[ Hijackthis Analyse ] Tenga.a

[Mr Backdoor]

Bonjour...

 

Etant mon tout premier message je me permet de me présenter rapidement...

 

Mr Backdoor, aussi appellé GreG, j'ai 28 ans et habite dans le 77, pres de Paris.

( mon pseudo n'a aucun rapport avec le Virus ' Backdoor', ... c'est une longue histoire... )

 

Depuis qlq jours mon PC est verolé par TENGA.A

 

Apres moultes scan par : Kaspersky, Secuser, bitdeffender, rien n'y fait, il rode toujours ( enfin je crois )

 

Cet apres midi, NOD32, a reussi à reparer pas mal de .exe, mais j'ai l'impression que le virus en lui meme est caché dans un recoin... ( des fois mon PC plante completement et aucun icone de mon menu n'est cliquable >> boot sauvage de rigueur )

 

J'ai suivi vos conseils et j'ai fait un ' Hijackthis ' dont voici le rapport :

 

Logfile of HijackThis v1.99.1

Scan saved at 19:11:38, on 15/08/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\System32\RUNDLL32.EXE

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\MSMSGS.EXE

C:\WINDOWS\System32\DrvMon.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

D:\downloads_firefox\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background

O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\System32\DrvMon.exe

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: BlueSoleil.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1130300279421

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

 

 

Je comprend vraiment rien du tout à ces etapes....

 

Merci pour votre aide, c'est la premiere fois que je suis bloqué comme tel par un virus.... ( Merci Kaspersky Pro )

Modifié le 16 août 2006 par Mr Backdoor

[Roach System]

Bonsoir

 

telecharge ceci

http://roachsystem.free.fr/Find%20&%20...%20Now!.zip

choisi l'option 1

Copie/Colle le rapport obtenu ici

[Mr Backdoor]

voici ce que j'obtient :

 

=========================================================================

=========================================================================

Find and Destroy Now! 1.0 By Roach System ©

=========================================================================

=========================================================================

 

 

Crée le "15/08/2006" à "21:16:22,51"

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Program Files ...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Fichiers Communs ...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Recherche de Fichiers Executables (Cela ne veut pas dire infectes)...

 

 

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\Cnmvsa.exe

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\helpkicker.exe

c:\Documents and Settings\Mrbackdoor\Application Data\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe

c:\Documents and Settings\Mrbackdoor\Application Data\Microsoft\Installer\{91057632-CA70-413C-B628-2D3CDBBB906B}\ARPPRODUCTICON.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\mu5sspid.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\byeFB.tmp\Disk1\setup.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\Disk0\_ISDel.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\Disk0\Setup.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\Disk0\UNSTEINS.EXE

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\pft8~tmp\nvudisp.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\pft8~tmp\setup.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\pftE8E.tmp\Setup.exe

c:\Documents and Settings\Mrbackdoor\Local Settings\Temp\{DDB6B45C-B006-423A-9F09-53DACC5EA7E2}\QuickTimeInstaller.exe

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0405\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0405\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0405\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0406\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0406\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0406\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0407\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0407\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0407\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0408\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0408\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0408\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0409\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0409\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0409\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040b\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040b\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040b\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040c\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040c\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040c\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040e\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040e\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\040e\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0410\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0410\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0410\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0411\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0411\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0411\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0413\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0413\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0413\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0414\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0414\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0414\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0415\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0415\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0415\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0419\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0419\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0419\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041d\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041d\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041d\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041F\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041F\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\041F\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0816\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0816\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0816\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0c0a\CNMlr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0c0a\CNMsr7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R\LanguageModules\0c0a\CNMur7A.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNM_0262.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMBR261.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMDRV.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMDUMP5.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMFUS.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMINST.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLMON2.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLR.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRCz.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRDe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRDk.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLREs.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRFi.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRFr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRGr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRHu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRIt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRJ.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRNl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRNo.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRPl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRPt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRRu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRSe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMLRTr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMOP79.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMP_261.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMPCOMM.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMPD.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMPP.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMPV.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMQUEUE.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSMSD.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSR.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRCz.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRDe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRDk.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSREs.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRFi.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRFr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRGr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRHu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRIt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRJ.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRNl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRNo.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRPl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRPt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRRu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRSe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSRTr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMSTMN.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMUI.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMUR.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURCz.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURDe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURDk.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMUREs.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURFi.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURFr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURGr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURHu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURIt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURJ.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURNl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURNo.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURPl.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURPt.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURRu.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURSe.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMURTr.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMVS.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Driver2\CNMW3.DLL

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\cnmi040c.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\cnminst2.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\cnmis.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\cnmis4.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\cnmis5.dll

c:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP5200R Installer\Inst2\devid.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll

c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

c:\Documents and Settings\Mrbackdoor\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash 8\fr\Configuration\External Libraries\FLfile.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash MX 2004\fr\Configuration\authplay.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash MX 2004\fr\Configuration\Importers\AI_EPS_PDF_Import.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash MX 2004\fr\Configuration\Importers\AIImport.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash MX 2004\fr\Configuration\Importers\FhDbRdr.dll

c:\Documents and Settings\Mrbackdoor\Local Settings\Application Data\Macromedia\Flash MX 2004\fr\Configuration\Importers\Fireworks Library.dll

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Mes Documents...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Windows...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Downloaded Program Files...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Fichiers System32...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Application Data...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Menu Demarrer...

 

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Bureau...

 

 

 

 

=========================================================================

=========================================================================

Fin du rapport Roach System ©

=========================================================================

=========================================================================

[Roach System]

I - Suppression des fichiers de restauration

 

Désactives la restauration du système, voir ici

 

*********************************

 

II - Nettoyage des fichiers temporaires, Prefetch, et des applications

 

Télécharge >>>>ceci<<<<

Double-clic sur ATF-Cleaner.exe pour lancer le programme

Coche ceci :

 

Windows Temp

Current User Temp

All Users Temp

Coockies

Temporary Internet Files

Prefetch

Java Cache

 

Le reste tu peux le cocher si tu le désir.

Clique sur Empty Selected et au message Done Cleaning sur Ok

 

*********************************

 

III - Posseder un logiciel Zip/Unzip

 

Assure toi d'avoir un logiciel compression decompression

 

===>

 

Choisi un des trois

 

Winzip[/g]

UltimateZip

Winrar

 

**********************************

 

IV - Preparation du logiciel Anti-Malware

 

1 - Telecharge E Scan

2 - Dezippe le grace au logiciel de decompression dans le dossier C:\Bases (Attention il doit ?tre

obligatoirement ici sinon ca ne marche pas ou tres mal)

3 - Apres l'avoir decompresser normallement il s'ouvre ferme le car on ne s'en servira pas tout de suite

4 - Ouvre le dossier C:\Bases

5 - Clique sur kavupd.exe (Mise A Jour Du logiciel)

 

IV bis - Preparation du logiciel anti-spyware

 

1 - Telecharge spybot search & destroy

2 - Met le a jour

3 - vaccine le

4 - ne le lance pas tout de suite

 

*************************

 

V - Redemarrage specifi?

 

Red?marres en mode sans ?chec, voir ici

 

**************************

 

VI - Utilisation de E Scan

 

1- Ouvre le dossier C:\Bases

2 - Clique sur mwavscan.com

3 - Coche toute ces cases

 

 

4 - Clique sur Scan Clean ( Pendant ce temps matte la télé c'est tres long )

5 - Quand c'est fini Clique Sur 'View Log' et "Save it!"

 

**************************

 

VII - Utilisation de spybot

 

1- Lance Spybot

2 - lance le

3 - supprime tout ce qu'il trouve (coche tout et clique sur corriger les problemes)

4 - redemarre ton ordi

 

**************************

 

VIII - Resultat

 

 

1 - Telecharge ceci

2 - decompresse le dans C:\Bases

3 - Le fichier [g]findmwav.bat[/g] se creer lance le

4 - Ce fichier va en creer un autre found.txt

5 - ouvre le Copie/Colle le rapport obtenu ici

[Mr Backdoor]

Et bien ça c'est du detaillé !!!

 

Je suis en train de faire les manip sur mon PC infecté ( en attendant je regarde pas la TV, y'a rien ... )

 

Je poste dès que j'ai fini, quoi qu'il arrive merci beaucoup !!!!

Modifié le 15 août 2006 par Mr Backdoor

[Mr Backdoor]

Voici le resultat du found.txt :

 

running from directory

C:\Bases

 

---------- MWAV.LOG

Tue Aug 15 23:16:08 2006 => File E:\programmes\complete avi and Div-X Codecs.EXE infected by "Virus.Win32.Tenga.a" Virus. Action Taken: File Disinfected.

 

---------- MWAV.LOG

 

---------- MWAV.LOG

Tue Aug 15 23:30:50 2006 => Total Number of Files Scanned: 136832

Tue Aug 15 23:30:50 2006 => Total Number of Virus(es) Found: 1

Tue Aug 15 23:30:50 2006 => Total Number of Disinfected Files: 1

Tue Aug 15 23:30:50 2006 => Total Number of Files Renamed: 0

Tue Aug 15 23:30:50 2006 => Total Number of Deleted Files: 0

Tue Aug 15 23:30:50 2006 => Total Number of Errors: 2

 

---------- MWAV.LOG

Tue Aug 15 21:41:10 2006 => Virus Database Date: 2006/07/08

Tue Aug 15 21:41:10 2006 => Virus Database Count: 205731

Tue Aug 15 21:57:31 2006 => Virus Database Date: 2006/08/15

Tue Aug 15 21:57:31 2006 => Virus Database Count: 215381

Tue Aug 15 23:30:50 2006 => Virus Database Date: 2006/08/15

Tue Aug 15 23:30:50 2006 => Virus Database Count: 215381

Tue Aug 15 23:36:04 2006 => Virus Database Date: 2006/08/15

Tue Aug 15 23:36:04 2006 => Virus Database Count: 215381

 

Alors docteur c'est grave ?

[Roach System]

File E:\programmes\complete avi and Div-X Codecs.EXE infected by "Virus.Win32.Tenga.a" Virus. Action Taken: File Disinfected.

 

apparament tu l'as plu la

tu as du changement ?

[Mr Backdoor]

Bonjour,

 

File E:\programmes\complete avi and Div-X Codecs.EXE infected by "Virus.Win32.Tenga.a" Virus. Action Taken: File Disinfected.

 

>> Lors de mon scan par NOD 32, il m'avait deja desinfecter bcp de .exe situés dans E:\programmes\ mais pas celui là. Cela veut il dire que d'autres .exe infectés peuvent subsister ?

 

 

Quoi qu'il en soit, j'ai pas eu le temps de me servir de mon PC pendant longtemps hier soir et là je suis au boulot....

 

Je teste ce soir et je poste pour te dire

 

Quelques questions :

 

1 - Hors mes plantages habituels, comment m'assurer que mon PC est de nouveau sain?

 

2 - Est il preferable de laisser cocher ' Desactiver la restauration du systeme ' ?

 

3 - Au revoir Kaspersky, bienvenue à NOD32 ... est ce une bonne décision ? ( sachant que Kasperksy est passé à coté de Tenga.a )

 

4 - Je n'utilise pas de Firewall ( boooooooooooouuuuuuuuuuuu je sais ) : un FW aurait il arreter cette intrusion ? quel FW me conseillez vous ( chez moi plusieurs PC en reseau via un switch, plusieurs DD reseaux, imprimante-reseau sous un connection Freebox V5 )

 

ENCORE MERCI POUR LA REACTIVITE DE TON AIDE !!!!

[Roach System]

Oui réactive ta restauration du systeme

 

et pour le firewall et les conseils de préventention

 

clique >>>>>>>>> ici <<<<<<<<<<<

[Mr Backdoor]

Bon mon PC me refait le meme coup qu'hier !!!

 

Apres une vingtaine de minutes d'utilisation, les fenetres ouvertes fonctionnent ( MSN, Lecteur Windows, Firefox ) mais impossible de les fermer, d'en ouvrir d'autres ... le survol de mes boutons rapides ne fait rien, Idem pour DEMARRER !!!

 

( Je sais pas si ca peut aider, mais le Alt-Tab fonctionne toujours lui )

 

Au secouuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuurs !!!!

Modifié le 16 août 2006 par Mr Backdoor