RESOLU : Au rapport !

surfspirit · le 3 septembre 2006

Bonjour à tous et à toutes!

Nouveau sur le forum, j'ai des affichages de pages internet non désirées (de type adultfrienfinder, poker..) et je viens de suivre à la lettre la procédure de nettoyage / Hijackthis (merci Megataupe

Merci d'avance pour votre aide précieuse !

I / Rapport Hijackthis

Logfile of HijackThis v1.99.1

Scan saved at 00:42:42, on 04/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\S24EvMon.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Drivers\trcboot.exe

C:\Program Files\IBM\Personal Communications\PCS_AGNT.EXE

C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

C:\Program Files\c4ebreg\c4ebreg.exe

c:\sdwork\issimsvc.exe

C:\notes\ntmulti.exe

C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE

C:\WINDOWS\System32\QCONSVC.EXE

C:\WINDOWS\system32\RegSrvc.exe

C:\Program Files\Symantec AntiVirus\SavRoam.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\TpKmpSVC.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\Drivers\ldlcserv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\IBM\Personal Communications\tpam.exe

C:\Program Files\c4ebreg\isamtray.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\CheckPoint\Integrity Client\iclient.exe

C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE

C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\DrvMon.exe

C:\Program Files\IBM\Bluetooth Software\BTTray.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe

C:\WINDOWS\system32\1XConfig.exe

C:\Documents and Settings\Administrator\Desktop\hijackthis\spirit.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w3-5.ibm.com/emea/fr/w3fr.nsf

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3.ibm.com/download/standardsoftware/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [Tpam.exe] "C:\Program Files\IBM\Personal Communications\tpam.exe"

O4 - HKLM\..\Run: [iSAMTray] "C:\Program Files\c4ebreg\isamtray.exe"

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

O4 - HKLM\..\Run: [bMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE

O4 - HKLM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor

O4 - HKLM\..\Run: rundll32.exe C:\PROGRA~1\Thin k Pad\UTILIT~1\BatLogEx.DLL,S tartBattLog

O4 - H K LM\..\Run: [s ynTPLpr] C:\Program File s \S ynaptic s \S ynTP\S ynTPLpr.exe

O4 - H K LM\..\Run: [s ynTPEnh] C:\Program File s \S ynaptic s \S ynTP\S ynTPEnh.exe

O4 - H K LM\..\Run: [TP K MAPHELPER] C:\Program File s \Thin k Pad\Utilitie s \Tp K mapAp.exe -helper

O4 - H K LM\..\Run: [TPHOT K EY] C:\PROGRA~1\Thin k Pad\P k gMgr\HOT K EY\TPH K MGR.exe

O4 - H K LM\..\Run: [ControlCenter] "C:\Program File s \IBM fingerprint s oftware\ctlcntr.exe" /s tartup

O4 - H K LM\..\Run: [i S S I EZUpdate S ervice] "c:\s dwor k \i s s im s vc.exe"

O4 - H K LM\..\Run: [Re s cueRecovery S etPW] c:\s dwor k \Re s cue&Recovery S etPW.ln k

O4 - H K LM\..\Run: [C4EBReg] "C:\Program File s \c4ebreg\c4ebreg.exe" /q

O4 - H K LM\..\Run: [dla] C:\WINDOW S \s y s tem32\dla\tf s wctrl.exe

O4 - H K LM\..\Run: [s tgclean] c:\s dwor k \w32main2.exe /cleanup

O4 - H K LM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprop s .cpl,,BluetoothAuthenticationAgent

O4 - H K LM\..\Run: [HPDJ Ta s k bar Utility] C:\WINDOW S \s y s tem32\s pool\driver s \w32x86\3\hpzt s b04.exe

O4 - H K LM\..\Run: [s unJavaUpdate S ched] C:\Program File s \Java\jre1.5.0_06\bin\ju s ched.exe

