defrag impossible chkdsk

Question

bonjour
je voudrai avoir un avis sur mon analyse hijackthis,suite a des probleme de defragmentation et de connexion internet,merci d'avance,Logfile of HijackThis v1.99.1
Scan saved at 20:48:00, on 21/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\Program Files\Microsoft IntelliType Pro	ype32.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\eMule\emule.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\maryvon  moreaux\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F2 - REG:system.ini: Shell=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {19A82FA5-CD16-4218-BCBC-DDDBA542FFAB} - blank (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6FAF6718-A3A5-47C7-A311-4D87CF9F78B0} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {8D3F7705-F859-43F3-9B96-18A36BF26279} - blank (file missing)
O2 - BHO: (no name) - {DA50C3CA-E3FF-4908-B056-0836B9DA4C0A} - blank (file missing)
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [Sonic RecordNow!] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: Télécharger en utilisant Download &Express - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe

merci!!

Kristopher · Answer

Salut,

Tu es notamment infecté par le ver W32/SDBOT :(

Merci de suivre cette méthode à la lettre :

virus methode preliminaire de desinfection version fr

Bonne chance,
Kris

macathe · Answer

bonjour et merci d"avoir répondu au si vite
voici mes---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	23:20:39 21/01/2007

 + Résultat de l'analyse:	



HKU\S-1-5-21-2607418606-490619351-2693171188-1005\Software\_rtneg -> Adware.Begin2Search : Ignoré.
HKU\.DEFAULT\Software\New.net -> Adware.NewDotNet : Ignoré.
HKU\S-1-5-18\Software\New.net -> Adware.NewDotNet : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@247realmedia[2].txt -> TrackingCookie.247realmedia : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@2o7[2].txt -> TrackingCookie.2o7 : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@advertising[1].txt -> TrackingCookie.Advertising : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@adviva[2].txt -> TrackingCookie.Adviva : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@atdmt[2].txt -> TrackingCookie.Atdmt : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@estat[1].txt -> TrackingCookie.Estat : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@fastclick[2].txt -> TrackingCookie.Fastclick : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@mediaplex[1].txt -> TrackingCookie.Mediaplex : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@overture[1].txt -> TrackingCookie.Overture : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@serving-sys[2].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@weborama[1].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\maryvon  moreaux\Cookies\maryvon__moreaux@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Ignoré.


Fin du rapport

 rapporte pour les analyses..

macathe · Answer

BitDefender Online Scanner
  
  
 
Scan report generated at: Mon, Jan 22, 2007 - 18:31:36
 
 
  
  
 
Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;
  
  
 
 
  
  
 
Statistics
 
Time
 01:35:46
 
Files
 365990
 
Folders
 5963
 
Boot Sectors
 3
 
Archives
 12224
 
Packed Files
 23492
 
  
  
 
Results
 
Identified Viruses 
 4
 
Infected Files 
 10
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 10
 
  
  
 
Engines Info
 
Virus Definitions
 390263
 
Engine build
 AVCORE v1.0 (build 2371) (i386) (Dec 13 2006 11:16:42)
 
Scan plugins
 14
 
Archive plugins
 38
 
Unpack plugins
 6
 
E-mail plugins
 6
 
System plugins
 1
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0LOT2L6N\istdownload[1].exe
 Infected with: Trojan.Downloader.IstBar.KLJ
 
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0LOT2L6N\istdownload[1].exe
 Deleted
 
C:\Program Files\serial.dat=>user32.exe
 Infected with: Trojan.Downloader.Harnig.AB
 
C:\Program Files\serial.dat=>user32.exe
 Disinfection failed
 
C:\Program Files\serial.dat=>user32.exe
 Deleted
 
C:\Program Files\serial.dat
 Updated
 
C:\Program Files\serial.dat=>widupdate.exe
 Infected with: Trojan.PWS.Nilage.AEH
 
C:\Program Files\serial.dat=>widupdate.exe
 Deleted
 
C:\Program Files\serial.dat
 Updated
 
C:\Program Files\serial.zip=>user32.exe
 Infected with: Trojan.Downloader.Harnig.AB
 
C:\Program Files\serial.zip=>user32.exe
 Disinfection failed
 
C:\Program Files\serial.zip=>user32.exe
 Deleted
 
C:\Program Files\serial.zip
 Updated
 
C:\Program Files\serial.zip=>widupdate.exe
 Infected with: Trojan.PWS.Nilage.AEH
 
C:\Program Files\serial.zip=>widupdate.exe
 Deleted
 
C:\Program Files\serial.zip
 Updated
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229794.exe
 Infected with: Trojan.Downloader.Harnig.AB
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229794.exe
 Disinfection failed
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229794.exe
 Deleted
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229795.exe
 Infected with: Trojan.Downloader.VB.ALT
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229795.exe
 Disinfection failed
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229795.exe
 Deleted
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229796.exe
 Infected with: Trojan.PWS.Nilage.AEH
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229796.exe
 Deleted
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229797.exe
 Infected with: Trojan.Downloader.Harnig.AB
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229797.exe
 Disinfection failed
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229797.exe
 Deleted
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229810.exe
 Infected with: Trojan.Downloader.VB.ALT
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229810.exe
 Disinfection failed
 
C:\System Volume Information\_restore{9AEDEF4B-1977-4657-B854-EFDB21259CFF}\RP985\A0229810.exe
 Deleted

Kristopher · Answer

Bonsoir,

Après avoir nettoyé les infections trouvés par AVG antispywares, merci de coller ce rapport suivi de celui de HijackThis.

Il faut être attentif à la lecture du tutoriel, si non cela ne sert à rien...

macathe · Answer

merci kristopher,scus
c fait

Defrag impossible chkdsk

5 réponses

Discussions similaires

Newsletters