fe,3b,27,f1,76,5b,70,cd,55,22,78,ed,f3,c7,fa,94,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f9,89,b5,c6,56,6a,4e,fe,19,02,3a,f2,87,0c,44,8e,cf,..
"khjeh"=hex:c3,ce,53,ec,bd,f5,09,89,eb,df,a5,20,57,2f,2b,94,4f,e8,08,3f,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ae,89,1a,31,4b,0d,43,bc,88,d8,26,b8,f2,27,b9,ff,eb,71,83,26,4e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:40,59,9a,33,76,fe,3b,27,f1,76,5b,70,cd,55,22,78,ed,f3,c7,fa,94,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f9,89,b5,c6,56,6a,4e,fe,19,02,3a,f2,87,0c,44,8e,cf,..
"khjeh"=hex:c3,ce,53,ec,bd,f5,09,89,eb,df,a5,20,57,2f,2b,94,4f,e8,08,3f,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ae,89,1a,31,4b,0d,43,bc,88,d8,26,b8,f2,27,b9,ff,eb,71,83,26,4e,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\MotoGP2\motogp2.exe"="C:\Program Files\MotoGP2\motogp2.exe:*:Enabled:motogp2"
"C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"="C:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe:*:Enabled:Nero Home"
"C:\Program Files\KWorld Multimedia\DVBS\DVBS.EXE"="C:\Program Files\KWorld Multimedia\DVBS\DVBS.EXE:*:Enabled:DVBS"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Program Files\ProgDVB\ProgDVB.exe"="C:\Program Files\ProgDVB\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\Program Files\ProgDVB PIP\ProgDVB.exe"="C:\Program Files\ProgDVB PIP\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\Program Files\Winlirc\winlirc.exe"="C:\Program Files\Winlirc\winlirc.exe:*:Enabled:winlirc"
"C:\Program Files\ProgDVB ek\ProgDVB.exe"="C:\Program Files\ProgDVB ek\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\Program Files\ProgDVBStd\ProgDVB.exe"="C:\Program Files\ProgDVBStd\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\WINDOWS\bittorrent.exe"="C:\WINDOWS\bittorrent.exe:*:Enabled:bittorrent"
"C:\Program Files\Program Files e Kopyalanacak\ProgDVB PIP\ProgDVB.exe"="C:\Program Files\Program Files e Kopyalanacak\ProgDVB PIP\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\Program Files\Program Files e Kopyalanacak\ProgDVB\ProgDVB.exe"="C:\Program Files\Program Files e Kopyalanacak\ProgDVB\ProgDVB.exe:*:Enabled:ProgDVB"
"C:\Program Files\EA GAMES\Medal of Honor Pacific Assault(tm)\mohpa.exe"="C:\Program Files\EA GAMES\Medal of Honor Pacific Assault(tm)\mohpa.exe:*:Enabled:Medal of Honor Pacific Assault(tm)"
"C:\Program Files\EA GAMES\Medal of Honor Pacific Assault(tm)\mohpa_server.exe"="C:\Program Files\EA GAMES\Medal of Honor Pacific Assault(tm)\mohpa_server.exe:*:Disabled:Medal of Honor Pacific Assault(tm)"
"C:\Program Files\ProgDVB\ProgDvbNet.exe"="C:\Program Files\ProgDVB\ProgDvbNet.exe:*:Enabled:ProgDvbNet"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\Documents and Settings\HP_Sahibi\Desktop\MASAšSTš\OYUNLAR\Pocket Tanks Deluxe 1.3\pockettanks.exe"="C:\Documents and Settings\HP_Sahibi\Desktop\MASAšSTš\OYUNLAR\Pocket Tanks Deluxe 1.3\pockettanks.exe:*:Enabled:Pocket Tanks"
"C:\Program Files\Pikatel KKP AirMax101\TestProgrami.exe"="C:\Program Files\Pikatel KKP AirMax101\TestProgrami.exe:*:Enabled:Test Programi"
"C:\Program Files\iMesh Applications\iMesh\iMesh.exe"="C:\Program Files\iMesh Applications\iMesh\iMesh.exe:*:Enabled:iMesh"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Sat 30 Sep 2006           211 A.SHR --- "C:\BOOT.BAK"
Wed  4 Oct 2006            22 A.SH. --- "C:\WINDOWS\SMINST\HPCD.sys"
Wed  3 Sep 2008        90,163 ..SHR --- "C:\WINDOWS\system32\ckvo.exe"
Thu  4 Sep 2008        84,992 ..SHR --- "C:\WINDOWS\system32\ckvo0.dll"
Wed  3 Sep 2008        84,992 ..SHR --- "C:\WINDOWS\system32\ckvo1.dll"
Tue 18 Mar 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 15 Sep 2007     1,272,712 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\183dd00d26903386078af794b855d4fa\BIT2C4.tmp"
