Aller au contenu
  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Messages recommandés

Posté(e)

Bonjour,

 

J'ai le même problème avec mon PC (windows XP).

 

J'ai suivi les procédures à la lettre : installation ANTIVIR, scan en mode sans échec, installation de HijackThis...

 

Je vous communique les rapports pour que vous puissiez m'aider pour éradiquer ce malware...

 

En vous remerciant vivement de votre aide !

 

 

 

Copie de Antivir :

 

AntiVir PersonalEdition Classic

Report file date: vendredi 9 mars 2007 09:58

 

Scanning for 569934 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Pierrot

Computer name: PIERRE

 

Version information:

BUILD.DAT : 217 12749 Bytes 05/12/2006 17:00:00

AVSCAN.EXE : 7.0.3.2 208936 Bytes 05/12/2006 15:30:07

AVSCAN.DLL : 7.0.3.1 35880 Bytes 05/12/2006 16:00:22

LUKE.DLL : 7.0.3.2 143400 Bytes 31/10/2006 16:07:46

LUKERES.DLL : 7.0.2.0 9256 Bytes 05/12/2006 16:00:22

ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 15:30:06

ANTIVIR1.VDF : 6.36.1.24 2212864 Bytes 14/11/2006 09:12:08

ANTIVIR2.VDF : 6.36.1.113 221696 Bytes 01/12/2006 09:12:12

ANTIVIR3.VDF : 6.37.0.3 6144 Bytes 01/12/2006 09:12:14

AVEWIN32.DLL : 7.3.0.15 1982976 Bytes 04/12/2006 17:18:38

AVPREF.DLL : 7.0.2.0 23592 Bytes 03/11/2006 10:53:44

AVREP.DLL : 6.37.0.3 983080 Bytes 01/12/2006 09:05:52

AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30/03/2006 08:43:31

AVPACK32.DLL : 7.2.0.5 368680 Bytes 23/10/2006 15:21:31

AVREG.DLL : 7.0.1.1 30760 Bytes 23/10/2006 10:52:27

NETNT.DLL : No Information!

RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 08/11/2006 12:26:26

RCTEXT.DLL : 7.0.12.1 77864 Bytes 05/12/2006 16:00:21

 

Configuration settings for the scan:

Jobname..........................: Local Drives

Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldrives.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: E:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Skipped archive types............: BSD Mailbox, Netscape/Mozilla Mailbox, Eudora Mailbox, Squid cache, Pegasus Mailbox, MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: high

Expanded search settings.........: 0x00007000

 

Start of the scan: vendredi 9 mars 2007 09:58

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Modules have been scanned

Scan process 'avcenter.exe' - '1' Modules have been scanned

Scan process 'firefox.exe' - '1' Modules have been scanned

Scan process 'explorer.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'MsMpEng.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'lsass.exe' - '1' Modules have been scanned

Scan process 'services.exe' - '1' Modules have been scanned

Scan process 'winlogon.exe' - '1' Modules have been scanned

Scan process 'csrss.exe' - '1' Modules have been scanned

Scan process 'smss.exe' - '1' Modules have been scanned

13 processes with 13 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'F:\'

[NOTE] In the drive 'F:\' no data medium is inserted!

Boot sector 'G:\'

[NOTE] In the drive 'G:\' no data medium is inserted!

Boot sector 'H:\'

[NOTE] In the drive 'H:\' no data medium is inserted!

Boot sector 'I:\'

[NOTE] In the drive 'I:\' no data medium is inserted!

Boot sector 'K:\'

[NOTE] In the drive 'K:\' no data medium is inserted!

 

Starting to scan the registry.

The registry was scanned ( 31 files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Pierrot\Bureau\Jeux\jeu-517-pro_tennis_tour(2).ace

[0] Archive type: ACE

--> TENNIS\BLUEBYTE\GRAFIK\UBISTART

[WARNING] Error creating the file

--> TENNIS\BLUEBYTE\CGA.ABF

[WARNING] No further files can be extracted from this archive. The archive will be closed

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Pierrot\Bureau\Jeux\jeu-517-pro_tennis_tour(3).ace

[0] Archive type: ACE

--> TENNIS\BLUEBYTE\GRAFIK\UBISTART

[WARNING] Error creating the file

--> TENNIS\BLUEBYTE\CGA.ABF

[WARNING] No further files can be extracted from this archive. The archive will be closed

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Pierrot\Bureau\Jeux\jeu-517-pro_tennis_tour.ace

[0] Archive type: ACE

--> TENNIS\BLUEBYTE\GRAFIK\UBISTART

[WARNING] Error creating the file

--> TENNIS\BLUEBYTE\CGA.ABF

[WARNING] No further files can be extracted from this archive. The archive will be closed

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Program Files\SoftwareOnline\soproc.exe

[DETECTION] Is the Trojan horse TR/Dldr.Ifsob

[iNFO] The file was deleted!

Begin scan in 'F:\' <C:\>

The path F:\ could not be found!

Le périphérique n'est pas prêt.

 

Begin scan in 'G:\' <F:\>

The path G:\ could not be found!

Le périphérique n'est pas prêt.

 

Begin scan in 'H:\' <G:\>

The path H:\ could not be found!

Le périphérique n'est pas prêt.

 

Begin scan in 'I:\' <H:\>

The path I:\ could not be found!

Le périphérique n'est pas prêt.

 

Begin scan in 'K:\' <I:\>

The path K:\ could not be found!

Le périphérique n'est pas prêt.

 

Begin scan in 'D:\' <TR5>

Begin scan in 'E:\' <D:\>

The path E:\ could not be found!

Le périphérique n'est pas prêt.

 

 

 

End of the scan: vendredi 9 mars 2007 12:35

Used time: 2:36:53 min

 

The scan has been done completely.

 

7413 Scanning directories

283019 Files were scanned

1 viruses and/or unwanted programs were found

1 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

283018 Files not concerned

4667 Archives were scanned

21 Warnings

2 Notes

 

 

Rapport HijackThis :

Logfile of HijackThis v1.99.1

Scan saved at 13:29:58, on 09/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\brsvc01a.exe

C:\WINDOWS\System32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\WINDOWS\ALCMTR.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\MyCash\IEFilter\MyCashIESvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Club-Internet\Le Compagnon Club\bin\lecompagnonclub.exe

C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Pierre\pierre1.exe.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/french

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = HTTP=proxy.club-internet.fr:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {0EE16FDA-348C-45D5-80BE-1954CD397F2A} - C:\PROGRA~1\MyCash\IEFilter\MyCashIE.dll

O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [EPSON Stylus DX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_S8B.tmp" /EF "HKLM"

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\CLUB-I~1\LECOMP~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

O4 - HKCU\..\Run: [MyCash IE Service] C:\Program Files\MyCash\IEFilter\MyCashIESvc.exe

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - Global Startup: LE COMPAGNON CLUB.lnk = C:\Program Files\Club-Internet\Le Compagnon Club\bin\matcli.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab

O16 - DPF: {59514505-D207-11D5-8D11-000102B211C7} (ActiveFormX Contrôle) - http://217.195.22.242/iShop_injector/PDownLoadActiveX.ocx

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1168120513812

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...