[Résolu] Virus sur mon PC

valouuu · le 2 septembre 2007

AntiVir PersonalEdition Classic

Report file date: dimanche 2 septembre 2007 21:11

Scanning for 1041381 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: User

Computer name: USER-PWJAIWOHNU

Version information:

BUILD.DAT : 247 14437 Bytes 10/05/2007 11:55:00

AVSCAN.EXE : 7.0.4.15 282664 Bytes 20/04/2007 11:37:16

AVSCAN.DLL : 7.0.4.4 33832 Bytes 27/03/2007 11:31:56

LUKE.DLL : 7.0.4.11 143400 Bytes 27/03/2007 11:26:06

LUKERES.DLL : 7.0.4.0 10280 Bytes 19/03/2007 11:19:00

ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 13:08:58

ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 10/07/2007 11:52:00

ANTIVIR2.VDF : 6.39.1.43 1542656 Bytes 25/08/2007 09:20:48

ANTIVIR3.VDF : 6.39.1.73 101376 Bytes 01/09/2007 18:22:46

AVEWIN32.DLL : 7.4.1.66 2789888 Bytes 30/08/2007 09:21:18

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:28

AVPREF.DLL : 7.0.2.1 24616 Bytes 27/03/2007 11:31:52

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 24/08/2007 11:52:02

AVREG.DLL : 7.0.1.2 31784 Bytes 15/03/2007 08:05:10

AVEVTLOG.DLL : 7.0.0.18 86056 Bytes 27/03/2007 11:16:06

AVARKT.DLL : 1.0.0.17 278568 Bytes 02/05/2007 10:32:28

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:44

RCIMAGE.DLL : 7.0.1.15 2228264 Bytes 13/03/2007 09:46:20

RCTEXT.DLL : 7.0.45.0 86056 Bytes 19/03/2007 11:42:44

Configuration settings for the scan:

Jobname..........................: Local Drives

Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldrives.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: A:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: dimanche 2 septembre 2007 21:11

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

12 processes with 12 modules were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'A:\'

[NOTE] In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.

The registry was scanned ( '27' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'A:\'

Search path A:\ could not be opened!

Erreur de données (contrôle de redondance cyclique).

End of the scan: dimanche 2 septembre 2007 21:42

Used time: 31:13 min

The scan has been done completely.

4566 Scanning directories

156532 Files were scanned

0 viruses and/or unwanted programs were found

0 classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

156532 Files not concerned

756 Archives were scanned

2 Warnings

0 Notes

0 Hidden objects were found

avec un petit rapport hijac pour completer le tout

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:55:55, on 02/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\a-squared Anti-Malware\a2service.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\OpiStat\OpiStat\OpiStat.exe

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\system32\tp4mon.exe

C:\WINDOWS\VM_STI.EXE

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\MpcStar\Codecs\QuickTime\QTSystem\qttask.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\OLITEC\Common\RaUI.exe

C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\TribalWeb.net\tribalweb.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.294\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.fr.netscape.com/fr/home/winsearch200.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://localhost:6080;https=http://localhost:6080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O4 - HKLM\..\Run: [OpiStat] C:\Program Files\OpiStat\OpiStat\OpiStat.exe

O4 - HKLM\..\Run: rundll32.exe C:\PROGRA~1\Thin k Pad\UTILIT~1\BatLogEx.DLL,S tartBattLog

O4 - H K LM\..\Run: [bMMMONWND] rundll32.exe C:\PROGRA~1\Thin k Pad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor

O4 - H K LM\..\Run: [bMMGAG] RunDll32 C:\PROGRA~1\Thin k Pad\UTILIT~1\pwrmonit.dll,S tartPwrMonitor

O4 - H K LM\..\Run: [Trac k Point S rv] tp4mon.exe

O4 - H K LM\..\Run: [bMMLREF] C:\Program File s \Thin k Pad\Utilitie s \BMMLREF.EXE

O4 - H K LM\..\Run: [bigDogPath] C:\WINDOW S \VM_S TI.EXE Philip s S PC 200NC PC Camera

O4 - H K LM\..\Run: [s unJavaUpdate S ched] "C:\Program File s \Java\jre1.6.0_02\bin\ju s ched.exe"

O4 - H K LM\..\Run: [Quic k Time Ta s k ] "C:\Program File s \Mpc S tar\Codec s \Quic k Time\QT S y s tem\qtta s k .exe" -atboottime

