Un log HijackThis, une analyse SVP

cestvert · le 20 septembre 2007

Bonjour à tous,

Mon ordinateur ne va plus du tout. En effet, les comptes administrateurs sont altérés notamment ne peux plus changer l’heure ou installer certain application.

J’ai désinfecté avec Avira en mode sans échec il semble que tous a été effacé ou mis en quarantaine. Par la suite en mode normale j’ai exécuter HijackThis qui donne le log suivant :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:24:06, on 20.09.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Apple\Library\System\machd.exe

C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

C:\WINDOWS\System32\cisvc.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\WINDOWS\SYSTEM32\DWRCS.EXE

C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE

C:\WINDOWS\system32\HPConfig.exe

C:\WINDOWS\System32\inetsrv\inetinfo.exe

C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcods.exe

C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcshield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe

C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe

C:\WINDOWS\system32\invoker.exe

C:\Apple\OpenBase\bin\openexec.exe

C:\Apple\Library\Frameworks\Foundation.framework\Resources\pgroup.exe

C:\Apple\OpenBase\bin\openinfo.exe

C:\Program Files\SiteAdvisor\6172\SAService.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exe

C:\Apple\Library\System\nmserver.exe

C:\WINDOWS\system32\java.exe

E:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\SiteAdvisor\6172\SiteAdv.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\HPQ\One-Touch\OneTouch.EXE

C:\Program Files\Fichiers communs\Nokia\NCLTools\NCLConf.exe

C:\WINDOWS\System32\hphmon05.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Apple\Library\Frameworks\AppKit.framework\Resources\pbs.exe

C:\Apple\Library\System\WindowServer.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\cidaemon.exe

E:\transfert\pbOrdi\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=asas:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE

O4 - HKLM\..\Run: [Nokia Connection Monitor] "C:\Program Files\Fichiers communs\Nokia\NCLTools\NCLConf.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe

O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [CARPService] carpserv.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\S-1-5-21-318002662-2135222273-1471158870-1110\..\Run: [userinit] C:\Documents and Settings\see.NICECOMPUTING\Application Data\ntos.exe (User '?')

O4 - HKUS\S-1-5-21-3653917127-210295829-688940020-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')

O4 - HKUS\S-1-5-21-3653917127-210295829-688940020-1004\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-21-318002662-2135222273-1471158870-1110 Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe (User '?')

O4 - S-1-5-21-318002662-2135222273-1471158870-1110 User Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe (User '?')

O4 - S-1-5-21-3653917127-210295829-688940020-1004 Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe (User '?')

O4 - S-1-5-21-3653917127-210295829-688940020-1004 User Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe (User '?')

O4 - Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe

O4 - User Startup: asasc.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Pasteboard Server.lnk = C:\Apple\Library\Frameworks\AppKit.framework\Resources\pbs.exe

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O4 - Global Startup: Start ASAS Client.lnk = C:\Program Files\Arpage\ASAS3\client\asasc.exe

O4 - Global Startup: VPN Client.lnk = ?

O4 - Global Startup: Window Server.lnk = C:\Apple\Library\System\WindowServer.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O15 - Trusted Zone: http://www.emsisoft.net

O15 - Trusted Zone: http://www.secuser.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835

O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab

O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit...b?1187623321333

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1096631198787

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1124267662289

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://config.zebulon.fr/plugins/hardwaredetection.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\Software\..\Telephony: DomainName = nicecomputing

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS1\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS2\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS3\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: Apple Mach Daemon (Apple_Mach_Daemon) - Unknown owner - C:\Apple\Library\System\machd.exe

O23 - Service: Apple Netname Server (Apple_Netname_Server) - Unknown owner - C:/Apple\Library\System\nmserver.exe

O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development - C:\WINDOWS\SYSTEM32\DWRCS.EXE

O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe

O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe

O23 - Service: HPWirelessMgr - Unknown owner - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe (file missing)

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~2\mcods.exe

O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~2\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~2\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: openexec - Unknown owner - C:\WINDOWS\system32\invoker.exe

O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe

O23 - Service: Apple WebObjects Monitor 5 (WOMONITOR5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\JavaMonitor.woa\WOMonitorService.exe

O23 - Service: Apple WebObjects Task Daemon 5 (WOTASKD5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exe

--

End of file - 16830 bytes

Je m’en sors pas du tout tout.

Si vous pouviez m’aider ce serait génial ….

Merci par avance !

eclypse · le 20 septembre 2007

Salut

Reouvre hijackthis et coche

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)

O4 - HKUS\S-1-5-21-318002662-2135222273-1471158870-1110\..\Run: [userinit] C:\Documents and Settings\see.NICECOMPUTING\Application Data\ntos.exe (User '?')

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\Software\..\Telephony: DomainName = nicecomputing

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS1\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS2\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = nicecomputing

O17 - HKLM\System\CS3\Services\Tcpip\..\{0C54C6BA-AC8B-44B8-A17F-CC2A05A68EE4}: NameServer = 193.193.144.12,193.193.158.10

Clique sur fix checked

Fais demarrer => executer => cmd puis tape ce qui suit

SC STOP Apple_Netname_Server
SC STOP WOMONITOR5

SC STOP WOTASKD5

Reouvre hijackthis et coche

O23 - Service: Apple Netname Server (Apple_Netname_Server) - Unknown owner - C:/Apple\Library\System\nmserver.exe
O23 - Service: openexec - Unknown owner - C:\WINDOWS\system32\invoker.exe

O23 - Service: Apple WebObjects Monitor 5 (WOMONITOR5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\JavaMonitor.woa\WOMonitorService.ex e

O23 - Service: Apple WebObjects Task Daemon 5 (WOTASKD5) - Unknown owner - C:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exe

Clique sur fix checked

Procedure

Télécharge Download Link: fixme.reg

Sauvegarde le sur ton bureau

N'utilise pas encore ce fichier.

KillBox

Télécharges KillBox

Redémarre le système en mode sans échec pour ne pas être gêné par un programme travaillant en tâche de fond (résident).
lance Pocketkillbox
copie le chemin de fichier entier ci dessous, et colle le dans la boîte Full Path of File to Delete :
```
C:\WINDOWS\system32\ntos.exe
```
Sélectionne l'option Replace on Reboot et active l'option "Use Dummy"
Clique sur la croix rouge et autorise Killbox a redémarrer l'ordinateur.

Après le redémarrage tu vas avoir un message d'erreur concernant "NTVDM CPU", ceci est normal. Fermez le dialogue en cliquant "Close".

Au redemarrage

Double clique sur Fixme.reg, autorise l'ajout des données à la base de registre.

Redémarre le PC.

Supprime les éléments suivants:

Fichier : C:\WINNT\system32\ntos.exe

Dossier : C:\WINNT\system32\wsnpoem

Poste un nouveau rapport HijackThis.

@+

Modifié le 20 septembre 2007 par eclypse

cestvert · le 20 septembre 2007

Tout d’abord merci pour ta réponse !

Ensuite quand j’ai souhaité effacer le fichier ntos.exe à l’aide Pocketkillbox il n’existait plus !!! (Je l’ai peut-être effacé précédemment …)

Toutefois, j’ai continué la procédure proposée, ai-je bien fait ?, c’est-à-dire j’ai cliqué sur Fixme.reg. Mais pas pu effacer les éléments suivants :

Fichier : C:\WINNT\system32\ntos.exe

Dossier : C:\WINNT\system32\wsnpoem

Car ils n’existaient pas.

Le log :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:27:58, on 20.09.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Apple\Library\System\machd.exe

C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

C:\WINDOWS\System32\cisvc.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\WINDOWS\SYSTEM32\DWRCS.EXE

C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE

C:\WINDOWS\system32\HPConfig.exe

C:\WINDOWS\System32\inetsrv\inetinfo.exe

C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcods.exe

C:\PROGRA~1\McAfee\MSC\mcpromgr.exe

c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcshield.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\PROGRA~1\MICROS~4\MSSQL\binn\sqlservr.exe

C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe

C:\Program Files\SiteAdvisor\6172\SAService.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Apple\Library\WebObjects\JavaApplications\wotaskd.woa\WOTaskDService.exe

C:\Apple\Library\System\nmserver.exe

C:\WINDOWS\system32\java.exe

E:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\SiteAdvisor\6172\SiteAdv.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\HPQ\One-Touch\OneTouch.EXE

C:\Program Files\Fichiers communs\Nokia\NCLTools\NCLConf.exe

C:\WINDOWS\System32\hphmon05.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe

C:\WINDOWS\system32\carpserv.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Apple\Library\Frameworks\AppKit.framework\Resources\pbs.exe

C:\Apple\Library\System\WindowServer.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe