Castor major

Eh bien voila j'ai effectuer toutes les phases a la lettre et un grand merci a M.Ingals donc pas mal d'alertes et infection bref voici les rapports de anti vir et hijack. HIJACK Logfile of HijackThis v1.99.1 Scan saved at 21:55:32, on 04/11/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\msmsgs.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local., O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - Global Startup: msmsgs.exe O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html O10 - Hijacked Internet access by New.Net O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://creative.com/su/ocx/15015/CTSUEng.cab O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://82.231.205.22:1024/activex/AMC.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://creative.com/su/ocx/15016/CTPID.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Service Bonjour (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Antivir AntiVir PersonalEdition Classic Report file date: samedi 4 novembre 2006 19:22 Scanning for 495093 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-WURGE-0001 Platform: Windows XP Windows version: (plain) [5.1.2600] Username: EdenZone Computer name: ONIZUKA Version information: AVSCAN.EXE : 7.0.0.47 200744 21/08/2006 11:06:56 AVSCAN.DLL : 7.0.0.45 41000 07/09/2006 11:56:33 LUKE.DLL : 7.0.0.47 118824 07/09/2006 11:32:33 LUKERES.DLL : 7.0.0.47 9256 07/09/2006 11:56:33 ANTIVIR0.VDF : 6.35.0.1 7371264 31/05/2006 11:35:27 ANTIVIR1.VDF : 6.36.0.9 1424384 06/09/2006 08:12:24 ANTIVIR2.VDF : 6.36.0.10 2048 06/09/2006 08:12:26 ANTIVIR3.VDF : 6.36.0.11 2048 06/09/2006 08:12:28 AVEWIN32.DLL : 7.2.0.14 1827328 04/09/2006 15:23:26 AVPREF.DLL : 7.0.0.2 23592 24/07/2006 13:36:04 AVREP.DLL : 6.36.0.3 794664 06/09/2006 09:04:08 AVRPBASE.DLL : 7.0.0.0 2162728 30/03/2006 09:43:31 AVPACK32.DLL : 7.2.0.0 368680 21/07/2006 07:00:28 AVREG.DLL : 6.31.0.90 27688 28/07/2005 11:06:36 NETNT.DLL : 6.32.0.0 6696 27/09/2005 08:56:49 NETNW.DLL : 7.0.0.0 9768 24/07/2006 13:35:55 RCIMAGE.DLL : 7.0.0.74 1642536 01/08/2006 12:22:57 RCTEXT.DLL : 7.0.0.107 77864 07/09/2006 11:56:32 Configuration settings for the scan: Jobname.......................: Local Hard Disks Configuration file............: C:\Program Files\AntiVir PersonalEdition Classic\alldiscs.avp Boot sectors..................: C,D,G Scan memory...................: 1 Process scan..................: 1 Scan all files................: 1 Scan archives.................: 1 Recursion depth...............: 20 Smart extensions..............: 1 Skipped archive types.........: 1000,1001,1002,1003,1004,1005, Macro heuristic...............: 1 File heuristic................: 3 Primary action................: 1 Secondary action..............: 0 Start of the scan: samedi 4 novembre 2006 19:22 The scan of running processes will be started 5 Processes were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Boot sector 'G:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( 10 files ). Starting the file scan: C:\pagefile.sys [WARNING] The file could not be opened! C:\t.inx [DETECTION] Is the Trojan horse TR/Crypt.F.Gen [iNFO] The file was moved to '45b5daac.qua'! C:\Documents and Settings\EdenZone\NTUSER.DAT [WARNING] The file could not be opened! C:\Documents and Settings\EdenZone\ntuser.dat.LOG [WARNING] The file could not be opened! C:\Documents and Settings\EdenZone\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat [WARNING] The file could not be opened! C:\Documents and Settings\EdenZone\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG [WARNING] The file could not be opened! C:\Program Files\RegCleaner\Backups\adobe gamma loader.exe [DETECTION] Is the Trojan horse TR/VB.ami.2 [iNFO] The file was moved to '45bbe884.qua'! C:\WINDOWS\system32\Incinerator.dll [DETECTION] Contains suspicious code HEUR/Malware [iNFO] The file was deleted! C:\WINDOWS\system32\usb496.dat [DETECTION] Contains suspicious code HEUR/Malware [iNFO] The file was deleted! C:\WINDOWS\system32\config\default [WARNING] The file could not be opened! C:\WINDOWS\system32\config\DEFAULT.LOG [WARNING] The file could not be opened! C:\WINDOWS\system32\config\sam [WARNING] The file could not be opened! C:\WINDOWS\system32\config\SAM.LOG [WARNING] The file could not be opened! C:\WINDOWS\system32\config\security [WARNING] The file could not be opened! C:\WINDOWS\system32\config\SECURITY.LOG [WARNING] The file could not be opened! C:\WINDOWS\system32\config\software [WARNING] The file could not be opened! C:\WINDOWS\system32\config\SOFTWARE.LOG [WARNING] The file could not be opened! C:\WINDOWS\system32\config\system [WARNING] The file could not be opened! C:\WINDOWS\system32\config\SYSTEM.LOG [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\dtscsi.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd9469.sys [WARNING] The file could not be opened! D:\MSN\Setup\Fiya_Flood3r.zip [0] Archive type: ZIP --> MSN7_Flood3r/MSN7-Flood3r.exe [DETECTION] Is the Trojan horse TR/Flood.VB.CN.1 [iNFO] The file was deleted! D:\Tunnig windows XP\Outils tunnig +\crack-inf.exe [DETECTION] Is the Trojan horse TR/Agent.HLE [iNFO] The file was moved to '45adf7e1.qua'! D:\Tunnig windows XP\Outils tunnig +\Style.XP.v3.13.WinXP2003.Incl.Keygen-ECLiPSE.zip [0] Archive type: ZIP --> crack-inf.exe [DETECTION] Is the Trojan horse TR/Agent.HLE [iNFO] The file was deleted! D:\Tunnig windows XP\Thème\120765.exe [DETECTION] Contains signature of the dropper DR/Dldr.Small.bke.23 [iNFO] The file was deleted! D:\Tunnig windows XP\Thème\23905.exe [DETECTION] Contains signature of the dropper DR/SaveNow.BO [iNFO] The file was deleted! G:\Documents and Settings\Mad professor\Application Data\Opera\Opera\profile\cache4\opr000JI.js [0] Archive type: GZ --> opr000JI [DETECTION] Contains signature of the exploits EXP/Agent.B [iNFO] The file was deleted! G:\Documents and Settings\Mad professor\Application Data\Opera\Opera\profile\cache4\opr000LC.js [0] Archive type: GZ --> opr000LC [DETECTION] Contains signature of the exploits EXP/Agent.B [iNFO] The file was deleted! G:\Documents and Settings\Mad professor\Application Data\Opera\Opera\profile\cache4\opr000MJ.js [0] Archive type: GZ --> opr000MJ [DETECTION] Contains signature of the exploits EXP/Agent.B [iNFO] The file was deleted! G:\Documents and Settings\Mad professor\Application Data\Opera\Opera\profile\cache4\opr000NI.js [0] Archive type: GZ --> opr000NI [DETECTION] Contains signature of the exploits EXP/Agent.B [iNFO] The file was deleted! G:\Documents and Settings\Mad professor\Application Data\Opera\Opera\profile\cache4\opr000NV.js [0] Archive type: GZ --> opr000NV [DETECTION] Contains signature of the exploits EXP/Agent.B [iNFO] The file was deleted! G:\WINDOWS\$NtUninstallQ315000$\netsetup.exe [WARNING] The file could not be opened! G:\WINDOWS\$NtUninstallQ315000$\ssdpapi.dll [WARNING] The file could not be opened! G:\WINDOWS\$NtUninstallQ315000$\ssdpsrv.dll [WARNING] The file could not be opened! G:\WINDOWS\$NtUninstallQ315000$\upnp.dll [WARNING] The file could not be opened! G:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.exe [WARNING] The file could not be opened! G:\WINDOWS\$NtUninstallQ315000$\spuninst\spuninst.inf [WARNING] The file could not be opened! End of the scan: samedi 4 novembre 2006 21:42 Used time: 2:20:13 min The scan has been done completely. 8343 Scanning directories 259991 Files were scanned 14 viruses and/or unwanted programs were found 11 files were deleted 0 files were repaired 3 files were moved to quarantine 0 files were renamed 3647 Archives were scanned 24 Warnings 4 Notes pour finir j'ai déja essayer de faire les mises a jour de xp sp1 sp2 pb c'est que j'ai une config assez vielle et hélas mon p'tit pépère PC as du mal bref il tire la langue mais bon.... donc merci encore et d'après toi je dois encore supprimer des composant ou alors c bon. et bravo pour la clarté de ton topic... Castor major