O4 - H K LM\..\Run: [Adobe Reader S peed Launcher] "C:\Program File s \Adobe\Reader 8.0\Reader\Reader_s l.exe"

O4 - H K LM\..\Run: [!AVG Anti-S pyware] "C:\Program File s \Gri s oft\AVG Anti-S pyware 7.5\avga s .exe" /minimized

O4 - H K LM\..\Run: [avgnt] "C:\Program File s \AntiVir Per s onalEdition Cla s s ic\avgnt.exe" /min

O4 - H K LM\..\Run: [a-s quared] "C:\Program File s \a-s quared Anti-Malware\a2guard.exe"

O4 - H K CU\..\Run: [CTFMON.EXE] C:\WINDOW S \s y s tem32\ctfmon.exe

O4 - H K CU\..\Run: [WIN S O S VERIFY] "C:\Program File s \WIN S O S \WIN S O S .EXE" MINI

O4 - H K CU\..\Run: [m s nm s gr] "C:\PROGRA~1\M S NME S ~1\m s nm s gr.exe" /bac k ground

O4 - H K U S \S -1-5-19\..\Run: [CTFMON.EXE] C:\WINDOW S \S y s tem32\CTFMON.EXE (U s er 'S ERVICE LOCAL')

O4 - H K U S \S -1-5-20\..\Run: [CTFMON.EXE] C:\WINDOW S \S y s tem32\CTFMON.EXE (U s er 'S ERVICE R É S EAU')

O4 - H K U S \S -1-5-18\..\Run: [CTFMON.EXE] C:\WINDOW S \S y s tem32\CTFMON.EXE (U s er 'S Y S TEM')

O4 - H K U S \.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOW S \S y s tem32\CTFMON.EXE (U s er 'Default u s er')

O4 - S tartup: TribalWeb.net.ln k = C:\Program File s \TribalWeb.net\tribalweb.exe

O4 - S tartup: TribalWeb.ln k = C:\Program File s \TribalWeb.net\tribalweb.exe

O4 - Global S tartup: Micro s oft Office.ln k = C:\Program File s \Micro s oft Office\Office\O S A9.EXE

O4 - Global S tartup: Moniteur re s eau 802.11g OLITEC.ln k = C:\Program File s \OLITEC\Common\RaUI.exe

O4 - Global S tartup: TrayMin300.exe.ln k = ?

O8 - Extra context menu item: Download all lin k s u s ing BitComet - re s ://C:\Program File s \BitComet\BitComet.exe/AddAllLin k .htm

O8 - Extra context menu item: Download all video s u s ing BitComet - re s ://C:\Program File s \BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: Download lin k u s ing &BitComet - re s ://C:\Program File s \BitComet\BitComet.exe/AddLin k .htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program File s \Java\jre1.6.0_02\bin\s s v.dll

O9 - Extra 'Tool s ' menuitem: Con s ole Java (S un) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program File s \Java\jre1.6.0_02\bin\s s v.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOW S \Networ k Diagno s tic\xpnetdiag.exe

O9 - Extra 'Tool s ' menuitem: @xp s p3re s .dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOW S \Networ k Diagno s tic\xpnetdiag.exe

O9 - Extra button: Me s s enger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program File s \Me s s enger\m s m s g s .exe

O9 - Extra 'Tool s ' menuitem: Window s Me s s enger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program File s \Me s s enger\m s m s g s .exe

O10 - Un k nown file in Win s oc k L S P: c:\window s \s y s tem32\nwprovau.dll

O14 - IERE S ET.INF: S TART_PAGE_URL=www.tele2internet.ch

O16 - DPF: Yahoo! MahJong S olitaire - http://download.game s .yahoo.com/game s /client s /y/mj s t4_x.cab

O16 - DPF: Yahoo! Po k er - http://download2.game s .yahoo.com/game s /client s /y/pt3_x.cab

O16 - DPF: Yahoo! Pyramid s - http://download.game s .yahoo.com/game s /client s /y/pyt1_x.cab

O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://s .tf1.fr/mmdia/s tatic/rawflow/clien...1.0/Rawflow.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (C K AVWeb S can Object) - http://web s canner.k a s per s k y.fr/k avweb s can_unicode.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YIn s t S tarter Cla s s ) - http://u s .dl1.yimg.com/download.yahoo.com/...n s t20040510.cab

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Total S can In s taller Cla s s ) - http://www.nano s can.com/a s /v1/cab s /a s c s tubie.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Game s Player) - http://game11.zylom.com/activex/zylomgame s player.cab

