rapport hijackthis

[angelique]

• t'as pas viré avast!!!!!!!!!!!!!!!!

 

• desinstalle ComboFix de la meme maniere que precedemment et fait un scan avec avira_anitivir_personnal et poste le rapport, [quarantaine les infections!]

[ginangelheart]

Pour avast, je ne peux pas le supprimer car c'est un copain qui me l'a installé et je n'ai pas de cd d'install.

 

rapport antivir

 

 

AntiVir PersonalEdition Classic

Report file date: jeudi 17 avril 2008 10:01

 

Scanning for 835736 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Admin

Computer name: XPSP2-F50B6F7C3

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 13:26:55

ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 13:27:04

ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 13:27:13

AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 16:43:56

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21

 

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: high

Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

 

Start of the scan: jeudi 17 avril 2008 10:01

 

Starting search for hidden objects.

'28927' objects were checked, '0' hidden objects were found.

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'IMApp.exe' - '1' Module(s) have been scanned

Scan process 'ashDisp.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned

Scan process 'Kodak Software Updater.exe' - '1' Module(s) have been scanned

Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned

Scan process 'emule.exe' - '1' Module(s) have been scanned

Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned

Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned

Scan process 'lxcrcoms.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'ezprint.exe' - '1' Module(s) have been scanned

Scan process 'iFrmewrk.exe' - '1' Module(s) have been scanned

Scan process 'ZCfgSvc.exe' - '1' Module(s) have been scanned

Scan process 'carpserv.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned

Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned

Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned

Scan process 'NBService.exe' - '1' Module(s) have been scanned

Scan process 'EvtEng.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned

Scan process 'ashServ.exe' - '1' Module(s) have been scanned

Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

44 processes with 44 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[NOTE] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '36' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <WINDOWS>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Admin\Bureau\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> 327882R2FWJFW\NirCmdC.cfexe

[DETECTION] Contains detection pattern of the application APPL/Tool.NirCmd.D

--> 327882R2FWJFW\psexec.cfexe

[DETECTION] Contains detection pattern of the application APPL/Rmadmin.131072

--> 327882R2FWJFW\pv.cfexe

[DETECTION] Contains detection pattern of the SPR/Tool.PV program

[iNFO] The file was moved to '48740488.qua'!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

 

 

End of the scan: jeudi 17 avril 2008 10:16

Used time: 15:39 min

 

The scan has been done completely.

 

4147 Scanning directories

113661 Files were scanned

3 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

113658 Files not concerned

1792 Archives were scanned

4 Warnings

0 Notes

28927 Objects were scanned with rootkit scan

0 Hidden objects were found

[jacmanou]

Tu peux supprimer Avast en utilisant le désinstalleur qu'angélique t'a demandé d'utiliser.

http://files.avast.com/files/eng/aswclear.exe

http://www.avast.com/fre/avast-uninstall-utility.html

 

Le prochain rapport HijackThis, fait le avec la dernière version 2.0.2 :

HijackThis

 

O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart

Enfin, pour l'origine de l'infection, qui a une idée ???

Modifié le 17 avril 2008 par jacmanou

[angelique]

Pour avast, je ne peux pas le supprimer car c'est un copain qui me l'a installé et je n'ai pas de cd d'install.

 

tu telecharges aswclear pour desinstaller Avast STP!!! y'a pas besoin du cd d'installation d'avast pour le supprimer ni pour l'installer............

 

sinon le rapport antivir est ok!

 

as tu encore des soucis??