Sat 15 Sep 2007     2,392,912 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\20e960814d2dddc2f2c98f6881013c19\BIT2C1.tmp"
Sat 15 Sep 2007     1,199,856 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2358b754b872301be3b59d13055da53c\BIT2C2.tmp"
Fri 15 Jun 2007     2,559,312 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\47ae52f6a925bd5c32e6849b1ebb2638\BIT2CE.tmp"
Sat 15 Sep 2007     4,721,032 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4d958289df727378a950b3d0a4d67dc0\BIT2C3.tmp"
Thu 15 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\65ab46151db05a9949495339e2bd4cd1\BIT4B5.tmp"
Mon  1 Sep 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7619c9cc91e23f51832d389eb58946e1\BIT96.tmp"
Thu 24 Apr 2008     8,856,616 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\87ef61b404e0fcd78099ed319f57614d\BIT665.tmp"
Thu 15 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\93b93838d4f1ba61d7e585e9bcc4441d\BIT4B4.tmp"
Thu 15 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9d79d29ac08f276a0f3b9f5cb58f6aa0\BIT4B3.tmp"
Tue 12 Jun 2007       617,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a5eb50c3f530f9ad935c86119193a873\BIT2C0.tmp"
Thu 15 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c3b0a8cc51184b9d1e002772c1a68cc6\BIT4B6.tmp"
Sun 16 Sep 2007       798,544 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f4d26348bf3342b3fd1c6f1929d916f3\BIT2C9.tmp"
Tue 30 Nov 2004       253,952 A..HR --- "C:\Documents and Settings\HP_Sahibi\Belgelerim\CruzerLock2(bellek)\PocketCache Trial Version\BackupRestoreBus.dll"
Sun 10 Feb 2008       117,093 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0cb24dc1be2e4f81ccb3c95360a35db4\download\BIT6AB.tmp"
Sun 16 Sep 2007     1,248,571 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1b9f02e1139554e532d9294b7645637a\download\BIT2CB.tmp"
Fri 15 Jun 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1d983905e49664becea2494d75082b5b\download\BIT233.tmp"
Wed 30 May 2007        87,198 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5529124e9029d6f52e69308b5a45ecc6\download\BIT2B9.tmp"
Sun  6 Jan 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5da74264a5d195ec06c321b2512895d7\download\BIT45F.tmp"
Sat 30 Jun 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\64034707117c0126e444b95e628869e0\download\BIT266.tmp"
Wed 30 May 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\89f4455bfd069c6f1a5b4a3cda1709f0\download\BIT2CD.tmp"
Sun 10 Feb 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8ee01a95c45a0096143ebb9a1d728cdb\download\BIT793.tmp"
Wed 30 May 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\98aee150de98580c06ae36dd5dfee054\download\BIT2D0.tmp"
Sun 16 Sep 2007       131,849 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c10a76f932759770c684aeac535e67ec\download\BIT2C8.tmp"
Tue 12 Jun 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ea8d1c19c4d6e107931d93285b9c5d00\download\BIT235.tmp"
Thu 24 Apr 2008       271,000 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ee225835007374d46e676bf4da90d4dd\download\BIT9C0.tmp"
Wed 30 May 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f6e2a2aa71069b6fc93e12dbbc3a9bd4\download\BIT2CC.tmp"
Fri 15 Jun 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\faf94a7a1241751f790a398532149cb1\download\BIT234.tmp"
Fri 13 Oct 2006         6,838 A..H. --- "C:\Documents and Settings\HP_Sahibi\Application Data\Microsoft\Office\Shortcut Bar\Off118.tmp"
Thu 14 Dec 2006         1,558 A..H. --- "C:\Documents and Settings\HP_Sahibi\Application Data\Microsoft\Office\Shortcut Bar\Sk117.tmp"
Sun 17 Dec 2006           473 A..HR --- "C:\Documents and Settings\HP_Sahibi\Belgelerim\CruzerLock2(bellek)\PocketCache Trial Version\BackupStorage\config.bak"

[b]Finished![/b]

Utilisateur anonyme · Answer

Bonjour

Un problème ça s'explique !

Trojan

1 réponse

Discussions similaires