Infection dropper.small.art & dialer.agent.z

le_yeti · le 10 août 2006

Bonjour à tous,

Infections détectées par ewido :

dropper.small.art & dialer.agent.z

sur pc en windows 2000

Détectés uniquement par fenetre d'alerte ewido lorsque les bestioles se réveillent. (ras sur le scan complet)

Présence à ce moment dans windows\temp de diverses cochonneries.tmp.exe

Tenté démarrage sans échec et lancement ewido + ccsetup + vundofix + smitfraudfix

La Bêêête est toujours vivante !

Voici un chtit coup de HiJackThis - Un grand merci d'avance pour le coup de main

(nb : la présence de r_server est ok)

Logfile of HijackThis v1.99.1

Scan saved at 18:35:21, on 10/08/2006

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\drivers\trcboot.exe

C:\WINDOWS\system32\cisvc.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

C:\Other Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\Other Program Files\Tiny Personal Firewall\persfw.exe

C:\TOOLS\RCMDSVC.EXE

C:\WINDOWS\system32\regsvc.exe

C:\WINDOWS\system32\R_server.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\WINDOWS\system32\MSTask.exe

C:\Program Files\HISClient\system\snabase.exe

C:\Program Files\HISClient\system\snarpcsv.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\system32\stisvc.exe

C:\WINDOWS\System32\WBEM\WinMgmt.exe

C:\WINDOWS\system32\mspmspsv.exe

C:\WINDOWS\system32\svchost.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\system32\CCM\CcmExec.exe

C:\appli\statpath\EIDCOM.EXE

C:\appli\statpath\ELITE.EXE

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

C:\Other Program Files\Itunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Other Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

C:\Program Files\Fichiers communs\{645FD271-0AE9-1036-0710-030313200021}\Update.exe

C:\Other Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Other Program Files\pgp\PGPTray.exe

C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\Fichiers communs\System\Mapi\1036\NT\MAPISP32.EXE

C:\Other Program Files\FireFox\firefox.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\svchost.exe

D:\trash\Download\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par Client Principal

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O1 - Hosts: 17.250.248.77 idisk0.mac.com idisk1.mac.com idisk2.mac.com idisk3.mac.com idisk4.mac.com idisk5.mac.com idisk6.mac.com idisk7.mac.com idisk8.mac.com idisk9.mac.com idisk10.mac.com idisk11.mac.com idisk12.mac.com idisk13.mac.com idisk14.mac.com idisk15.mac.com idisk16.mac.com idisk17.mac.com idisk18.mac.com idisk19.mac.com idisk20.mac.com idisk21.mac.com idisk22.mac.com idisk23.mac.com idisk24.mac.com idisk25.mac.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RBLK_RoboX Screen Class - {22389F3A-A44B-4DDE-9FE5-D7A08BA981E1} - C:\appli\statpath\rblk_robox.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: WLIB_IESpy.IESpyBHO Class - {E0C056A1-3024-4BD8-8FA2-429C562ADCAB} - C:\appli\statpath\wlib_iespy.dll

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx

O3 - Toolbar: Copernic Desktop Search - {C5F7A735-70F1-477F-8C36-6FF3C736017B} - C:\Other Program Files\Copernic Desktop Search\CopernicDesktopSearchIntegration977.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [WPLOGON] c:\tools\wpkit.exe -titre "Parametrage du poste" -message "Veuillez patienter pendant la configuration de votre profil ..." c:\tools\wplogon.cmd -test "c:\documents and settings\%username%\Application Data\WP\1stlogon.tag"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Other Program Files\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [PFTLAsyncLogon] C:\appli\statpath\tool_hideexec.exe exec C:\appli\statpath\sson_ginaevt.exe asynchrone

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup

O4 - HKLM\..\Run: [iTunesHelper] "C:\Other Program Files\Itunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Other Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [!ewido] "C:\Other Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Other Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray

O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Startup: PGPtray.lnk = C:\Other Program Files\pgp\PGPTray.exe

O4 - Startup: Raccourci vers D.cmd.lnk = C:\d.cmd

O4 - Startup: Raccourci vers DE.cmd.lnk = scripts\DE.cmd

O4 - Startup: Raccourci vers trans.exe.lnk = C:\Other Program Files\transparent\trans.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: iOpus Internet Macros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Other Program Files\InternetMacros\imacros.dll (file missing)

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

O14 - IERESET.INF: START_PAGE_URL=about:blank

...

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0300f0e30e6c44...RdxIE601_fr.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain =

O20 - Winlogon Notify: HARD_IDBANCLI - HARD_IDBANCLI.DLL (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O20 - Winlogon Notify: SSON_TRAYSRV - SSON_TRAYSRV.DLL (file missing)

O20 - Winlogon Notify: winghy32 - C:\WINDOWS\SYSTEM32\winghy32.dll

O23 - Service: AutoExNT - Unknown owner - C:\WINDOWS\system32\AutoExNT.Exe

O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe

...

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Other Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

O23 - Service: Tiny Personal Firewall (PersFw) - Tiny Software - C:\Other Program Files\Tiny Personal Firewall\persfw.exe

O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\R_server.exe" /service (file missing)

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

O23 - Service: TrcBoot - Unknown owner - C:\WINDOWS\System32\drivers\trcboot.exe

Modifié le 17 août 2006 par le_yeti

Malekal_morte · le 10 août 2006

Bonsoir,

D:\trash\Download\HijackThis.exe <-- renomme le en Scanner.exe

Double-clic sur Scanner.exe

génère un nouveau rapport et copie/colle ici.

le_yeti · le 11 août 2006

Voili-voilou...

Logfile of HijackThis v1.99.1

Scan saved at 15:55:03, on 11/08/2006

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\drivers\trcboot.exe

C:\WINDOWS\system32\cisvc.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

C:\Other Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\Other Program Files\Tiny Personal Firewall\persfw.exe

C:\TOOLS\RCMDSVC.EXE

C:\WINDOWS\system32\regsvc.exe

C:\WINDOWS\system32\R_server.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\WINDOWS\system32\MSTask.exe

C:\Program Files\HISClient\system\snabase.exe

C:\Program Files\HISClient\system\snarpcsv.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\system32\stisvc.exe

C:\WINDOWS\System32\WBEM\WinMgmt.exe

C:\WINDOWS\system32\mspmspsv.exe

C:\WINDOWS\system32\svchost.exe

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\system32\CCM\CcmExec.exe

C:\appli\statpath\EIDCOM.EXE

C:\appli\statpath\ELITE.EXE

C:\appli\statpath\MIDW_SERVER.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

C:\Other Program Files\Itunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe

C:\Other Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\Fichiers communs\{645FD271-0AE9-1036-0710-030313200021}\Update.exe

C:\Other Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Other Program Files\pgp\PGPTray.exe

C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\Fichiers communs\System\Mapi\1036\NT\MAPISP32.EXE

C:\WINDOWS\system32\cidaemon.exe

C:\Other Program Files\FireFox\firefox.exe

C:\Other Program Files\Winamp\Winamp.exe

C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE

D:\trash\Download\scanner.exe