Rapport hijackthis+malwarebytes'
Bonjour,
voici de malwarebytes'
Malwarebytes' Anti-Malware 1.20
Version de la base de données: 938
Windows 5.1.2600 Service Pack 2
10:39:09 11/07/2008
mbam-log-7-11-2008 (10-39-04).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 90207
Temps écoulé: 17 minute(s), 36 second(s)
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 50
Processus mémoire infecté(s):
C:\Documents and Settings\tazebama.dl_ (Worm.Mabezat) -> No action taken.
Module(s) mémoire infecté(s):
C:\Documents and Settings\tazebama.dll (Worm.Mabezat) -> No action taken.
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\tazebama.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091349.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0092595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0093595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094105.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094469.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0095561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0096561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0097561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0099605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100606.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101550.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101606.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0102605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0103605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0104605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104671.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104684.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104798.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104858.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0105046.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0106027.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0107027.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0108039.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0109039.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0110078.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112076.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113221.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114221.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0115220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0116218.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP31\A0116376.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001044.exe (Trojan.Agent) -> No action taken.
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001059.exe (Spyware.OnlineGames) -> No action taken.
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010300.exe (Trojan.Agent) -> No action taken.
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010400.exe (Spyware.OnlineGames) -> No action taken.
D:\UTILITAIRES\Nero-6.6.0.8a\keygen\keygen.exe (Trojan.Agent) -> No action taken.
D:\UTILITAIRES\WMPlayer 11\Windows_Media_11_Patch\Patch.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\tazebama.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\Youssef\Application Data\tazebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
é celui de hijack this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:54:26, on 11/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
C:\Documents and Settings\tazebama.dl_
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89E64E7E-2CE3-45D6-AB22-D78689752023}: NameServer = 192.168.50.55 196.12.209.6
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
--
End of file - 3895 bytes
voici de malwarebytes'
Malwarebytes' Anti-Malware 1.20
Version de la base de données: 938
Windows 5.1.2600 Service Pack 2
10:39:09 11/07/2008
mbam-log-7-11-2008 (10-39-04).txt
Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 90207
Temps écoulé: 17 minute(s), 36 second(s)
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 50
Processus mémoire infecté(s):
C:\Documents and Settings\tazebama.dl_ (Worm.Mabezat) -> No action taken.
Module(s) mémoire infecté(s):
C:\Documents and Settings\tazebama.dll (Worm.Mabezat) -> No action taken.
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\tazebama.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091349.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0092595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0093595.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094105.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094469.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0095561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0096561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0097561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098561.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0099605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100606.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101550.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101606.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0102605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0103605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0104605.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104671.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104684.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104798.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104858.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0105046.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0106027.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0107027.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0108039.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0109039.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0110078.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112076.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113221.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114221.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0115220.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0116218.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP31\A0116376.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001044.exe (Trojan.Agent) -> No action taken.
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001059.exe (Spyware.OnlineGames) -> No action taken.
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010300.exe (Trojan.Agent) -> No action taken.
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010400.exe (Spyware.OnlineGames) -> No action taken.
D:\UTILITAIRES\Nero-6.6.0.8a\keygen\keygen.exe (Trojan.Agent) -> No action taken.
D:\UTILITAIRES\WMPlayer 11\Windows_Media_11_Patch\Patch.exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\tazebama.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\Youssef\Application Data\tazebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
é celui de hijack this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:54:26, on 11/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
C:\Documents and Settings\tazebama.dl_
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{89E64E7E-2CE3-45D6-AB22-D78689752023}: NameServer = 192.168.50.55 196.12.209.6
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)
--
End of file - 3895 bytes
Configuration: Windows XP Internet Explorer 6.0
5 réponses
-
la connexion ne marche plus de mon Pc infecté mé jvé t'envoyé le rapport
é merci pour l'aide
ce virus ne veut jamé étre supprimé tazebama -
ben c cke jé fais
-
en attente d'aide
-
1) Redémarre en "Mode sans échec"
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement, appuie sur la touche [F8] (ou [F5] sur certains pc) jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionner "Mode sans échec" et appuie sur [Entrée]
Il faudra choisir ta session habituelle, pas le compte "Administrateur" ou une autre.
Regarde ici si besoin : http://pageperso.aol.fr/loraline60/mode_sans_echec.htm
Ouvre le fichier texte sauvegardé sur le Bureau afin de suivre les instructions comme il faut.
2) Scan avec Malwarebyte's Anti-Malware
*Lance Malwarebyte's Anti-Malware
*Puis vs dans l'onglet "Recherche" puis coche "Exécuter un examen complet" puis "Rechercher sélectionne tes disques durs" puis clique sur "Lancer l’examen"
*A la fin du scan >>> clique sur Afficher les résultats puis sur Enregistrer le rapport
*Suppression des éléments détectés >>>> clique sur Supprimer la sélection
*S'il t'es demandé de redémarrer >>> clique sur "Yes"
*--> Un rapport de scan s'ouvre, enregistre sur ton Bureau et poste ce rapport en réponse.
-
-
c fé mé le virus é tjrs la
-
Salut ouvre "Malwarebytes' Anti-Malware" va dans "Quarantaine" puis clique sur "Tout Supprimer".
