URGENT - INFECTE PAR WIN32

maouss · le 19 avril 2007

Bonjour,

J'utilise avast et pourtant mon système est infecté par win32. Aidez-moi à m'en débarrasser. Ci-après mon rapport Hijackthis. Merci.

Logfile of HijackThis v1.99.1

Scan saved at 09:59 Nathalie, on 19/04/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\bittorrent.exe

C:\Program Files\CursorXP\CursorXP.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Kévin\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL

O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

O4 - HKLM\..\Run: [sunjavaupdatesched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKCU\..\Run: [cursorxp] "C:\Program Files\CursorXP\CursorXP.exe" -s

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [steam] "c:\valve\steam\steam.exe" -silent

O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &Search - http://ko.bar.need2find.com/KO/menusearch.html?p=KO

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: teleir_cert - https://static.ir.dgi.minefi.gouv.fr/secure...teleir_cert.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094998031104

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1158123758000

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe

O23 - Service: SC Test Branding Service 1 - SC Test Branding 1 - C:\Program Files\Fichiers communs\SC Test Branding 1 Shared\Service\SCTestService1.exe

bruce lee · le 19 avril 2007

Bonjour maouss,

Peux tu me dire le nom du fichier infecté s'il te plait ainsi que son emplacement (quel dossier)

@+

maouss · le 19 avril 2007

Je te joins le journal d'avast :

18/04/2007 10:58 Nathalie SYSTEM 1924 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\DOCUME~1\Nathalie\LOCALS~1\Temp\xnwisdtr.dll" file.

18/04/2007 10:58 Nathalie SYSTEM 1924 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\xnwisdtr.dll" file.

18/04/2007 11:32 Nathalie SYSTEM 1756 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\DOCUME~1\Nathalie\LOCALS~1\Temp\prmvymfs.dll" file.

18/04/2007 11:32 Nathalie SYSTEM 1756 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\prmvymfs.dll" file.

18/04/2007 11:58 Nathalie Nathalie 3516 Sign of "Win32:Rjump [Wrm]" has been found in "c:\windows\bittorrent.exe" file.

18/04/2007 12:00 Nathalie Nathalie 3736 Sign of "Win32:Rjump [Wrm]" has been found in "c:\windows\bittorrent.exe" file.

18/04/2007 12:04 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\qomgelhy.dll" file.

18/04/2007 12:04 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\qvuvdivk.dll" file.

18/04/2007 12:05 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\WINDOWS\system32\vespflix.dll" file.

18/04/2007 12:05 Nathalie Nathalie 3880 Sign of "Win32:BHO-BG [Trj]" has been found in "C:\WINDOWS\system32\uaslcqqy.dll" file.

18/04/2007 12:05 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\tqtobjft.dll" file.

18/04/2007 12:06 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\aamhfbmj.dll" file.

18/04/2007 12:11 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\rngutbof.dll" file.

18/04/2007 12:11 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\rwgntlpo.exe" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\wubuxdug.exe" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\rduqidvw.exe" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\bbwrmfeg.dll" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\amsplwms.exe" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\epxuitdk.dll" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\yekcelya.dll" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\jxaqgekw.exe" file.

18/04/2007 12:12 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\ludugqmi.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\xnbjmaqd.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\ifmxpffe.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\csilrgux.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\txwrvxsd.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\pujgeipj.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\dbmusjpd.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\WINDOWS\system32\qgogwmjp.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\WINDOWS\system32\poxbhnvg.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\lyknvwjm.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\noohfjgr.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\pbgpoxgu.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\yeygysxm.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\ccakbabl.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\deanxxhi.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\eioljopn.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\WINDOWS\system32\gvrdesrj.exe" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\coniauho.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\prvluydh.dll" file.

18/04/2007 12:13 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\dwmtkkfv.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\tnoueehr.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\vtwxvjdw.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\jmgvjbdt.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\gsbycapn.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\xnwisdtr.dll" file.

18/04/2007 12:14 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\WINDOWS\system32\prmvymfs.dll" file.

18/04/2007 12:22 Nathalie Nathalie 3880 Sign of "Win32:Rjump [Wrm]" has been found in "C:\WINDOWS\bittorrent.exe" file.

18/04/2007 13:01 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\Documents and Settings\Jean-Michel\Local Settings\Temp\yuolonpd.dll" file.

18/04/2007 13:56 Nathalie Nathalie 3880 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Yohan\Local Settings\Temp\4\cdn.dll" file.

18/04/2007 13:56 Nathalie Nathalie 3880 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\Yohan\Local Settings\Temp\4\cdnaux.dll" file.

18/04/2007 14:11 Nathalie SYSTEM 1756 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\DOCUME~1\Nathalie\LOCALS~1\Temp\tqdulfpx.dll" file.

18/04/2007 14:22 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Documents and Settings\Lou\Local Settings\Temp\jptggwsu.exe" file.