O23 - S ervice: a-s quared Anti-Malware S ervice (a2AntiMalware) - Em s i S oftware GmbH - C:\Program File s \a-s quared Anti-Malware\a2 s ervice.exe

O23 - S ervice: AntiVir Per s onalEdition Cla s s ic S cheduler (AntiVir S cheduler) - Avira GmbH - C:\Program File s \AntiVir Per s onalEdition Cla s s ic\s ched.exe

O23 - S ervice: AntiVir Per s onalEdition Cla s s ic Guard (AntiVir S ervice) - Avira GmbH - C:\Program File s \AntiVir Per s onalEdition Cla s s ic\avguard.exe

O23 - S ervice: AVG Anti-S pyware Guard - GRI S OFT s .r.o. - C:\Program File s \Gri s oft\AVG Anti-S pyware 7.5\guard.exe

O23 - S ervice: IBM PM S ervice (IBMPM S VC) - Un k nown owner - C:\WINDOW S \S y s tem32\ibmpm s vc.exe

O23 - S ervice: Window s Live S etup S ervice (WL S etup S vc) - Un k nown owner - C:\Program File s \Window s Live\in s taller\WL S etup S vc.exe

--

End of file - 8433 byte s

et voila

ca rame toujour s un peu alor s s i tu voi s quelque cho s e a eliminer

et encore merci merci merci vou s ete s formidable

derniere petite que s tion je garde quoi comme antiviru s et d'autre part e s t ce que je peux s upprimer tout ce que vou s m'avez fait telecharger?

encore merci merci merci

eclypse · le 3 septembre 2007

Salut

Ouvre hijackthis et coche

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\MpcStar\Codecs\QuickTime\QTSystem\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"

O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: TribalWeb.net.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe

O4 - Startup: TribalWeb.lnk = C:\Program Files\TribalWeb.net\tribalweb.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Moniteur reseau 802.11g OLITEC.lnk = C:\Program Files\OLITEC\Common\RaUI.exe

O4 - Global Startup: TrayMin300.exe.lnk = ?

Clique sur fix checked

Rends toi dans le panneau de config puis supprime

A-Squared
WINSOS

Regseeker

Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

Double clique

s

ur

Tool

s

Cleaner2.exe

> clique

s

ur

Extract

s

an

s

changer la de

s

tination initiale.
Ouvre le Po

s

te de Travail > ouvre le Lecteur

C:\[/g]
Ouvre le do

s

s

ier

Tool

s

Cleaner

.
Double clique

s

ur

Tool

s

Cleaner2.bat

et

s

ui

s

le

s

directive

s

.
Fai

s

un copier/coller du rapport qui

s

e trouve dan

s

C:\TCleaner.txt
Note : ton bureau va di

s

para

î

tre, c'e

s

t normal.

S

'il n'appara

î

t pa

s

à

la fin du

s

can, fai

s

la manip

s

uivante :

CTRL+ALT+

S

UPP

pour ouvrir le Ge

s

tionnaire de

s

t

â

che

s

.

Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

Si ca rame toujours fais ceci :

Demarrer => po

s

te de travail => c: => bouton droit => propriet

é

s
Nettoyage de di

s

k
Va dan

s

l'onglet Outil

s

pui

s

fai

s

le

s

2 option

s

(

S

can + defrag)
Repo

s

te un log hijac

k

thi

s

dan

s

le pire de

s

ca

s

s

il n'ya pa

s

de mieux

Si tu trouves les dossiers suivant supprime les :

OTmoveIt
Vundo

MSNFix fichier et dossier

ATF-Cleaner

Killbox

c:\!killbox\

Diaghelp

@+

Eclypse

Modifié le 3 septembre 2007 par eclypse

valouuu · le 3 septembre 2007

********ToolsCleaner2 (A.Rothstein)********

Debut le 03/09/2007 a 12:44:51,12

***************************************

-Navilog = Trouve!

-Navilog = Suppression effectuee!

-MsnFix = Trouve!

- (C:) MsnFix = Suppression effectuee!

Programme(s) supprime(s) avec succes!

***************************************

Fin le 03/09/2007 a 12:45:16,63

** Module de recherche complementaire ** (Beta Test 1)

Merci d'avoir utilise ToolsCleaner2

MERCI JE CROIS QUE C'EST BON MAINTENANT

Connexion

Pas encore inscrit ?

[Résolu] Virus sur mon PC

Messages recommandés

valouuu

eclypse

valouuu

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer