infection par win32/CryptExe

Question

bonjour à tous mes sauveteur (salut Quentin si tu es sur le site),

Je me retrouve avec une infection pae win32/CryptExe, découverte par avg mais qui ne peut pas me la corriger. Existe-t-il une autre solution pour évacuer ce ver ???
Merci d'avance

Utilisateur anonyme · Answer

Salut,

as-tu essayé en mdoe sans echec ?

Si ça fonctionne pas :

Télécharge HijackThis:
Téléchargement de HijackThis

Installe le dans son propre dossier:
-clic droit sur le bureau, choisis "nouveau dossier" puis installe le dedans.
Lance le, clic sur "do a system scan and save logfile"
Puis copie et colle le rapport ici stp

Geronimo85200 · Answer

aussitot rentré, aussitot fait. Merci de ton aide:Logfile of HijackThis v1.99.1Scan saved at 01:26:12, on 13/09/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\Program Files\Ahead\InCD\InCD.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exeC:\Program Files\Silicon Image\SiISATARaid\SATARaid.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\WINDOWS\System32\WISPTIS.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\eMule\emule.exeC:\Documents and Settings\blérot\Local Settings\Temporary Internet Files\Content.IE5\N24NFTC5\HijackThis[1].exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.free.fr/freebox/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: localhost 127.0.0.1O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exeO4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB002" /M "Stylus DX4800"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: SATARaid.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dllO16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potf_x.cabO16 - DPF: {266B9238-31A5-4B53-9039-272FE846DF9D} (DiameterTransfer Control) - http://www.sis.com/download/SISTransfer.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://geronimo85200.spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Geronimo85200 · Answer

et voilà:KASPERSKY ONLINE SCANNER REPORT  Wednesday, September 13, 2006 11:04:22 AMOperating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)Kaspersky Online Scanner version: 5.0.83.0Kaspersky Anti-Virus database last update: 13/09/2006Kaspersky Anti-Virus database records: 209962  Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true  Scan Target My Computer A:\C:\D:\E:\F:\   Scan Statistics Total number of scanned objects 58512 Number of viruses found 2 Number of infected objects 3 / 0 Number of suspicious objects 0 Duration of the scan process 00:49:52 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat  Object is locked  skipped   C:\Documents and Settings\All Users\Documents\setup.exe  Infected: Trojan-Proxy.Win32.Horst.av  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\cert8.db  Object is locked  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\formhistory.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\googlesafebrowsing.db  Object is locked  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\history.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\key3.db  Object is locked  skipped   C:\Documents and Settings\blérot\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\parent.lock  Object is locked  skipped   C:\Documents and Settings\blérot\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Microsoft\Windows Live Contacts\geronimo85200@hotmail.comeal\members.stg  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Microsoft\Windows Live Contacts\geronimo85200@hotmail.com\shadow\members.stg  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\Cache\B59C25C4d01  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\Cache\_CACHE_001_  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\Cache\_CACHE_002_  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\Cache\_CACHE_003_  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Application Data\Mozilla\Firefox\Profiles\1dvthgcm.default\Cache\_CACHE_MAP_  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Historique\History.IE5\MSHist012006091320060914\index.dat  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Temp\~DF6A2F.tmp  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Temp\~DF6A61.tmp  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Temp\~DFFECC.tmp  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Temp\~DFFEDF.tmp  Object is locked  skipped   C:\Documents and Settings\blérot\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\blérot
tuser.dat  Object is locked  skipped   C:\Documents and Settings\blérot
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\LocalService
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\NetworkService
tuser.dat.LOG  Object is locked  skipped   C:\errlgr.txt  Object is locked  skipped   C:\Program Files\eMule\Temp\001.part  Object is locked  skipped   C:\Program Files\eMule\Temp\002.part  Object is locked  skipped   C:\Program Files\eMule\Temp\003.part  Object is locked  skipped   C:\Program Files\eMule\Temp\004.part  Object is locked  skipped   C:\Program Files\eMule\Temp\005.part  Object is locked  skipped   C:\Program Files\eMule\Temp\006.part  Object is locked  skipped   C:\Program Files\eMule\Temp\007.part  Object is locked  skipped   C:\Program Files\eMule\Temp\010.part  Object is locked  skipped   C:\Program Files\eMule\Temp\012.part  Object is locked  skipped   C:\Program Files\eMule\Temp\013.part  Object is locked  skipped   C:\Program Files\eMule\Temp\014.part  Object is locked  skipped   C:\Program Files\eMule\Temp\015.part  Object is locked  skipped   C:\Program Files\eMule\Temp\016.part  Object is locked  skipped   C:\Program Files\eMule\Temp\017.part  Object is locked  skipped   C:\Program Files\eMule\Temp\018.part  Object is locked  skipped   C:\Program Files\eMule\Temp\019.part  Object is locked  skipped   C:\Program Files\eMule\Temp\021.part  Object is locked  skipped   C:\Program Files\eMule\Temp\022.part  Object is locked  skipped   C:\Program Files\eMule\Temp\023.part  Object is locked  skipped   C:\Program Files\eMule\Temp\024.part  Object is locked  skipped   C:\Program Files\eMule\Temp\025.part  Object is locked  skipped   C:\Program Files\eMule\Temp\026.part  Object is locked  skipped   C:\Program Files\eMule\Temp\027.part  Object is locked  skipped   C:\Program Files\eMule\Temp\028.part  Object is locked  skipped   C:\Program Files\eMule\Temp\029.part  Object is locked  skipped   C:\Program Files\eMule\Temp\030.part  Object is locked  skipped   C:\Program Files\eMule\Temp\031.part  Object is locked  skipped   C:\Program Files\eMule\Temp\032.part  Object is locked  skipped   C:\Program Files\eMule\Temp\033.part  Object is locked  skipped   C:\Program Files\eMule\Temp\034.part  Object is locked  skipped   C:\Program Files\eMule\Temp\035.part  Object is locked  skipped   C:\Program Files\eMule\Temp\036.part  Object is locked  skipped   C:\Program Files\eMule\Temp\037.part  Object is locked  skipped   C:\Program Files\eMule\Temp\038.part  Object is locked  skipped   C:\Program Files\eMule\Temp\039.part  Object is locked  skipped   C:\Program Files\eMule\Temp\040.part  Object is locked  skipped   C:\Program Files\eMule\Temp\041.part  Object is locked  skipped   C:\Program Files\eMule\Temp\042.part  Object is locked  skipped   C:\Program Files\eMule\Temp\043.part  Object is locked  skipped   C:\Program Files\eMule\Temp\044.part  Object is locked  skipped   C:\Program Files\eMule\Temp\045.part  Object is locked  skipped   C:\Program Files\eMule\Temp\046.part  Object is locked  skipped   C:\Program Files\eMule\Temp\047.part  Object is locked  skipped   C:\Program Files\eMule\Temp\048.part  Object is locked  skipped   C:\Program Files\eMule\Temp\049.part  Object is locked  skipped   C:\Program Files\eMule\Temp\050.part  Object is locked  skipped   C:\Program Files\eMule\Temp\051.part  Object is locked  skipped   C:\Program Files\eMule\Temp\052.part  Object is locked  skipped   C:\Program Files\eMule\Temp\053.part  Object is locked  skipped   C:\Program Files\eMule\Temp\054.part  Object is locked  skipped   C:\Program Files\eMule\Temp\055.part  Object is locked  skipped   C:\Program Files\eMule\Temp\056.part  Object is locked  skipped   C:\Program Files\eMule\Temp\057.part  Object is locked  skipped   C:\Program Files\eMule\Temp\058.part  Object is locked  skipped   C:\Program Files\eMule\Temp\059.part  Object is locked  skipped   C:\Program Files\eMule\Temp\060.part  Object is locked  skipped   C:\Program Files\eMule\Temp\061.part  Object is locked  skipped   C:\Program Files\eMule\Temp\062.part  Object is locked  skipped   C:\Program Files\eMule\Temp\068.part  Object is locked  skipped   C:\Program Files\eMule\Temp\069.part  Object is locked  skipped   C:\Program Files\eMule\Temp\070.part  Object is locked  skipped   C:\Program Files\eMule\Temp\071.part  Object is locked  skipped   C:\Program Files\eMule\Temp\072.part  Object is locked  skipped   C:\Program Files\eMule\Temp\073.part  Object is locked  skipped   C:\System Volume Information\MountPointManagerRemoteDatabase  Object is locked  skipped   C:\System Volume Information\_restore{528064B0-2E22-4BF9-9AA6-6CDDB4E89CC7}\RP182\A0023624.exe  Object is locked  skipped   C:\System Volume Information\_restore{528064B0-2E22-4BF9-9AA6-6CDDB4E89CC7}\RP184\A0023691.exe  Infected: Trojan-Proxy.Win32.Horst.hz  skipped   C:\System Volume Information\_restore{528064B0-2E22-4BF9-9AA6-6CDDB4E89CC7}\RP210\change.log  Object is locked  skipped   C:\WINDOWS\Debug\oakley.log  Object is locked  skipped   C:\WINDOWS\Debug\PASSWD.LOG  Object is locked  skipped   C:\WINDOWS\Internet Logs\fwdbglog.txt  Object is locked  skipped   C:\WINDOWS\Internet Logs\fwpktlog.txt  Object is locked  skipped   C:\WINDOWS\Internet Logs\IAMDB.RDB  Object is locked  skipped   C:\WINDOWS\Internet Logs\PASCAL-Y5P1FQ8L.ldb  Object is locked  skipped   C:\WINDOWS\Internet Logs	vDebug.log  Object is locked  skipped   C:\WINDOWS\SchedLgU.Txt  Object is locked  skipped   C:\WINDOWS\Sti_Trace.log  Object is locked  skipped   C:\WINDOWS\system32\config\AppEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\default  Object is locked  skipped   C:\WINDOWS\system32\config\DEFAULT.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\sam  Object is locked  skipped   C:\WINDOWS\system32\config\SAM.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SecEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\security  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\software  Object is locked  skipped   C:\WINDOWS\system32\config\SOFTWARE.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SysEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\system  Object is locked  skipped   C:\WINDOWS\system32\config\SYSTEM.LOG  Object is locked  skipped   C:\WINDOWS\system32\drivers\sptd.sys  Object is locked  skipped   C:\WINDOWS\system32\drivers\sptd3213.sys  Object is locked  skipped   C:\WINDOWS\system32
vsvcd.exe  Infected: Trojan-Proxy.Win32.Horst.av  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  Object is locked  skipped   C:\WINDOWS\Temp\ZLT06f85.TMP  Object is locked  skipped   C:\WINDOWS\Temp\ZLT06f8c.TMP  Object is locked  skipped   C:\WINDOWS\wiadebug.log  Object is locked  skipped   C:\WINDOWS\wiaservc.log  Object is locked  skipped   D:\System Volume Information\MountPointManagerRemoteDatabase  Object is locked  skipped   Scan process completed.

Regis59 · Answer

SalutIl te le detecte ou?a+

Geronimo85200 · Answer

salut Quentin,Heureux de te retrouver (enfin po vraiment ds ces conditions!).onc ce virus est détecté par avg quand il fait un autoscan ainsi que par l'antivirus en ligne testé:C:\WINDOWS\system32
vsvcd.exe Infected: Trojan-Proxy.Win32.Horst.av skipped C:\System Volume Information\_restore{528064B0-2E22-4BF9-9AA6-6CDDB4E89CC7}\RP184\A0023691.exe Infected: Trojan-Proxy.Win32.Horst.hz skipped etC:\Documents and Settings\All Users\Documents\setup.exe Infected: Trojan-Proxy.Win32.Horst.av skippedPS: j'ai commencé à m'intéresser à ton site. Passionant! Je crois que je vais essayer de passer souvent du temps dessus pour essayer de me démerd.. tout seul et éventuellement (si j'y arrive) pour pouvoir aider les autres.

Regis59 · Answer

SalutPour le site, ce n est pas le mien , puisque nous sommes 4 administrateurs a gerer.Pour tes infections:C:\WINDOWS\system32
vsvcd.exe Supprime ceci et verifie que ce service n existe pas:Windows LogC:\System Volume Information\_restore{528064B0-2E22-4BF9-9AA6-6CDDB4E89CC7}\RP184\A0023691.exe Infected: Trojan-Ici, rien de grave l infection est inactif puisqu elle se situe dans un point de restauration infecté.C:\Documents and Settings\All Users\Documents\setup.exe Ici, soit tu le supprime parce que c est toi qui avait telechargé cet executable soit tu l analyses en ligne.NOTE: Je n ai pas les liens sur moi car la je suis au lycée donc désolé. S'il te les faut, demande les et des que je peux je te file caA+

Geronimo85200 · Answer

"Pour tes infections:C:\WINDOWS\system32
vsvcd.exeSupprime ceci "Je fais une supression physique (toute con) ?"et verifie que ce service n existe pas:Windows Log "Je fais comment ?Excuse le retard ds la correspondance mais moi ossi j'étais au bahut et longues journées