18/04/2007 14:22 Nathalie Nathalie 3880 Sign of "Win32:Trojano-1165 [Trj]" has been found in "C:\Documents and Settings\Kévin.SALLEÀMANGER\Local Settings\Temp\WER60a2.dir00\iexplore.exe.hdmp" file.

18/04/2007 15:12 Nathalie Nathalie 3880 Sign of "Win32:Rjump [Wrm]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP815\A0201946.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208205.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208206.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208207.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:BHO-BG [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208208.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208209.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208210.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208211.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208212.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208213.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208214.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208215.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208216.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208217.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208218.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208219.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208220.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208221.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208222.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208223.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208224.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208225.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208226.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208227.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:BHO-BS [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208228.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208229.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208230.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208231.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208232.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208233.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208234.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208235.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208236.exe" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208237.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208238.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208239.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208240.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208241.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208242.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208243.dll" file.

18/04/2007 15:16 Nathalie Nathalie 3880 Sign of "Win32:VBStat-C [Trj]" has been found in "C:\System Volume Information\_restore{C3469B3C-22F0-4A76-8B3B-F11115B6BF29}\RP844\A0208244.dll" file.

bruce lee · le 19 avril 2007

Re,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer
Clique sur le bouton Scan for Vundo
Lorsque le scan est complété, clique sur le bouton Remove Vundo
Une invite te demandera si tu veux supprimer les fichiers, clique YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
Copie/colle le contenu du rapport situé dans C:\vundofix.txt

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

==> Télécharge navilog1.zip (de IL-MAFIOSO) http://perso.orange.fr/il.mafioso/Navifix/navilog1.zip enregistre ce fichier sur le bureau.

Extraie la totalité de navilog1.zip sur le bureau

==> double clic sur navilog1.bat choisis l'option 1 appuie sur la touche Entrée.

Laisse le scan se dérouler, ne touche pas à la souris et au clavier.

Le scan fini un rapport portant ce fixnavi.txt souvrira poste le contenu de ce rapport.

Si le résultat du scan ne s'affiche pas tu le trouvera dans C:\fixnavi.txt.

Télécharge Deckard's System Scanner http://deckard.geekstogo.com/dss.exe sur ton bureau

Ferme toutes les applications en cours

Doublie clique sur dss.exe. Tu auras deux messages qui vont apparaitre à l'écran, clique sur OK pour les deux.

Sois patient, le scan peut être long.

A la fin tu auras de nouveau un message disant que bloc-notes va s'ouvrir clique sur OK puis fais un copier/coller de tout son contenu.

Modifié le 19 avril 2007 par bruce lee

maouss · le 19 avril 2007

J'ai effectué les manips demandées. Ci-après tous les "rapports" collectés : Bon courage !

VundoFix V6.3.19

Checking Java version...

Java version is 1.4.2.1

Old versions of java are exploitable and should be removed.

Java version is 1.4.2.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 13:15:00 Nathalie 19/04/2007

Listing files found while scanning....

C:\WINDOWS\system32\eksjllcr.dll

C:\WINDOWS\system32\fhkmp.bak1

C:\WINDOWS\system32\fhkmp.bak2

C:\WINDOWS\system32\fhkmp.ini

C:\WINDOWS\system32\fhkmp.ini2

C:\WINDOWS\system32\fhkmp.tmp

C:\WINDOWS\system32\hjkkj.ini

C:\WINDOWS\system32\hswcslvm.dll

C:\WINDOWS\system32\jkkjh.dll

C:\WINDOWS\system32\jrtgioea.dll

C:\WINDOWS\system32\kkymlmfx.dll

C:\WINDOWS\system32\nvqnvdlp.dll

C:\WINDOWS\system32\pmkhf.dll

C:\WINDOWS\system32\qghhyhsk.dll

C:\WINDOWS\system32\qupcxfly.dll

C:\WINDOWS\system32\roipxblw.ini

C:\WINDOWS\system32\ssneydkh.dll

C:\WINDOWS\system32\tgrvknsa.dll

C:\WINDOWS\system32\tvbauxyp.dll

C:\WINDOWS\system32\ugdsrvno.dll

C:\WINDOWS\system32\vtustsr.dll

C:\WINDOWS\system32\wlbxpior.dll

C:\WINDOWS\system32\xfmlmykk.ini

Beginning removal...

Attempting to delete C:\WINDOWS\system32\eksjllcr.dll

C:\WINDOWS\system32\eksjllcr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\fhkmp.bak1

C:\WINDOWS\system32\fhkmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\fhkmp.bak2

C:\WINDOWS\system32\fhkmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\fhkmp.ini

C:\WINDOWS\system32\fhkmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\fhkmp.ini2

C:\WINDOWS\system32\fhkmp.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\fhkmp.tmp

C:\WINDOWS\system32\fhkmp.tmp Has been deleted!

