Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

eradication malware

bayern2006

Par bayern2006
dans Analyses et éradication malwares

 Partager

Messages recommandés

bayern2006 Junior Member

bayern2006

Posté(e)
Posté(e)

Bonjour...

Des fentres s'ouvrent de façon intempestives qiand je suis connecté ( style casinos, antivirus, etc...)

 

J'ai suvi cette procédure :

 

 

Phase 1 : mode normal : téléchargement des outils (antivirus et logiciel HijackThis)

 

Phase 2 : redémarrage en mode sans échec, affichage de tous les fichiers (fichiers cachés et fichiers système)

 

Phase 3 : nettoyage simple du système (fichiers/dossiers inutiles), examen antivirus, désinstallation d'Antivir, redémarrage en mode normal, installation et utilisation d'HijackThis

 

Phase 4 : envoi du rapport HijackThis pour analyse

 

Le rapport antivirus donne:

 

 

 

AntiVir PersonalEdition Classic

Report file date: mardi 19 septembre 2006 21:16

 

Scanning for 505020 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-WURGE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Personnel

Computer name: MAISON

 

Version information:

AVSCAN.EXE : 7.0.0.47 200744 21/08/2006 16:06:56

AVSCAN.DLL : 7.0.0.45 41000 07/09/2006 16:56:33

LUKE.DLL : 7.0.0.47 118824 07/09/2006 16:32:33

LUKERES.DLL : 7.0.0.47 9256 07/09/2006 16:56:33

ANTIVIR0.VDF : 6.35.0.1 7371264 31/05/2006 16:35:27

ANTIVIR1.VDF : 6.36.0.9 1424384 06/09/2006 13:12:24

ANTIVIR2.VDF : 6.36.0.14 122368 13/09/2006 23:06:41

ANTIVIR3.VDF : 6.36.0.43 54272 19/09/2006 23:06:41

AVEWIN32.DLL : 7.2.0.16 1835520 19/09/2006 23:06:41

AVPREF.DLL : 7.0.0.2 23592 24/07/2006 18:36:04

AVREP.DLL : 6.36.0.5 806952 19/09/2006 23:06:41

AVRPBASE.DLL : 7.0.0.0 2162728 30/03/2006 14:43:31

AVPACK32.DLL : 7.2.0.0 368680 21/07/2006 12:00:28

AVREG.DLL : 6.31.0.90 27688 28/07/2005 16:06:36

NETNT.DLL : 6.32.0.0 6696 27/09/2005 13:56:49

NETNW.DLL : 7.0.0.0 9768 24/07/2006 18:35:55

RCIMAGE.DLL : 7.0.0.74 1642536 01/08/2006 17:22:57

RCTEXT.DLL : 7.0.0.107 77864 07/09/2006 16:56:32

 

Configuration settings for the scan:

Jobname.......................: Manual Selection

Configuration file............: C:\Documents and Settings\All Users.WINDOWS.2\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Boot sectors..................: C,E

Scan memory...................: 1

Process scan..................: 1

Scan all files................: 1

Scan archives.................: 1

Recursion depth...............: 20

Smart extensions..............: 1

Skipped archive types.........: 1000,1001,1002,1003,1004,1005,

Macro heuristic...............: 1

File heuristic................: 2

Primary action................: 1

Secondary action..............: 0

 

Start of the scan: mardi 19 septembre 2006 21:16

 

 

The scan of running processes will be started

4 Processes were scanned

 

Start scanning boot sectors:

 

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'E:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( 33 files ).

 

 

Starting the file scan:

 

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\7b30d722afb49\auupdate.exe

[WARNING] The file could not be opened!

C:\7b30d722afb49\copymar.exe

[WARNING] The file could not be opened!

C:\7b30d722afb49\custdial.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\dw.exe

[WARNING] The file could not be opened!

C:\7b30d722afb49\highcont.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\licwmi.mfl

[WARNING] The file could not be opened!

C:\7b30d722afb49\logonmgr.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\lvback.gif

[WARNING] The file could not be opened!

C:\7b30d722afb49\mail.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\manifest.xml

[WARNING] The file could not be opened!

C:\7b30d722afb49\market.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\msdbx.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msmom.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msn.inf

[WARNING] The file could not be opened!

C:\7b30d722afb49\msn36.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\msn6.exe

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnmetal.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnmigr.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnmtllc.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnntmig.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnspell.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnunin.exe

[WARNING] The file could not be opened!

C:\7b30d722afb49\msnupgrd.inf

[WARNING] The file could not be opened!

C:\7b30d722afb49\mstsc.chm

[WARNING] The file could not be opened!

C:\7b30d722afb49\popc.dll

[WARNING] The file could not be opened!

C:\7b30d722afb49\privacy.hta

[WARNING] The file could not be opened!