Geronimo85200 · Answer

Logfile of HijackThis v1.99.1Scan saved at 13:32:00, on 15/09/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\Program Files\Ahead\InCD\InCD.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXEC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\System32\RUNDLL32.EXEC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exeC:\Program Files\Silicon Image\SiISATARaid\SATARaid.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeC:\Program Files\Ahead\InCD\InCDsrv.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\eMule\emule.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Documents and Settings\blérot\Local Settings\Temporary Internet Files\Content.IE5\N24NFTC5\HijackThis[1].exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.free.fr/freebox/index.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO1 - Hosts: localhost 127.0.0.1O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /rO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exeO4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB002" /M "Stylus DX4800"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: SATARaid.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dllO16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potf_x.cabO16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cabO16 - DPF: {266B9238-31A5-4B53-9039-272FE846DF9D} (DiameterTransfer Control) - http://www.sis.com/download/SISTransfer.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://geronimo85200.spaces.msn.com//PhotoUpload/MsnPUpld.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cabO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLLO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Regis59 · Answer

Salut

Pas de soucis, moi aussi j etais au bahu

Tu fais une suppression toute con, tu te rends a l endroit indiqué, clik droit et supprimer

Pour les services, tu vas dans:
panneau de config < outil d administration < service

recherche le

a+

Geronimo85200 · Answer

fichier supprimé et pas dewindows log. Je verrai au prochain redémarrage (je suis en pleine préparation de cours).
Par contre, j'ai vu quelques fichiers bizzares ou en bleu dans mon dd:
$VAULT£.AVG (en rapporta vec mon antivirus surement mais vide) 252 Ko
!Killbox 4Ko
$MSI30Uninstall MSI30-K88401 6$ (en bleu) 2.4 Mo

sais-tu à quoi cela peut correspondre et si je peux les virer

Regis59 · Answer

salutlaisse les les restesa+

Geronimo85200 · Answer

tout à l'air ok ce matin à part que le démarrage a été très long. C'est peut-être ma mise à jour et ma config de la mule qui a tout ralenti (le tps de remettre à jour les données). En tt cas, pas de cirus à l'horizon. Encore mci

etinou · Answer

Bonjour,J'ai le même problème que vous avec avg et le trojan repéré win32 cryptexe.J'ai suivi vos recomandations voici le rapport de kaspersky online.Wednesday, September 20, 2006 3:26:18 PMOperating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)Kaspersky Online Scanner version: 5.0.83.0Kaspersky Anti-Virus database last update: 19/09/2006Kaspersky Anti-Virus database records: 211404  Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true  Scan Target My Computer C:\D:\   Scan Statistics Total number of scanned objects 79577 Number of viruses found 0 Number of infected objects 0 / 0 Number of suspicious objects 0 Duration of the scan process 02:07:06 Infected Object Name Virus Name Last Action C:\WINDOWS\system32\config\system.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\software.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\default.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY  Object is locked  skipped   C:\WINDOWS\system32\config\SAM  Object is locked  skipped   C:\WINDOWS\system32\config\SAM.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SECURITY.LOG  Object is locked  skipped   C:\WINDOWS\system32\config\SYSTEM  Object is locked  skipped   C:\WINDOWS\system32\config\SOFTWARE  Object is locked  skipped   C:\WINDOWS\system32\config\DEFAULT  Object is locked  skipped   C:\WINDOWS\system32\config\SysEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\AppEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\config\SecEvent.Evt  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP  Object is locked  skipped   C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP  Object is locked  skipped   C:\WINDOWS\system32\iqwavf.exe  Object is locked  skipped   C:\WINDOWS\system32\mdqbfx.exe  Object is locked  skipped   C:\WINDOWS\system32\ijyauxbt.exe  Object is locked  skipped   C:\WINDOWS\system32\jeikfspbt.exe  Object is locked  skipped   C:\WINDOWS\system32\CatRoot2	mp.edb  Object is locked  skipped   C:\WINDOWS\system32\CatRoot2\edb.log  Object is locked  skipped   C:\WINDOWS\system32\h323log.txt  Object is locked  skipped   C:\WINDOWS\Debug\PASSWD.LOG  Object is locked  skipped   C:\WINDOWS\Sti_Trace.log  Object is locked  skipped   C:\WINDOWS\wiaservc.log  Object is locked  skipped   C:\WINDOWS\wiadebug.log  Object is locked  skipped   C:\WINDOWS\SchedLgU.Txt  Object is locked  skipped   C:\WINDOWS\WindowsUpdate.log  Object is locked  skipped   C:\WINDOWS\SoftwareDistribution\ReportingEvents.log  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\logs\SAV.txt  Object is locked  skipped   C:\Documents and Settings\All Users\Application Data\Sophos\Sophos Anti-Virus\Config\interchk.chk  Object is locked  skipped   C:\Documents and Settings\NetworkService\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\NetworkService
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\LocalService\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\LocalService
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\Isa\NTUSER.DAT  Object is locked  skipped   C:\Documents and Settings\Isa
tuser.dat.LOG  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Historique\History.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Temporary Internet Files\Content.IE5\index.dat  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.114.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\GatherLogs\MyIndex\MyIndex.114.Crwl  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Ntfy12.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk2.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\CiST0000.000  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\NlFiles\DocId.Map  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\CiPT0000.000  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\INDEX.000  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\Build\Indexer\CiFiles\00010009.ci  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.chk1.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Idm.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.Dir  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.idx  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h0.Dir  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h0  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h1.Dir  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h1  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h3  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4A.Dir  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4A  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4B.Dir  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Projects\MyIndex\MyIndex.Hash.gthr.h4B  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties	mp.edb  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\MSS.log  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Applications\RSApp\Properties\RSApp.edb  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Logs\MAPI.txt  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Tempssgthrsvc\Ntf5.tmp  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Tempssgthrsvc\Ntf8.tmp  Object is locked  skipped   C:\Documents and Settings\Isa\Local Settings\Application Data\Microsoft\Desktop Search\Tempssgthrsvc\Perflib_Perfdata_9ec.dat  Object is locked  skipped   C:\Documents and Settings\Isa\Cookies\index.dat  Object is locked  skipped   C:\Documents and Settings\Isa\Application Data\AVG7\Log\emc.log  Object is locked  skipped   C:\System Volume Information\_restore{FE32DDCA-30FF-4C2F-A021-39EAE75462BD}\RP1\change.log  Object is locked  skipped   Scan process completed. Je ne vois pas comment faire ensuite pour analyser ses fichiers (qui sont bloqués) ?? Pouvez vous m'aider s'il vous plait ? Il m'agace ce virus, j'ai déjà passé en mode sans echec et en désactivant la restauration système  (ad aware, avg, a2, spy bot). Mais il est revenu :-(((((((Cordialement etienne

titia160282 · Answer

bonjourje connais le même problème que géronimo. Aussi, j'ai fait les manips que vous lui demandiez de faire. Est ce qu'il vous serez possible d'y regarder et de me dire comment je peux me débarasser du virus win32/cryptexeLogfile of HijackThis v1.99.1Scan saved at 17:43:00, on 19/09/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\windows\system\hpsysdrv.exeC:\WINDOWS\system32\hphmon06.exeC:\HP\KBD\KBD.EXEC:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashServ.exeC:\WINDOWS\AGRSMMSG.exeC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\WINDOWS\ALCWZRD.EXEC:\WINDOWS\ALCMTR.EXEC:\hp\drivers\hplsbwatcher\lsburnwatcher.exeC:\Program Files\QuickTime\qttask.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeC:\Program Files\Shareaza\Shareaza.exeC:\WINDOWS\system32undll32.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exec:\Program Files\Fichiers communs\LightScribe\LSSrvc.exeC:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Alwil Software\Avast4\ashMaiSv.exeC:\Program Files\Alwil Software\Avast4\ashWebSv.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\HPZipm12.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\HP_Propriétaire\Bureau\Nouveau dossier\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exeO4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exeO4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXEO4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startupO4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exeO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgentO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exeO4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeO4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUPO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -trayO4 - HKCU\..\Run: [Instant Access] rundll32.exe EGACCESS4_1065.dll,InstantAccessO4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimizedO4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exeO4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.htmlO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.htmlO8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/eng/demon_2_0_0_25.cabO16 - DPF: {CB5D474E-A510-40A4-B5A4-838933BCBA64} - http://es6-scripts.dlv4.com/binaries/egaccess4/egaccess4_1065_XP.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dllO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeO23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exeJe vous remercie d'avancetitia160282

debdeb · Answer

salut,
moi aussi je me retrouve avec ce problème...dps le 13 SEptembre, AVG me détecte ce virus et impossible de m'en débarrasser..j'ai fait plusieurs scans avec AVG ms rien n'y fait. Finalement, j'ai dl F-Secure et lui ne me le détecte pas..
Bref, j'ai dl HJT et voici le rapport:

Logfile of HijackThis v1.99.1
Scan saved at 21:09:30, on 19/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5450.0004)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\InstantTimeZone\InstantTimeZone.exe
C:\Program Files\Onfolio\onfserv.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Briand\Bureau\Nouveau dossier\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AccuWeatherDesktopAlerts] C:\Program Files\AccuWeatherDesktopAlerts\AccuWeatherDesktopAlerts.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Startup: Aide mémoire.lnk = ?
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O4 - Global Startup: InstantTimeZone.lnk = C:\Program Files\InstantTimeZone\InstantTimeZone.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Onfolio Server.lnk = ?
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Capture Page to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddLinkEntryFromDocument.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Capt&ure Target to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture &Snippet to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentSelection.html
O8 - Extra context menu item: Capture Ima&ge to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddEntryFromDocumentElement.html
O8 - Extra context menu item: Capture Page and Selected &Links to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddSiteSnippetFromDocumentSelection.html
O8 - Extra context menu item: Capture Selected Ite&ms to Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddMultipleEntriesFromDocumentSelection.html
O8 - Extra context menu item: Capture Site to &Onfolio... - res://C:\Program Files\Onfolio\Onfolio.WindowsResources.dll/AddSiteFromDocument.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuweather.com/tnpl_awda/client/download/TNPLDownloader.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitia...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://clebcleb.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://210.211.81.160//activex/AMC.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8F2B3E96-94B3-4CA0-919A-531DDC9ABE92} (XUploadPhotos Class) - https://secure.hi5.com/index.html?r=%2Fhome.html&logged_out
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Pourriez-vous me dire ce que vous en pensez??
D'avance merci et bonne soirée.

PS: j'ai essayé de scanner avec Kaspersky mais le scan ne se lance pas!

DavidLG · Answer

Salut,
un de plus de touché par CryptExe. J'ai téléchargé Avira Antivir, fait un scan de mon disque comme demandé. J'ai également téléchargé HijackThis, fait un scan et je vous fait parvenir mon fichier log comme demandé. Depuis qu'AVG a détecté CryptExe, mon PC a du mal à démarré, comme si mon alim était en train de s'envoyer en l'air, est-ce lier à ce fichu ver ou y a t il coincidence ?
Voici rapport extrait du scan HijackThis, et merci de votre aide.

Logfile of HijackThis v1.99.1
Scan saved at 20:40:00, on 06/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32
svsvc
svsvc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Palm\HOTSYNC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\DAVIDL~1\LOCALS~1\Temp\Répertoire temporaire 1 pour hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.carrefour.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fhelp%2fHelp4%2f%3f
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.carrefour.fr
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.carrefour.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
O2 - BHO: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)
O3 - Toolbar: Band Class - {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} - C:\WINDOWS\AdRoar.dll (file missing)
O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [WebRebates] javaw -cp "C:\Program Files\WebRebates\System\Code" Main lp: "C:\Program Files\WebRebates"
O4 - HKLM\..\Run: [websearch] javaw -cp "C:\Program Files\websearch\System\Code" Main lp: "C:\Program Files\websearch"
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32
svsvc
svsvc.exe
O4 - HKLM\..\Run: [picsvr] C:\WINDOWS\system32\picsvr\picsvr.exe
O4 - HKLM\..\Run: [AdRoarUpdate] C:\WINDOWS\ARUpdate.exe
O4 - HKLM\..\Run: [Watch] C:\PROGRA~1\AvA\Watch.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Instant Access] C:\WINDOWS\system32\instacs.exe /run
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe
O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?5982483c79e94a0fa045f4f25a575bc
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?5982483c79e94a0fa045f4f25a575bc
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI699F~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Client de licence CA (CA_LIC_CLNT) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Serveur de licence CA (CA_LIC_SRVR) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe

Utilisateur anonyme · Answer

Faites vos propre post ! 
Merci https://forums.commentcamarche.net/forum/#ecrire

Utilisateur anonyme · Answer

Cliquez sur "écrire" présent en haut de cette même fenêtre ;-)
Tn PC est infecté

Infection par win32/CryptExe

18 réponses

Discussions similaires

Newsletters