[RÉSOLU]---Analyse rapports HijackThis,

[Sacros]

Bonjour............

 

Très bien le nouveau portail...........Bravo

 

Besoin d'aide pour HijackThis et problème viral. SVP.

Bon, j'ai trouvé deux bestioles avec avira antivir:

 

Une ( SPR/Tool.Reboot) mise HS en quarantaine et tué (4689bo20.qua)

l'autre en quarantaine chez antivir (SPR/Tool.Hardoff.A)

 

Je vous mets le rapport Scan AntiVir fait en mode sans échec, et le rapport Hijack fait après.

 

En vous remerciant d'avance de bien vouloir prendre sur votre temps pour analyser mon problème.

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

AntiVir PersonalEdition Classic

Report file date: samedi 14 avril 2007 12:43

 

Scanning for 738217 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Sacros

Computer name: DOMBIS

 

Version information:

BUILD.DAT : 217 12749 Bytes 05/12/2006 17:00:00

AVSCAN.EXE : 7.0.3.5 208936 Bytes 08/03/2007 09:19:45

AVSCAN.DLL : 7.0.3.1 35880 Bytes 05/12/2006 16:00:22

LUKE.DLL : 7.0.3.2 143400 Bytes 31/10/2006 16:07:46

LUKERES.DLL : 7.0.2.0 9256 Bytes 05/12/2006 16:00:22

ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 15:30:06

ANTIVIR1.VDF : 6.37.1.151 4303360 Bytes 23/02/2007 09:19:47

ANTIVIR2.VDF : 6.38.0.214 729600 Bytes 12/04/2007 13:40:40

ANTIVIR3.VDF : 6.38.0.218 19968 Bytes 13/04/2007 13:40:40

AVEWIN32.DLL : 7.3.1.50 2400768 Bytes 11/04/2007 13:39:55

AVPREF.DLL : 7.0.2.0 23592 Bytes 03/11/2006 10:53:44

AVREP.DLL : 6.38.0.210 1232936 Bytes 12/04/2007 13:41:19

AVRPBASE.DLL : 7.0.0.0 2162728 Bytes 30/03/2006 08:43:31

AVPACK32.DLL : 7.3.0.8 360488 Bytes 03/04/2007 08:14:14

AVREG.DLL : 7.0.1.2 30760 Bytes 08/03/2007 09:19:45

NETNT.DLL : No Information!

RCIMAGE.DLL : 7.0.1.3 2097192 Bytes 08/11/2006 12:26:26

RCTEXT.DLL : 7.0.12.1 77864 Bytes 05/12/2006 16:00:21

 

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: C:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: delete

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: J:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Skipped archive types............: BSD Mailbox, Netscape/Mozilla Mailbox, Eudora Mailbox, Squid cache, Pegasus Mailbox, MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: high

Different risk categories........: +GAME,+JOKE,+PCK,+SPR,

 

Start of the scan: samedi 14 avril 2007 12:43

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Modules have been scanned

Scan process 'avcenter.exe' - '1' Modules have been scanned

Scan process 'ctfmon.exe' - '1' Modules have been scanned

Scan process 'explorer.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'MsMpEng.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'svchost.exe' - '1' Modules have been scanned

Scan process 'lsass.exe' - '1' Modules have been scanned

Scan process 'services.exe' - '1' Modules have been scanned

Scan process 'winlogon.exe' - '1' Modules have been scanned

Scan process 'csrss.exe' - '1' Modules have been scanned

Scan process 'smss.exe' - '1' Modules have been scanned

13 processes with 13 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

Boot sector 'E:\'

[NOTE] No virus was found!

Boot sector 'J:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( 19 files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <DISK>

C:\pagefile.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <Disque 40G >

Begin scan in 'E:\' <DISKOBIS>

E:\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Reboot.exe

[DETECTION] Contains signature of the SPR/Tool.Reboot.C program

--> SmitfraudFix\restart.exe

[DETECTION] Contains signature of the SPR/Tool.Hardoff.A program

[iNFO] The file was moved to '4689be20.qua'!

Begin scan in 'J:\' <MINUS USB>

 

 

End of the scan: samedi 14 avril 2007 13:51

Used time: 1:07:47 min

 

The scan has been done completely.

 

3687 Scanning directories

350353 Files were scanned

2 viruses and/or unwanted programs were found

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

350351 Files not concerned

1758 Archives were scanned

1 Warnings

3 Notes

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

PS: SUPPRIMÉ LE DOSSIER (Smitfraudfix)

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Logfile of HijackThis v1.99.1

Scan saved at -- Ð --15:33:05, on 14/04/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\Windows Defender\MSASCui.exe

D:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe

E:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\PROGRA~1\Wanadoo\ComComp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\WINDOWS\system32\ntvdm.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\Wanadoo\Watch.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.google.fr/keyword/%s

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ---- Ð ----

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.3558\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe

O4 - HKLM\..\Run: [WinPatrol] D:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx

O4 - HKCU\..\Run: [Gadwin PrintScreen 3.5] E:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [AVG Anti-Spyware] E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

O4 - HKCU\..\Run: [ccleaner] "E:\Program Files\CCleaner\ccleaner.exe" /AUTO

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: MONITEUR.EXE.lnk = E:\olifaxvx\MONITEUR.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - C:\WINDOWS\web\OpenFrame.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} -

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -

O17 - HKLM\System\CCS\Services\Tcpip\..\{1076C0CB-272F-427E-B59C-ED07D4CB387D}: NameServer = 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{54A7A52F-7054-45F2-BC8E-3527F0A67BBE}: NameServer = 192.168.1.1

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

 

Voilà ce que j'ai. Merci.......

Modifié le 14 avril 2007 par Sacros

[Malekal_morte]

Salut,

 

Ne pas en tenir compte.

[Sacros]

Bonsoir.......;

Merci Malekal_morte.

A toute l'équipe aussi....J'ai perdu le message d'une première réponse. Elle devait être pareil.

Salut.........

Ð