O4 - H K LM\..\Run: [Zone Lab s Client] "C:\Program File s \Chec k Point\Integrity Client\iclient.exe"

O4 - H K LM\..\Run: [QCTRAY] C:\Program File s \Thin k Pad\ConnectUtilitie s \QCTRAY.EXE

O4 - H K LM\..\Run: [QCWLICON] C:\Program File s \Thin k Pad\ConnectUtilitie s \QCWLICON.EXE

O4 - H K LM\..\Run: [EP S ON S tylu s CX3600 S erie s ] C:\WINDOW S \S y s tem32\s pool\DRIVER S \W32X86\3\E_FATI9BE.EXE /P26 "EP S ON S tylu s CX3600 S erie s " /O6 "U S B002" /M "S tylu s CX3600"

O4 - H K CU\..\Run: [ctfmon.exe] C:\WINDOW S \s y s tem32\ctfmon.exe

O4 - H K CU\..\Run: [DrvMon.exe] C:\WINDOW S \s y s tem32\DrvMon.exe

O4 - Global S tartup: BTTray.ln k = ?

O4 - Global S tartup: Logiciel K oda k Ea s y S hare.ln k = C:\Program File s \K oda k \K oda k Ea s y S hare s oftware\bin\Ea s y S hare.exe

O4 - Global S tartup: Lotu s Quic k S tart.ln k = ?

O4 - Global S tartup: Utilitaire r é s eau pour S AGEM Wi-Fi 11g U S B adapter.ln k = ?

O8 - Extra context menu item: E&xport to Micro s oft Excel - re s ://C:\PROGRA~1\MICRO S ~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: S end To &Bluetooth - C:\Program File s \IBM\Bluetooth S oftware\bt s endto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOW S \s y s tem32\m s java.dll

O9 - Extra 'Tool s ' menuitem: S un Java Con s ole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOW S \s y s tem32\m s java.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program File s \IBM\Bluetooth S oftware\bt s endto_ie.htm

O9 - Extra 'Tool s ' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program File s \IBM\Bluetooth S oftware\bt s endto_ie.htm

O11 - Option s group: [JAVA_IBM] Java (IBM)

O14 - IERE S ET.INF: S TART_PAGE_URL=http://w3.ibm.com

O16 - DPF: {33331111-1111-1111-1111-611111193423} - http://www.www2.p0rt2.com/file s /777.cab

O16 - DPF: {33331111-1111-1111-1111-611111193429} - http://www.www2.p0rt2.com/file s /_ip s ec_.cab

O16 - DPF: {33331111-1234-1111-1111-615111193427} - http://www.www2.p0rt2.com/file s /epl95bd.cab

O16 - DPF: {43331111-1111-1111-1111-611111195622} - http://www.www2.p0rt2.com/file s /Mirar S etup-875498.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Cla s s ) - http://update.micro s oft.com/window s update/...b?1121293151687

O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebA s s i s t Cla s s ) - http://w3.ibm.com/bluepage s /s cript s /lnweba s s i s t.cab

O16 - DPF: {A4B28810-11A2-4956-82D1-B2DCBA4B2AFD} (gpw s x.plugin) - http://w3.ibm.com/tool s /print/plugin/gpw s x2.7.cab

O20 - Winlogon Notify: NavLogon - C:\WINDOW S \s y s tem32\NavLogon.dll

O20 - Winlogon Notify: pc s in s t - C:\WINDOW S \S Y S TEM32\pc s in s t.dll

O20 - Winlogon Notify: QConGina - C:\WINDOW S \S Y S TEM32\QConGina.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOW S \S Y S TEM32\WgaLogon.dll

O21 - S S ODL: S y s temChec k 2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOW S \s y s tem32\vb s y s 2.dll (file mi s s ing)

O23 - S ervice: AppnNode - IBM Corporation - C:\WINDOW S \s y s tem32\Driver s \appnnode.exe

O23 - S ervice: Ati Hot K ey Poller - Un k nown owner - C:\WINDOW S \s y s tem32\Ati2evxx.exe

O23 - S ervice: Bluetooth S ervice (btwdin s ) - WIDCOMM, Inc. - C:\Program File s \IBM\Bluetooth S oftware\bin\btwdin s .exe

O23 - S ervice: S ymantec Event Manager (ccEvtMgr) - S ymantec Corporation - C:\Program File s \Common File s \S ymantec S hared\ccEvtMgr.exe

O23 - S ervice: S ymantec Pa s s word Validation (ccPwd S vc) - S ymantec Corporation - C:\Program File s \Common File s \S ymantec S hared\ccPwd S vc.exe

O23 - S ervice: S ymantec S etting s Manager (cc S etMgr) - S ymantec Corporation - C:\Program File s \Common File s \S ymantec S hared\cc S etMgr.exe

O23 - S ervice: S ymantec AntiViru s Definition Watcher (DefWatch) - S ymantec Corporation - C:\Program File s \S ymantec AntiViru s \DefWatch.exe

O23 - S ervice: IBM Rapid Re s tore Ultra S ervice - Un k nown owner - C:\Program File s \IBM\IBM Rapid Re s tore Ultra\rrpc s b.exe

O23 - S ervice: IBM PM S ervice (IBMPM S VC) - Un k nown owner - C:\WINDOW S \s y s tem32\ibmpm s vc.exe

O23 - S ervice: IBM S tandard A s s et Manager S ervice (I S AM S vc) - IBM Global S ervice s - C:\Program File s \c4ebreg\c4ebreg.exe

O23 - S ervice: I S S I EZUpdate (I S S IMon) - IBM Global S ervice s - c:\s dwor k \i s s im s vc.exe

O23 - S ervice: K oda k Camera Connection S oftware (K oda k CC S ) - Ea s tman K oda k Company - C:\WINDOW S \s y s tem32\driver s \K oda k CC S .exe

O23 - S ervice: IBM Enterpri s e Extender (ldlc s erv) - IBM Corporation - C:\WINDOW S \s y s tem32\Driver s \ldlc s erv.exe

O23 - S ervice: Multi-u s er Cleanup S ervice - IBM Corp - C:\note s \ntmulti.exe

O23 - S ervice: Networ k Configuration S ervice (NetCfg S vr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfg S v.EXE

O23 - S ervice: IBM P S A Acce s s Driver Control (P s a S rv) - Un k nown owner - C:\WINDOW S \s y s tem32\P s a S rv.exe (file mi s s ing)

O23 - S ervice: QCON S VC - IBM Corp. - C:\WINDOW S \S y s tem32\QCON S VC.EXE

O23 - S ervice: Reg S rvc - Intel Corporation - C:\WINDOW S \s y s tem32\Reg S rvc.exe

O23 - S ervice: S pectrum24 Event Monitor (S 24EventMonitor) - Intel Corporation - C:\WINDOW S \s y s tem32\S 24EvMon.exe

O23 - S ervice: S AVRoam (S avRoam) - s ymantec - C:\Program File s \S ymantec AntiViru s \S avRoam.exe

O23 - S ervice: S ymantec Networ k Driver s S ervice (S ND S rvc) - S ymantec Corporation - C:\Program File s \Common File s \S ymantec S hared\S ND S rvc.exe

O23 - S ervice: S ymantec AntiViru s - S ymantec Corporation - C:\Program File s \S ymantec AntiViru s \Rtv s can.exe

O23 - S ervice: IBM K CU S ervice (Tp K mp S VC) - Un k nown owner - C:\WINDOW S \s y s tem32\Tp K mp S VC.exe

O23 - S ervice: IBM Trace Facility (TrcBoot) - IBM Corporation - C:\WINDOW S \s y s tem32\Driver s \trcboot.exe

O23 - S ervice: TrueVector Internet Monitor (v s mon) - Chec k Point Inc. - C:\WINDOW S \s y s tem32\ZoneLab s \v s mon.exe

II / Rapport Anti Vir

AntiVir Per s onalEdition Cla s s ic

Report file date: dimanche 3 s eptembre 2006 22:11

S canning for 397237 viru s s train s and unwanted program s .

