probleme infection

[thomasttt]

Desolé pour le retard mais je suis parti en week end et ainsi n'ai pas eu le temps de repondre plus tot.Voici ce que tu m'as demandé :

 

spyweeper :

 

21:57: Traces Found: 1

21:57: Custom Sweep has completed. Elapsed time 00:37:49

21:57: File Sweep Complete, Elapsed Time: 00:36:50

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_6.vob]

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_8.vob]

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_7.vob]

21:57: Warning: Failed to access drive H:

21:57: Warning: Failed to access drive G:

21:57: Warning: Failed to access drive F:

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_4.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_02_8.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_5.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_02_7.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_2.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_02_6.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_0.vob]

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_1.vob]

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_02_3.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_02_5.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\vts_02_4.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\vts_02_3.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\vts_02_2.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\vts_02_1.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\vts_01_0.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_02_0.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: AntiVirus engine returned [File Corrupted] on [e:\video_ts\video_ts.vob]

21:57: Warning: Failed to read file "e:\video_ts\vts_01_1.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\vts_01_0.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:57: Warning: Failed to read file "e:\video_ts\video_ts.vob". Erreur de protection contre la copie - la lecture a échoué car le secteur est crypté

21:51: edonkey2000 betamaster patch.exe (ID = 0)

21:51: Found Troj/WGAPatch-A: Troj/WGAPatch-A

21:48: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\enu\rdrmsgenu.pdf]

21:41: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\rdrmsgsplash.pdf]

21:33: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\websearch\websearchenu.pdf]

21:32: Warning: AntiVirus engine returned [File Encrypted] on [c:\program files\adobe\acrobat 7.0\reader\messages\fra\rdrmsgfra.pdf]

21:20: Warning: AntiVirus engine returned [Access Denied] on [c:\pagefile.sys]

21:20: Starting File Sweep

21:20: Warning: Failed to access drive A:

21:20: Cookie Sweep Complete, Elapsed Time: 00:00:00

21:20: Starting Cookie Sweep

21:20: Registry Sweep Complete, Elapsed Time:00:00:06

21:20: Starting Registry Sweep

21:20: Memory Sweep Complete, Elapsed Time: 00:00:39

21:19: Starting Memory Sweep

21:19: Sweep initiated using definitions version 841

21:19: Spy Sweeper 5.2.3.2138 started

21:19: | Start of Session, vendredi 19 janvier 2007 |

********

21:19: | End of Session, vendredi 19 janvier 2007 |

21:19: Program Version 5.2.3.2138 Using Spyware Definitions 841

21:19: Informational: Loaded AntiVirus Engine: 2.41.0; SDK Version: 4.13; Virus Definitions: 18/01/2007 06:34:56 (GMT)

21:04: Your virus definitions have been updated.

21:04: Informational: Loaded AntiVirus Engine: 2.41.0; SDK Version: 4.13; Virus Definitions: 18/01/2007 06:34:56 (GMT)

21:04: Your spyware definitions have been updated.

Keylogger: Off

BHO Shield: On

IE Security Shield: On

Alternate Data Stream (ADS) Execution Shield: On

Startup Shield: On

Common Ad Sites: Off

Hosts File Shield: On

Internet Communication Shield: On

ActiveX Shield: On

Windows Messenger Service Shield: On

IE Favorites Shield: On

Spy Installation Shield: On

Memory Shield: On

IE Hijack Shield: On

IE Tracking Cookies Shield: Off

20:54: Shield States

20:54: Spyware Definitions: 816

20:54: Spy Sweeper 5.2.3.2138 started

20:52: Automated check for program update in progress.

Keylogger: Off

BHO Shield: On

IE Security Shield: On

Alternate Data Stream (ADS) Execution Shield: On

Startup Shield: On

Common Ad Sites: Off

Hosts File Shield: On

Internet Communication Shield: On

ActiveX Shield: On

Windows Messenger Service Shield: On

IE Favorites Shield: On

Spy Installation Shield: On

Memory Shield: On

IE Hijack Shield: On

IE Tracking Cookies Shield: Off

20:51: Shield States

20:51: Spyware Definitions: 816

20:51: Warning: Virus definitions files are invalid, please update your virus definitions. 220

20:51: Spy Sweeper 5.2.3.2138 started

20:51: Spy Sweeper 5.2.3.2138 started

20:51: | Start of Session, vendredi 19 janvier 2007 |

********

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 00:05:53, on 20/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\Thomas\Bureau\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install

O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [nTrayFw] "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE" /FU "C:\WINDOWS\TEMP\E_S91.tmp" /EF "HKLM"

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [MP10_EnsureFileVer] "C:\WINDOWS\inf\unregmp2.exe" /EnsureFileVersions

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

O4 - Global Startup: Activer le Poste de Travail Sans Fil Labtec.lnk = C:\Program Files\Poste de Travail Sans Fil Labtec\MagicKey.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll

O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} - http://f011.mail.caramail.lycos.fr/app/upl...ileUploader.cab

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: Moteur Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

[regis56]

Bonjour thomasttt !

 

Bien !

 

Continu comme ceci STP :

 

Peux-tu faire s'il te plait un scan en ligne?=>

-Faire un scan en ligne ici et coller le rapport.

Panda si tu n'y arrives pas : tutorial

 

A plus.

[thomasttt]

Voici le rapport du scan en ligne de panda :

 

 

Incident Statut Analyse

 

Virus:Trj/Rizalof.HZ Désinfecté C:\Documents and Settings\Thomas\Mes documents\{9DF687E7-381C-4882-A05F-4ADF1DD53394}\2000 Downloads\Security Suite 2006 CRACK + SERIAL KEYGEN.exe

Virus:Trj/Rizalof.HZ Désinfecté C:\Documents and Settings\Thomas\Mes documents\{9DF687E7-381C-4882-A05F-4ADF1DD53394}\2000 Downloads\ZONEALARM INTERNET SECURITY SUITE 2006 + CRACK + ACTIVATOR.exe

Virus:Trj/Rizalof.HZ Désinfecté C:\Documents and Settings\Thomas\Mes documents\{9DF687E7-381C-4882-A05F-4ADF1DD53394}\2000 Downloads\ZoneAlarm Internet Security Suite 2006 CRACK + SERIAL KEYGEN.exe

[regis56]

Bonsoir thomasttt !

 

Le crack !!

 

C'est tu que Zone alarme est gratuit !! pas besoin de le cracker !

 

Fais ceci STP

 

C:\Documents and Settings\Thomas\Mes documents\{9DF687E7-381C-4882-A05F-4ADF1DD53394}\2000 Downloads\Security Suite 2006 CRACK + SERIAL KEYGEN.exe <= supprime le fichier !

 

Ensuite refais un scan ici STP

http://www.kaspersky.com/virusscanner

tuto d'aide ici

http://www.malekal.com/scan_Av_en_ligne.html

 

A plus.