analyse hijackthis

numero_170 · le 2 septembre 2007

Bonsoir

ralentissement du pc, ouverture de pubs intempestives, "exlorer.exe" rencontre une erreur et doit fermer ... voici quelques uns des symptômes de mon pc depuis quelques jours

log hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 21:51:00, on 02/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\Microsoft ActiveSync\Wcescomm.exe

C:\PROGRA~1\MICROS~2\rapimgr.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\Documents and Settings\Olivier\Mes documents\Mes fichiers reçus\Mes utilitaires\Sécurité\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.free.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {0c299cbe-2f55-4863-9484-f985fbdc1e3d} - C:\WINDOWS\system32\l3cnui.dll (file missing)

O2 - BHO: (no name) - {53523C7E-EA23-40ED-A2A9-52D6CEDCB13D} - C:\WINDOWS\System32\geeby.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {C1ADC5ED-FB26-4770-AFE5-BD3A7EB5C148} - C:\WINDOWS\System32\rqrrspo.dll (file missing)

O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\dprdpsur.dll

O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [systemOptimizer] rundll32.exe "C:\WINDOWS\system32\svbjlkix.dll",forkonce

O4 - HKLM\..\RunOnce: [spybotDeletingA8611] command /c del "C:\WINDOWS\system32\geeby.dll_tobedeleted"

O4 - HKLM\..\RunOnce: [spybotDeletingC9405] cmd /c del "C:\WINDOWS\system32\geeby.dll_tobedeleted"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm

O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1188573395359

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1188674317453

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://www.touslesdrivers.com/fichiers/har...ion_2_0_4_9.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: c:\windows\system32\ddccyxy.dll

O20 - Winlogon Notify: geeby - C:\WINDOWS\System32\geeby.dll

O20 - Winlogon Notify: l3cnui - C:\WINDOWS\

O20 - Winlogon Notify: rqrrspo - C:\WINDOWS\

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe

O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe

O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

--

End of file - 7684 bytes

et encore merci pour votre travail

eclypse · le 3 septembre 2007

Salut

Analyse en cours

Retour dans la matinée

@+

Eclypse

eclypse · le 3 septembre 2007

Re

Reouvre hijackthis et coche

O2 - BHO: (no name) - {53523C7E-EA23-40ED-A2A9-52D6CEDCB13D} - C:\WINDOWS\System32\geeby.dll
O2 - BHO: (no name) - {0c299cbe-2f55-4863-9484-f985fbdc1e3d} - C:\WINDOWS\system32\l3cnui.dll (file missing)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {C1ADC5ED-FB26-4770-AFE5-BD3A7EB5C148} - C:\WINDOWS\System32\rqrrspo.dll (file missing)

O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\dprdpsur.dll

O4 - HKLM\..\Run: [systemOptimizer] rundll32.exe "C:\WINDOWS\system32\svbjlkix.dll",forkonce

O4 - HKLM\..\RunOnce: [spybotDeletingA8611] command /c del "C:\WINDOWS\system32\geeby.dll_tobedeleted"

O4 - HKLM\..\RunOnce: [spybotDeletingC9405] cmd /c del "C:\WINDOWS\system32\geeby.dll_tobedeleted"

O20 - AppInit_DLLs: c:\windows\system32\ddccyxy.dll

020 - Winlogon Notify: geeby - C:\WINDOWS\System32\geeby.dll

O20 - Winlogon Notify: l3cnui - C:\WINDOWS\

O20 - Winlogon Notify: rqrrspo - C:\WINDOWS\

CLICK SUR FIX CHECKED

Télécharge VirtumundoBeGone

Execute le puis clique sur continue puis start à l'invite il te dis qu'il redemarrera ton pc s'il trouve une infection repond OUI

Poste le rapport + un new hijackthis

@+

Eclypse

numero_170 · le 3 septembre 2007

Salut eclipse

rapport :

[09/03/2007, 9:18:44] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Olivier\Mes documents\Mes fichiers reçus\Mes utilitaires\Sécurité\VirtumundoBeGone.exe" )

[09/03/2007, 9:19:08] - Detected System Information:

[09/03/2007, 9:19:08] - Windows Version: 5.1.2600, Service Pack 2

[09/03/2007, 9:19:08] - Current Username: Olivier (Admin)

[09/03/2007, 9:19:08] - Windows is in NORMAL mode.

[09/03/2007, 9:19:08] - Searching for Browser Helper Objects:

[09/03/2007, 9:19:08] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()

[09/03/2007, 9:19:08] - WARNING: BHO has no default name. Checking for Winlogon reference.

[09/03/2007, 9:19:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper

[09/03/2007, 9:19:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.

[09/03/2007, 9:19:08] - BHO 2: {58A0350C-5E12-4230-95CD-7676DAD1E65E} ()

[09/03/2007, 9:19:08] - WARNING: BHO has no default name. Checking for Winlogon reference.

[09/03/2007, 9:19:08] - Checking for HKLM\...\Winlogon\Notify\geeby

[09/03/2007, 9:19:08] - Found: HKLM\...\Winlogon\Notify\geeby - This is probably Virtumundo.

[09/03/2007, 9:19:08] - Assigning {58A0350C-5E12-4230-95CD-7676DAD1E65E} MSEvents Object

[09/03/2007, 9:19:08] - BHO list has been changed! Starting over...

[09/03/2007, 9:19:08] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()

[09/03/2007, 9:19:08] - WARNING: BHO has no default name. Checking for Winlogon reference.

[09/03/2007, 9:19:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper

[09/03/2007, 9:19:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.

[09/03/2007, 9:19:08] - BHO 2: {58A0350C-5E12-4230-95CD-7676DAD1E65E} (MSEvents Object)

[09/03/2007, 9:19:08] - ALERT: Found MSEvents Object!

[09/03/2007, 9:19:08] - Finished Searching Browser Helper Objects

[09/03/2007, 9:19:08] - *** Detected MSEvents Object

[09/03/2007, 9:19:08] - Trying to remove MSEvents Object...

[09/03/2007, 9:19:09] - Terminating Process: IEXPLORE.EXE

[09/03/2007, 9:19:10] - Terminating Process: RUNDLL32.EXE

[09/03/2007, 9:19:10] - Disabling Automatic Shell Restart

[09/03/2007, 9:19:10] - Terminating Process: EXPLORER.EXE

[09/03/2007, 9:19:11] - Suspending the NT Session Manager System Service

[09/03/2007, 9:19:11] - Terminating Windows NT Logon/Logoff Manager

[09/03/2007, 9:19:11] - Re-enabling Automatic Shell Restart

[09/03/2007, 9:19:11] - File to disable: C:\WINDOWS\System32\geeby.dll

[09/03/2007, 9:19:11] - Renaming C:\WINDOWS\System32\geeby.dll -> C:\WINDOWS\System32\geeby.dll.vir

[09/03/2007, 9:19:12] - ! File rename was unsucessful.

[09/03/2007, 9:19:12] - Attempting to Deny Access to C:\WINDOWS\System32\geeby.dll

[09/03/2007, 9:19:12] - *** IMPORTANT: Delete/Rename/Move on reboot (like Killbox) MAY NOT work.

[09/03/2007, 9:19:12] - ERROR: Le mappage entre les noms de compte et les ID de sécurité n'a pas été effectué.

[09/03/2007, 9:19:12] - *** IMPORTANT: The file is disabled and will need to be deleted by the user.

[09/03/2007, 9:19:12] - Removing HKLM\...\Browser Helper Objects\{58A0350C-5E12-4230-95CD-7676DAD1E65E}

[09/03/2007, 9:19:12] - Removing HKCR\CLSID\{58A0350C-5E12-4230-95CD-7676DAD1E65E}

[09/03/2007, 9:19:12] - Adding Kill Bit for ActiveX for GUID: {58A0350C-5E12-4230-95CD-7676DAD1E65E}

[09/03/2007, 9:19:12] - Deleting ATLEvents/MSEvents Registry entries

[09/03/2007, 9:19:12] - Removing HKLM\...\Winlogon\Notify\geeby

[09/03/2007, 9:19:13] - Searching for Browser Helper Objects:

[09/03/2007, 9:19:13] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()

[09/03/2007, 9:19:13] - WARNING: BHO has no default name. Checking for Winlogon reference.

[09/03/2007, 9:19:13] - Checking for HKLM\...\Winlogon\Notify\SDHelper

[09/03/2007, 9:19:13] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.

[09/03/2007, 9:19:13] - Finished Searching Browser Helper Objects

[09/03/2007, 9:19:13] - Finishing up...

[09/03/2007, 9:19:13] - A restart is needed.

[09/03/2007, 9:19:30] - Attempting to Restart via STOP error (Blue Screen!)

new hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 09:30:47, on 03/09/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\RUNDLL32.EXE