Hello et merci d'avoir répondu aussi clairement. je vais faire les manips en fin d'apm et te tiens au courant je vais suivre a la lettre se que vous m'avez conseiller. Mon anti virus ainsi que mon anti espion sont avec zone alarme j'éspère que celui ci est assez puissant enfin jusqu'a présent je n'ai vraiment pas eu de souci majeur avec se soft . merci encore. castor major

Bonjour a tous Je suis tout nouveau et je remercie zebulon.fr qui me permet d'exposer mon cas, d'habitude j'essaie de me debrouillé tout seul mais là je sèche, et j'avoue que je n'ai plus vraiment le temps avec l'ouverture de mon entreprise,c'est pour sa simplicité et efficaciter que je viens sur ce forum. Donc voici mon problème j'ai télécharger une mise a jour d'un jeux et je ne sais pas si celui ci est malveillant je n'aurais pas du suivre les liens quand je l'ai reçu le nom ne me pairaissait pas trompeur donc je l'ai ouvert j'ai mon firewall qui c'est déclancher (Zone alarm 6.5 secu. suite), aussi tôt j'ai fait une analyse il a traité 3 virus don je ne me souvient plus de leurs noms ,et un qu'il ne trouvait pas le traitement je ne le retrouve pas dans les quarantaine tout ce que je me souvient c'est de WIN32/SWIZZOR quelque chose comme ça... bref depuis il mon anti virus c'est declenché 2 fois sans jamais l'avoir fait réaparaitre mais toujour en suppriment d'autre virus toujour par groupe de 2. Aussi j'ai bloqué l'accès a I.E. 6 car celui ci ce declenchais dans des fenetre rapide et invisible le voyant de zone alarm dans ma barre de tache lui me montrait que j'avais un debit sortant, quand je regardais les programe qui voulais sortir il me montrais I.E 6 qui clignotais comme un malade. Je peux me passer de se naviguateur je passe par opéra mais meme si je le supprime je ne pense pas que sa resoude le problème du virus si il y en a . Mon F.A.I est Orange 8 meg par modem ethernet, je suis sous xp pro. Je suis desoler d'avoir fait un texte aussi long mais je pense que si vous puvez m'aider il vous faut des infos. D'avance je vous remercie pour votre aide Castor major Rapport de HIJACK Logfile of HijackThis v1.94.0 Scan saved at 07:12:00, on 04/11/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.fr/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=local., O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: NetXfer - {C16CBAAC-A75C-4DB5-A0DD-CDF5CAFCDD3A} - C:\Program Files\Xi\NetXfer\NXToolBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Tout télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddList.html O8 - Extra context menu item: Télécharger avec NetXfer - C:\Program Files\Xi\NetXfer\NXAddLink.html O10 - Hijacked Internet access by New.Net O10 - Unknown file in Winsock LSP: c:\windows\system32\zonelabs\vetredir.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\zonelabs\vetredir.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\zonelabs\vetredir.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\zonelabs\vetredir.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://creative.com/su/ocx/15015/CTSUEng.cab O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/prot...b?1119775106873 O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://82.231.205.22:1024/activex/AMC.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://creative.com/su/ocx/15016/CTPID.cab Voila tout....