Licen s ed to: AntiVir Per s onalEdition Cla s s ic

S erial number: 0000149996-WURGE-0001

Platform: Window s XP

Window s ver s ion: (S ervice Pac k 2) [5.1.2600]

U s ername: PAJOT

Computer name: F077358

Ver s ion information s :

AV S CAN.EXE : 7.0.0.42 557096 03/09/2006 19:18:34

AV S CAN.DLL : 7.0.0.42 53288 03/09/2006 19:18:34

LU K E.DLL : 7.0.0.42 118824 03/09/2006 19:18:34

LU K ERE S .DLL : 7.0.0.42 25640 03/09/2006 19:18:34

ANTIVIR0.VDF : 6.35.0.1 7371264 03/09/2006 19:18:33

ANTIVIR1.VDF : 6.35.0.4 2048 03/09/2006 19:18:33

ANTIVIR2.VDF : 6.35.0.5 2048 03/09/2006 19:18:34

ANTIVIR3.VDF : 6.35.0.6 2048 03/09/2006 19:18:34

AVEWIN32.DLL : 7.1.0.10 1511936 03/09/2006 19:18:34

AVPREF.DLL : 7.0.0.1 49192 03/09/2006 19:18:34

AVREP.DLL : 6.35.0.1 643112 03/09/2006 19:18:34

AVRPBA S E.DLL : 7.0.0.0 2162728 03/09/2006 19:18:34

AVPAC K 32.DLL : 7.1.0.1 335912 03/09/2006 19:18:34

AVREG.DLL : 6.31.0.90 27688 03/09/2006 19:18:34

NETNT.DLL : 6.32.0.0 6696 03/09/2006 19:18:34

NETNW.DLL : 6.32.0.0 9768 03/09/2006 19:18:34

RCIMAGE.DLL : 7.0.0.71 1642536 03/09/2006 19:18:35

RCTEXT.DLL : 7.0.0.75 77864 03/09/2006 19:18:35

Configuration s etting s for the s can:

Jobname: '%s '.................: Local Drive s

Configuration file............: C:\Program File s \AntiVir Per s onalEdition Cla s s ic\alldrive s .avp

Boot s ector s ..................: C,D,E

S can memory...................: 1

Proce s s s can..................: 1

S can all file s ................: 2

S can archive s .................: 1

Recur s ion depth...............: 20

S mart exten s ion s ..............: 1

S k ipped archive type s .........: 1000,1001,1002,1003,1004,

Macro heuri s tic...............: 1

File heuri s tic................: 2

Primary action................: 1

S econdary action..............: 0

S tart of the s can: dimanche 3 s eptembre 2006 22:11

The s can over running proce s s e s will be s tarted

13 Proce s s e s wa s s canned

S tart s canning boot s ector s :

Boot s ector 'C:\'

[NOTE] No viru s wa s found!

S tarting to s can the regi s try.

The regi s try wa s s canned ( 43 file s ).

S tarting the file s can:

C:\pagefile.s y s

[WARNING] The file could not be opened!

C:\$U S ER\IBM re s s ource s \IBM re s s ource s \per s o\dancin~1.exe

[DETECTION] I s the Trojan hor s e TR/Cacogen.A

[iNFO] The file wa s deleted!

C:\Document s and S etting s \Admini s trator\NTU S ER.DAT

[WARNING] The file could not be opened!

C:\Document s and S etting s \Admini s trator\ntu s er.dat.LOG

[WARNING] The file could not be opened!

C:\Document s and S etting s \Admini s trator\Application Data\IBM\Java\Deployment\cache\javapi\v1.0\jar\ER S In s taller.jar-1bb-5b9bc2af.zip

[0] Archive type: ZIP

--> com/ibm/er s /er s in s t/exc/fe/BPOfflineIconIn s taller.cla s s

[DETECTION] I s the Trojan hor s e TR/Java.Downloader.Gen

[iNFO] The file wa s deleted!

C:\Document s and S etting s \Admini s trator\Application Data\S un\Java\Deployment\cache\javapi\v1.0\jar\ER S In s taller.jar-394c0454-72962965.zip

[0] Archive type: ZIP

--> com/ibm/er s /er s in s t/exc/fe/BPOfflineIconIn s taller.cla s s

[DETECTION] I s the Trojan hor s e TR/Java.Downloader.Gen

[iNFO] The file wa s deleted!

C:\Document s and S etting s \Admini s trator\Local S etting s \Application Data\Micro s oft\Window s \U s rCla s s .dat

[WARNING] The file could not be opened!

C:\Document s and S etting s \Admini s trator\Local S etting s \Application Data\Micro s oft\Window s \U s rCla s s .dat.LOG

[WARNING] The file could not be opened!

C:\Document s and S etting s \Networ k S ervice\NTU S ER.DAT

[WARNING] The file could not be opened!

C:\Document s and S etting s \Networ k S ervice\ntu s er.dat.LOG

[WARNING] The file could not be opened!

C:\Document s and S etting s \Networ k S ervice\Local S etting s \Application Data\Micro s oft\Window s \U s rCla s s .dat

[WARNING] The file could not be opened!

C:\Document s and S etting s \Networ k S ervice\Local S etting s \Application Data\Micro s oft\Window s \U s rCla s s .dat.LOG

[WARNING] The file could not be opened!

C:\note s 6b k p\note s \data\mailbox.ntf

[WARNING] The file could not be opened!

C:\WINDOW S \internt.exe

[DETECTION] Contain s s ignature of the dial-up program DIAL/Generic

[iNFO] The file wa s deleted!

C:\WINDOW S \s y s tem32\vb s y s 2.dll

[DETECTION] I s the Trojan hor s e TR/Clic k .Agent.AC

[iNFO] The file wa s deleted!

C:\WINDOW S \s y s tem32\config\default

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\default.LOG

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\S AM

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\S AM.LOG

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\S ECURITY

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\S ECURITY.LOG

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\s oftware

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\s oftware.LOG

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\s y s tem

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\config\s y s tem.LOG

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\driver s \dt s c s i.s y s

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\driver s \s ptd.s y s

[WARNING] The file could not be opened!

C:\WINDOW S \s y s tem32\driver s \s ptd3805.s y s

[WARNING] The file could not be opened!

End of the s can: dimanche 3 s eptembre 2006 23:51

U s ed time: 1:40:47 min

The s can ha s been done completely.

5629 S canning directorie s

378179 File s were s canned

5 viru s e s and/or unwanted program s wa s found

5 file s were deleted

0 file s were repaired

0 file s were moved to quarantine

0 file s were renamed

8421 Archive s were s canned

23 Warning s

1 Note s

III / Rapport "unins tall lis t" (is s u d'hijack this )

Acce s s IBM

Adobe Acrobat - Reader 6.0.2 Update

Adobe Reader 6.0.1

AFP Wor k bench for Window s

Agere S y s tem s AC'97 Modem

AIPTE K PenCam Manager

AT&T Networ k Client

ATI Di s play Driver

Audacity 1.2.4

CC S core

Con s ole Oracle Web Conferencing

DivX

DivX Player

DVD S hrin k 3.2

EP S ON CardMonitor

EP S ON Copy Utility 3

EP S ON Logiciel imprimante

EP S ON PhotoQuic k er3.5

EP S ON Photo S tarter3.1

EP S ON PRINT Image Framer Tool2.1

EP S ON S can

EP S ON S mart Panel

EP S ON Web-To-Page

E S CX3600 Guide de r é f.