C:\7b30d722afb49\secdrv.sys

[WARNING] The file could not be opened!

C:\7b30d722afb49\signup.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\themedef.mar

[WARNING] The file could not be opened!

C:\7b30d722afb49\Thumbs.db

[WARNING] The file could not be opened!

C:\7b30d722afb49\type.wav

[WARNING] The file could not be opened!

C:\7b30d722afb49\ui.mar

[WARNING] The file could not be opened!

C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft\Crypto\RSA\MachineKeys\511a0f3f9e960fa97de3d0b74adfc574_1c549cae-24b0-41b7-9e31-83d8f6f6351c

[WARNING] The file could not be opened!

C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft\Crypto\RSA\MachineKeys\82d4293e8d9ad30a227205abeac17954_1c549cae-24b0-41b7-9e31-83d8f6f6351c

[WARNING] The file could not be opened!

C:\Documents and Settings\NetworkService.AUTORITE NT.001\NTUSER.DAT

[WARNING] The file could not be opened!

C:\Documents and Settings\NetworkService.AUTORITE NT.001\ntuser.dat.LOG

[WARNING] The file could not be opened!

C:\Documents and Settings\NetworkService.AUTORITE NT.001\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

[WARNING] The file could not be opened!

C:\Documents and Settings\NetworkService.AUTORITE NT.001\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG

[WARNING] The file could not be opened!

C:\Documents and Settings\Personnel.MAISON\ntuser.dat

[WARNING] The file could not be opened!

C:\Documents and Settings\Personnel.MAISON\ntuser.dat.LOG

[WARNING] The file could not be opened!

C:\Documents and Settings\Personnel.MAISON\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat

[WARNING] The file could not be opened!

C:\Documents and Settings\Personnel.MAISON\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\crypt32.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\cryptsvc.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\hh.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\hhctrl.ocx

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\hhsetup.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\html32.cnv

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\itss.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\locator.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\magnify.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\migwiz.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\mrxsmb.sys

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\msconv97.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\narrator.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\newdev.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\ntdll.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\ntkrnlpa.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\ntoskrnl.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\ole32.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\osk.exe

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\pchshell.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\raspptp.sys

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\rpcrt4.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\rpcss.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\shell32.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\shmedia.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\srrstr.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\srv.sys

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\sysmain.sdb

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\user32.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\win32k.sys

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\winsrv.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB826939$\zipfldr.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB828035$\wkssvc.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\expsrv.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msexch40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msexcl40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msjet40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msjetoledb40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msjint40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msjter40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msjtes40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msltus40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\mspbde40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msrd2x40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msrd3x40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msrepl40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\mstext40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\mswdat10.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\mswstr10.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\msxbde40.dll

[WARNING] The file could not be opened!

C:\WINDOWS.1a\$NtUninstallKB829558$\vbajet32.dll

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\EGACCESS.dll

[DETECTION] Contains signature of the dial-up program DIAL/EDGACCESS.1

[iNFO] The file was moved to '45521c53.qua'!

C:\WINDOWS.2\system32\config\default

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\DEFAULT.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SAM

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SAM.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SECURITY

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SECURITY.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\software

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SOFTWARE.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\system

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\config\SYSTEM.LOG

[WARNING] The file could not be opened!

C:\WINDOWS.2\system32\drivers\atapi.sys

[WARNING] The file could not be opened!

 

 

End of the scan: mercredi 20 septembre 2006 07:50

Used time: 10:34:13 min

 

The scan has been canceled!

 

10255 Scanning directories

328613 Files were scanned

1 viruses and/or unwanted programs were found

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

3927 Archives were scanned

105 Warnings

2 Notes

 

Le rapport Hijackthis donne :

 

Logfile of HijackThis v1.99.1

Scan saved at 06:05:11, on 21/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS.2\System32\smss.exe

C:\WINDOWS.2\system32\winlogon.exe

C:\WINDOWS.2\system32\services.exe

C:\WINDOWS.2\system32\savedump.exe

C:\WINDOWS.2\system32\lsass.exe

C:\WINDOWS.2\system32\Ati2evxx.exe

C:\WINDOWS.2\system32\svchost.exe

C:\WINDOWS.2\System32\svchost.exe

C:\WINDOWS.2\system32\spoolsv.exe

C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSVC.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

C:\WINDOWS.2\system32\drivers\CDAC11BA.EXE

C:\WINDOWS.2\system32\DRIVERS\CDANTSRV.EXE

C:\WINDOWS.2\System32\CTSvcCDA.EXE

C:\Program Files\Fichiers communs\EPSON\eEBAPI\SAgent2.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS.2\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS.2\System32\ups.exe