Attempting to delete C:\WINDOWS\system32\hjkkj.ini

C:\WINDOWS\system32\hjkkj.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\jkkjh.dll

C:\WINDOWS\system32\jkkjh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jrtgioea.dll

C:\WINDOWS\system32\jrtgioea.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kkymlmfx.dll

C:\WINDOWS\system32\kkymlmfx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nvqnvdlp.dll

C:\WINDOWS\system32\nvqnvdlp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmkhf.dll

C:\WINDOWS\system32\pmkhf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qghhyhsk.dll

C:\WINDOWS\system32\qghhyhsk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\qupcxfly.dll

C:\WINDOWS\system32\qupcxfly.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\roipxblw.ini

C:\WINDOWS\system32\roipxblw.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssneydkh.dll

C:\WINDOWS\system32\ssneydkh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tgrvknsa.dll

C:\WINDOWS\system32\tgrvknsa.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ugdsrvno.dll

C:\WINDOWS\system32\ugdsrvno.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wlbxpior.dll

C:\WINDOWS\system32\wlbxpior.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xfmlmykk.ini

C:\WINDOWS\system32\xfmlmykk.ini Has been deleted!

Performing Repairs to the registry.

Done!

Search Navipromo version 1.1.5 commencé le 19/04/2007 à 14:02:18,07

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!

!!! Poster ce rapport sur le forum pour le faire analyser !!!

!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Documents and Settings\Nathalie\Bureau

Mise a jour le 13.04.2007 a 20h00 by IL-MAFIOSO

Executé en mode normal

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\Nathalie\Application Data ***

*** Recherche avec BlackLight Engine/F-secure ***

BlackLight Engine est un produit de F-secure, pour + d'infos :

http://www.f-secure.com/blacklight/blacklight_help.html

F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR

======================================

This is a beta version. It will expire on 1st of April, 2007.

Version information: 2.2.1061.

[+] Started on 04/19/07 at 14:02:19.

[-] ERROR: F-Secure BlackLight could not acquire debug privileges.

[+] Exited on 04/19/07 at 14:02:19 (return code = 3).

*** Recherche fichiers ***

*** Recherche cles registre ***

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]

Recherche dans [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage]

Recherche Clé Magic Control

*** Module de Recherche complémentaire ***

(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

2)Recherche Heuristique :

*

**

C:\WINDOWS\system32\bfpzneuw.dat trouvé !

***

****

*****

******

*******

********

*** Analyse Terminé le 19/04/2007 à 14:02:34,57 ***

Deckard's System Scanner v20070411.38

Run by Nathalie on 2007-04-19 at 14:04:52

Computer is in Normal Mode.

--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --

41: 2007-04-19 12:05:22 UTC - RP846 - Deckard's System Scanner Restore Point

40: 2007-04-18 20:35:48 UTC - RP845 - Point de vérification système

39: 2007-04-17 19:36:28 UTC - RP844 - Point de vérification système

38: 2007-04-16 11:53:08 UTC - RP843 - Point de vérification système

37: 2007-04-15 11:33:08 UTC - RP842 - Point de vérification système

-- First Restore Point --

1: 2007-03-24 19:23:56 UTC - RP806 - Installation de pilote non signé

Backed up registry hives.

Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1

Scan saved at 2007-04-19 14:09:25

Platform: Windows XP Service Pack 2 (5.01.2600)

MSIE: Internet Explorer (7.0.5730.11)

Running processes:

C:\WINDOWS\system32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\drivers\KodakCCS.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\CursorXP\CursorXP.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Documents and Settings\Nathalie\Bureau\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

O2 - BHO: (no name) - {39F64A9C-963E-41A8-A7A6-0F785F2EAA78} - C:\WINDOWS\system32\kvugkhwp.dll

O2 - BHO: (no name) - {67C55A8D-E808-4caa-9EA7-F77102DE0BB6} - C:\WINDOWS\system32\ssneydkh.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7B278C59-AB49-4F36-8C33-4DC040DB1034} - C:\WINDOWS\system32\kvugkhwp.dll

O2 - BHO: (no name) - {7BF9F18C-E294-45E7-BCCB-9FDC9E9AC3EB} - C:\WINDOWS\system32\pmkhf.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)

O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

O2 - BHO: (no name) - {D80C4E21-C346-4E21-8E64-20746AA20AEB} - (no file)

O2 - BHO: (no name) - {E861E125-5ECA-40C8-A503-0CED98ABF7E5} - C:\WINDOWS\system32\kvugkhwp.dll

O2 - BHO: (no name) - {F278BBB7-EF6E-4018-AC6F-CF66CA4F25F9} - C:\WINDOWS\system32\kvugkhwp.dll

O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll

O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

O4 - HKLM\..\Run: [sunjavaupdatesched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [soundman] SOUNDMAN.EXE

O4 - HKLM\..\Run: [disk monitor] c:\program files\generic\usb card reader driver v1.9e3\disk_monitor.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [soft help more eq] C:\Documents and Settings\All Users\Application Data\DefaultGramSoftHelp\Remotedrv.exe

O4 - HKLM\..\Run: [soundService] rundll32.exe "C:\WINDOWS\system32\kkymlmfx.dll",setvm

O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\wlbxpior.dll",setvm