Bonjour, J'ai été infectée par le virus/trojan Core10k.exe. Avec Hijackthis, j'ai un log. Quelqu'un peut-il me dire ce que je dois faire pour me débarasser de cet enfer de virus? Merci infiniment. Voici mon log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:18:32, on 08/11/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\SYSTEM32\WISPTIS.EXE C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\WTablet\Pen_TabletUser.exe C:\hp\support\hpsysdrv.exe C:\hp\KBD\kbd.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Users\Owner\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://ici.radio-canada.ca/info R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: D - {880CB49C-24C7-306A-9166-6170A98F7A95} - C:\Windows\system32\xwr69335.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Win2KService] C:\Windows\System32\office2007\mirc.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-8.0.9.41/backgammon/backgammon-en_US.cab O16 - DPF: Battle Phlinx by pogo - http://game1.pogo.com/applet-8.0.9.41/battlephlinx/battlephlinx-en_US.cab O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-8.0.9.41/vbjack2/vbjack2-en_US.cab O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-8.0.9.41/bowling/bowling-en_US.cab O16 - DPF: Hangman Hijinks by pogo - http://game1.pogo.com/applet-8.0.9.41/hangman/hangman-en_US.cab O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.9.41/flinger/flinger-en_US.cab O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-8.0.9.41/squares/squares-en_US.cab O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/v/8.1.2.24/applet/holdem/holdem-en_US.cab O16 - DPF: Thousand Island Solitaire by pogo - http://game1.pogo.com/v/8.1.2.12/applet/millbrae/millbrae-en_US.cab O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-8.0.9.41/tumbee2/tumbee2-en_US.cab O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-8.0.9.41/babble/babble-en_US.cab O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-8.0.9.41/wordwhomp2/whomp2-en_US.cab O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-8.0.9.41/whackdown/whackdown-en_US.cab O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-8.0.9.41/wordjong/wordjong-en_US.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Bonjour, Désactive l'uac : https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html ************************** J'ai été infectée par le virus/trojan Core10k.exe. C'est ton anti-virus qui te le détecte ? Je pourrais avoir son rapport ? ************************** Relance Hijackthis, choisi " Do a system scan only " & coche la case devant ces lignes : O16 - DPF: Backgammon by pogo - http://game1.pogo.com/applet-8.0.9.41/backgammon/backgammon-en_US.cab O16 - DPF: Battle Phlinx by pogo - http://game1.pogo.com/applet-8.0.9.41/battlephlinx/battlephlinx-en_US.cab O16 - DPF: Blackjack Carnival by pogo - http://game1.pogo.com/applet-8.0.9.41/vbjack2/vbjack2-en_US.cab O16 - DPF: Bowling by pogo - http://game1.pogo.com/applet-8.0.9.41/bowling/bowling-en_US.cab O16 - DPF: Hangman Hijinks by pogo - http://game1.pogo.com/applet-8.0.9.41/hangman/hangman-en_US.cab O16 - DPF: Phlinx by pogo - http://game1.pogo.com/applet-8.0.9.41/flinger/flinger-en_US.cab O16 - DPF: QWERTY by pogo - http://game1.pogo.com/applet-8.0.9.41/squares/squares-en_US.cab O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.com/v/8.1.2.24/applet/holdem/holdem-en_US.cab O16 - DPF: Thousand Island Solitaire by pogo - http://game1.pogo.com/v/8.1.2.12/applet/millbrae/millbrae-en_US.cab O16 - DPF: Tumble Bees by pogo - http://game1.pogo.com/applet-8.0.9.41/tumbee2/tumbee2-en_US.cab O16 - DPF: Word Craft by pogo - http://game1.pogo.com/applet-8.0.9.41/babble/babble-en_US.cab O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-8.0.9.41/wordwhomp2/whomp2-en_US.cab O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-8.0.9.41/whackdown/whackdown-en_US.cab O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-8.0.9.41/wordjong/wordjong-en_US.cab Clique sur " fix checked " ++

Re, Supprime Daft.exe JavaRA.exe Toolscleaner & C:\Tcleaner.txt & C:\Windows\Gmer.exe Remasque tes fichiers cachés. Créer un nouveau point de restauration : http://www.libellules.ch/restauration_system_vista.php#point Voila ! C'est fini. Des questions ? +

Pas de questions à part... es-tu marié? Si non, suis prenante... lol... farce à part, merci infiniment, t'es super!

Oui, une question: sur mon bureau j'ai desktop.ini deux fois... je fais quoi avec?

Parfait Cyril, c'est que j'avais pas masqué... merci!

Infectée par Core10k.exe - Page 2

Résolu

Réponse 21 / 24
Utilisateur anonyme
Re,

Supprime

Daft.exe
JavaRA.exe
Toolscleaner & C:\Tcleaner.txt

& C:\Windows\Gmer.exe

Remasque tes fichiers cachés.

Créer un nouveau point de restauration : http://www.libellules.ch/restauration_system_vista.php#point

Voila !
C'est fini.
Des questions ?

+

0
Réponse 22 / 24
Roxanne_32 Auteur
Pas de questions à part... es-tu marié? Si non, suis prenante... lol... farce à part, merci infiniment, t'es super!

0
Réponse 23 / 24
Roxanne_32 Auteur
Oui, une question: sur mon bureau j'ai desktop.ini deux fois... je fais quoi avec?

0
Réponse 24 / 24
Roxanne_32 Auteur
Parfait Cyril, c'est que j'avais pas masqué... merci!

0
Précédent
- 1
- 2

Newsletters