C:\WINDOWS.2\System32\MsPMSPSv.exe

C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe

C:\WINDOWS.2\system32\Ati2evxx.exe

C:\WINDOWS.2\Explorer.EXE

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\WINDOWS.2\SOUNDMAN.EXE

C:\WINDOWS.2\system32\CTHELPER.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

E:\Programmes\itunes\iTunesHelper.exe

C:\WINDOWS.2\Logi_MwX.Exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\WINDOWS.2\system32\ICO.EXE

C:\WINDOWS.2\system32\FSRremoS.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS.2\system32\Pelmiced.exe

C:\WINDOWS.2\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe

C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe

C:\WINDOWS.2\system32\wuauclt.exe

E:\Programmes\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS.2\UpdReg.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.2\system32\NeroCheck.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [iTunesHelper] "E:\Programmes\itunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.2\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [instant Access] rundll32.exe EGACCESS4_1065.dll,InstantAccess

O4 - Global Startup: APC UPS Status.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.2\System32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab

O16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt3_x.cab

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...ab?946796524703

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1158437226671

O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab

O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f011.mail.caramail.lycos.fr/app/upl...ileUploader.cab

O16 - DPF: {CB5D474E-A510-40A4-B5A4-838933BCBA64} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1065_XP.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{62BA3503-41A0-453C-82F0-E567EE435F41}: NameServer = 80.10.246.130 80.10.246.3

O18 - Filter: application/xhtml+xml - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll

O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll

O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.2\SYSTEM32\WgaLogon.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe" -z (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS.2\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS.2\system32\ati2sgag.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS.2\system32\drivers\CDAC11BA.EXE

O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS.2\system32\DRIVERS\CDANTSRV.EXE

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS.2\System32\CTSvcCDA.EXE

O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\eEBAPI\eEBSVC.exe

O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\eEBAPI\SAgent2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe (file missing)

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS.2\system32\PsaSrv.exe (file missing)

O23 - Service: System Update (SUService) - Unknown owner - c:\program files\lenovo\system update\suservice.exe (file missing)

O23 - Service: tinc.vpn - Unknown owner - C:\Program.exe (file missing)

O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\Fichiers communs\Lenovo\Scheduler\tvtsched.exe (file missing)

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: Windows Log - Unknown owner - C:\WINDOWS.2\system32\nvsvcd.exe (file missing)

 

quelqu'un pourrait-il m'aider?

 

Merci

Jack_Burton Godlike Member

Jack_Burton

Posté(e)
Posté(e) (modifié)

Post a supprimer par la modération, merci

Modifié par Jack_Burton
Jack_Burton Godlike Member

Jack_Burton

Posté(e)
Posté(e) (modifié)

Bonjour,

 

Ton rapport montre des signes d'infection.

Nous allons procéder par étape.

 

Voila ce que tu vas faire pour le moment :

 

Prière d'imprimer ces instructions, ou de les coller dans un fichier texte pour lecture en mode Sans Échec.

 

Télécharge Brute Force Uninstaller (de Merijn).

Créé un nouveau dossier directement sur le C:\ et nomme-le BFU. Décompresse le fichier téléchargé dans ce nouveau dossier (C:\BFU)

 

FAIS UN CLIC-DROIT ICI et choisis "Enregistrer la cible sous..." afin de télécharger EGDACCESS.bfu (de Metallica). Sauvegarde dans le dossier créé (C:\BFU). **Note : si tu utlises Internet Explorer; lors de la sauvegarde, assure-toi que le champs "Type :" affiche "Tous les fichiers". Tu dois maintenant avoir deux fichiers dans le dossier C:\BFU : EGDACCESS.bfu et BFU.exe (très important).

 

Redémarre en mode Sans Échec : au redémarrage, tapote immédiatement la touche F8; tu verras un écran avec choix de démarrages apparaître. Utilisant les flèches du clavier, choisis "Mode Sans Échec" et valide avec "Entrée". Choisis ton compte usuel, et non Administrateur.

 

Démarre le "Brute Force Uninstaller" en double-cliquant BFU.exe (du dossier C:\BFU)

 

- Clique sur le petit dossier jaune, à la droite de la boîte Scriptline to execute, et double-clique sur :

 

EGDACCESS.bfu

 

- Dans la boîte "Scriptline to execute", tu devrais maintenant voir ceci : C:\BFU\EGDACCESS.bfu

 

Clique sur Execute et laisse-le faire son travail.

 

Attendre que Complete script execution apparaîsse et clique sur OK.

Clique Exit pour fermer le programme BFU.

 

Redémarre ton système et poste un nouveau rapport hijackthis.

Modifié par Jack_Burton
Jack_Burton Godlike Member

Jack_Burton

Posté(e)
Posté(e) (modifié)

Discussion doublon :

http://forum.zebulon.fr/index.php?showtopic=104640

 

Merci à la modération de fermer cette discussion.

Modifié par Jack_Burton

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...