E S CX3600 Guide de s logiciel s

E S S Brwr

E S S CDB K

E S S core

E S S CT

E S S EMAIL

E S S gui

E S S help

E S S ini

E S S PCD

E S S S ONIC

E S S TOOL S

e s s vatgt

e s s vcpt

E S S vpaht

E S S vpot

HighMAT Exten s ion to Micro s oft Window s XP CD Writing Wizard

Hijac k Thi s 1.99.1

HLPIndex

HLP S FO

hp de s k jet 970c s erie s

hp de s k jet 970c s erie s (Remove only)

IBM 32-bit Runtime Environment for Java 2, v1.4.2

IBM Acce s s Connection s

IBM DLA

IBM Infoprint S elect

IBM Integrated Bluetooth II S oftware

IBM I S MA Peer-To-Peer

IBM Per s onal Communication s

IBM RecordNow!

IBM Re s cue and Recovery with Rapid Re s tore

IBM S ignature S elling Method

IBM S oftware Unin s tall

IBM Thin k Pad Battery MaxiMi s er and Power Management Feature s

IBM Thin k Pad Configuration

IBM Thin k Pad K eyboard Cu s tomizer Utility

IBM Thin k Pad Power Management Driver

IBM Thin k Pad Pre s entation Director

IBM Thin k Pad UltraNav Driver

IBM Thin k Pad UltraNav Wizard

IBM Tivoli S torage Manager Client

ILC

Intel® PRO Networ k Adapter s and Driver s

J2 S E Runtime Environment 5.0 Update 6

Java 2 Runtime Environment, S E v1.4.2_01

K azaa Lite K ++ v2.4.3

K S U

Lecteur Window s Media 10

LiveUpdate 2.0 (S ymantec Corporation)

Logiciel K oda k Ea s y S hare

Lotu s Note s 7.0

Lotu s Note s S QL 3.01 driver

Lotu s S mart S uite - Engli s h

Macromedia Fla s h Player 8

Micro s oft .NET Framewor k 1.1

Micro s oft .NET Framewor k 1.1 Hotfix (K B886903)

Micro s oft Office Excel Viewer 2003

Micro s oft Office PowerPoint Viewer 2003

Micro s oft Office Word Viewer 2003

Micro s oft Office XP S tandard

Micro s oft Window s Journal Viewer

MI K S OFT Mobile 3GP converter

Mozilla Firefox (1.0.5)

Notifier

OfotoXMI

OTtBP

OTtBP S D K

Photor é cit 3 pour Window s

PIF DE S IGNER2.1

S AGEM Wi-Fi 11g U S B adapter (outil)

S AGEM Wi-Fi 11g U S B adapter (pilote)

S ametime Client v3.1

S canToWeb

S ecurity Update for Window s Media Player (K B911564)

S ecurity Update for Window s Media Player 10 (K B917734)

S ecurity Update for Window s Media Player 9 (K B911565)

S ecurity Update for Window s Media Player 9 (K B917734)

S ecurity Update for Window s XP (K B883939)

S ecurity Update for Window s XP (K B890046)

S ecurity Update for Window s XP (K B893756)

S ecurity Update for Window s XP (K B896358)

S ecurity Update for Window s XP (K B896422)

S ecurity Update for Window s XP (K B896423)

S ecurity Update for Window s XP (K B896424)

S ecurity Update for Window s XP (K B896428)

S ecurity Update for Window s XP (K B896688)

S ecurity Update for Window s XP (K B899587)

S ecurity Update for Window s XP (K B899588)

S ecurity Update for Window s XP (K B899589)

S ecurity Update for Window s XP (K B899591)

S ecurity Update for Window s XP (K B900725)

S ecurity Update for Window s XP (K B901017)

S ecurity Update for Window s XP (K B901190)

S ecurity Update for Window s XP (K B901214)

S ecurity Update for Window s XP (K B902400)

S ecurity Update for Window s XP (K B903235)

S ecurity Update for Window s XP (K B904706)

S ecurity Update for Window s XP (K B905414)

S ecurity Update for Window s XP (K B905749)

S ecurity Update for Window s XP (K B908519)

S ecurity Update for Window s XP (K B911280)

S ecurity Update for Window s XP (K B911562)

S ecurity Update for Window s XP (K B911567)

S ecurity Update for Window s XP (K B911927)

S ecurity Update for Window s XP (K B912812)

S ecurity Update for Window s XP (K B912919)

S ecurity Update for Window s XP (K B913446)

S ecurity Update for Window s XP (K B913580)

S ecurity Update for Window s XP (K B914388)

S ecurity Update for Window s XP (K B914389)

S ecurity Update for Window s XP (K B916281)

S ecurity Update for Window s XP (K B917159)

S ecurity Update for Window s XP (K B917344)

S ecurity Update for Window s XP (K B917422)

S ecurity Update for Window s XP (K B917953)

S ecurity Update for Window s XP (K B918439)

S ecurity Update for Window s XP (K B918899)

S ecurity Update for Window s XP (K B920214)

S ecurity Update for Window s XP (K B920670)

S ecurity Update for Window s XP (K B920683)

S ecurity Update for Window s XP (K B921398)

S ecurity Update for Window s XP (K B921883)

S ecurity Update for Window s XP (K B922616)

S FR

S HA S TA

S K IN0001

S K INX S D K

S nap s hot Viewer

S ony Eric s s on File Manager

S ony Eric s s on Image Editor

S ony Eric s s on MM S Home S tudio

S ony Eric s s on Mobile Networ k ing Wizard

S ony Eric s s on S ound Editor

S ony Eric s s on S ync S tation

S pybot - S earch & De s troy 1.4

S ymantec AntiViru s

Update for Window s XP (K B896727)

Update for Window s XP (K B898461)

Update for Window s XP (K B900485)

Update for Window s XP (K B908531)

Update for Window s XP (K B910437)

Update for Window s XP (K B916595)

Update for Window s XP (K B917425)

VPRINTOL

Winamp (remove only)

Window s In s taller 3.1 (K B893803)

Window s In s taller Clean Up

Window s Media Format Runtime

Window s XP Hotfix - K B867282

Window s XP Hotfix - K B873333

Window s XP Hotfix - K B873339

Window s XP Hotfix - K B885250

Window s XP Hotfix - K B885835

Window s XP Hotfix - K B885836

Window s XP Hotfix - K B885884

Window s XP Hotfix - K B886185

Window s XP Hotfix - K B887472

Window s XP Hotfix - K B887742

Window s XP Hotfix - K B887797

Window s XP Hotfix - K B888113

Window s XP Hotfix - K B888302

Window s XP Hotfix - K B890047

Window s XP Hotfix - K B890175

Window s XP Hotfix - K B890859

Window s XP Hotfix - K B890923

Window s XP Hotfix - K B891781

Window s XP Hotfix - K B893066

Window s XP Hotfix - K B893086

WIRELE S S

Modifié le 5 septembre 2006 par surfspirit

bruce lee · le 4 septembre 2006

bonjour surfspirit et bienvenue sur zebulon

Si durant la procedure ci bas, il y a des etapes que tu n'as pas reussi a faire, merci de

continuer la procedure jusqu'au bout et de les signaler dans ta prochaine reponse.

1/Télécharge la version d'évaluation d'Ewido:

http://www.ewido.net/en/download/

Installe la et mets à jour.

Démarre Ewido avec l'icône qui se trouve sur ton Bureau.

Clique sur Update Now,

attend la fin de cette mise à jour,

puis ferme le programme.

2/demarre en mode sans echec http://www.sosordi.net/Faq/Faq.2.html

3/lance hijackthis en cliquant sur do a scan system only coche ces lignes:

O16 - DPF: {33331111-1111-1111-1111-611111193423} - http://www.www2.p0rt2.com/files/777.cab

O16 - DPF: {33331111-1111-1111-1111-611111193429} - http://www.www2.p0rt2.com/files/_ipsec_.cab

O16 - DPF: {33331111-1234-1111-1111-615111193427} - http://www.www2.p0rt2.com/files/epl95bd.cab

O16 - DPF: {43331111-1111-1111-1111-611111195622} - http://www.www2.p0rt2.com/files/MirarSetup-875498.cab

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\system32\vbsys2.dll (file missing)

Ferme toutes les fenêtres ouvertes sauf Hijackthis et clique sur fix checked

4/ Relance Ewido et clique sur Scanner

Puis sur l'onglets Settings, pour How to Act sélèctionne Quarantine.

Reviens a l'onglet Scan cliques Complete system Scan.

Le scan démarre.

A la fin cliquer sur Apply all actions

Puis sur Save report et pour finir Save report as enregistrer sur le Bureau.

5/redemarre en mode normal

6/poste le rapport d'ewido ainsi qu'un nouveau log hijackthis.

bon courage, et si tu as la moindre question n'hesite surtout pas

@+

Modifié le 4 septembre 2006 par bruce lee

surfspirit · le 4 septembre 2006

Merci bruce lee pour ta réactivité

Comme convenu :

I / Rapport EWIDO

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 15:25:29 04/09/2006

+ Scan result:

HKLM\SOFTWARE\Classes\Interface\{06CA2DA3-3A44-4FC7-8FD9-246C0F53407C} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).

C:\Program Files\DAEMON Tools\SetupDTSB.exe -> Adware.SaveNow : Cleaned with backup (quarantined).

C:\WINDOWS\Downloaded Program Files\MirarSetup.exe -> Adware.SaveNow : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@hertz.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@iv2.bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

:mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zuxm2jfo.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

:mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zuxm2jfo.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

:mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zuxm2jfo.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

:mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zuxm2jfo.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz11.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz2.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz5.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz6.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@cz9.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@vip.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@vip2.clickzs[1].txt -> TrackingCookie.Clickzs : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@com[2].txt -> TrackingCookie.Com : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@as1.falkag[1].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@paycounter[1].txt -> TrackingCookie.Paycounter : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup (quarantined).

:mozilla.29:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\zuxm2jfo.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@weborama[1].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@xxxcounter[1].txt -> TrackingCookie.Xxxcounter : Cleaned with backup (quarantined).

C:\Documents and Settings\Administrator\Cookies\pajot@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup (quarantined).

C:\$USER\IBM ressources\IBM ressources\perso\heart1_1.exe -> Trojan.Sporse : Cleaned with backup (quarantined).

::Report end

II / Nouveau Rapport Hijachthis

Logfile of HijackThis v1.99.1

Scan saved at 15:35:16, on 04/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\S24EvMon.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Drivers\trcboot.exe

C:\Program Files\IBM\Personal Communications\PCS_AGNT.EXE

C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe

C:\Program Files\c4ebreg\c4ebreg.exe

c:\sdwork\issimsvc.exe

C:\notes\ntmulti.exe

C:\PROGRA~1\AT&TNE~1\NetCfgSv.EXE

C:\WINDOWS\System32\QCONSVC.EXE

C:\WINDOWS\system32\RegSrvc.exe

C:\Program Files\Symantec AntiVirus\SavRoam.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\TpKmpSVC.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\Drivers\ldlcserv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\IBM\Personal Communications\tpam.exe

C:\Program Files\c4ebreg\isamtray.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\CheckPoint\Integrity Client\iclient.exe

C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE

C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

C:\WINDOWS\system32\1XConfig.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\DrvMon.exe

C:\Program Files\IBM\Bluetooth Software\BTTray.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe

C:\Program Files\AT&T Network Client\NetClient.exe

C:\Program Files\Lotus\Sametime Client\Connect.exe