Infection PC via disque dur externe

[rosie]

Bonsoir,

 

Nouveau post pour notre autre PC infecté en connectant un disque dur externe !

Comme pour le premier PC (voir post http://forum.zebulon.fr/infection-via-cle-usb-t142580.html dont s'occupe Apollo 01), j'ai suivi votre tutoriel "Les infections se propageant par les supports amovibles : USB, Flash, etc." (http://forum.zebulon.fr/infections-par-supports-amovibles-t131959.html ) en exécutant :

- Flash Desinfector Ok

- en voulant désactiver l'autorun par défaut dans Windows mais note : "Impossible d'importer C:\....autorun_off.reg. Toutes les données n'ont pas été inscrites correctement dans le registre. Certaines clés sont ouvertes par d'autres personnes ou d'autres processus."

 

J'ai effectué également un scan avec AVP Tool. Infection détectée mais pas possible de l'éradiquer. Fin du rapport qui l'indique ci-dessous (je ne copie pas tout, c'est plusieurs pages) :

 

20/04/2008 18:32:23 File: c:\documents and settings\nino\local settings\application data\mozilla\firefox\profiles\udjaow85.default\cache(2)\18a49f4dd01//stream//data0050 detected adware 'not-a-virus:AdWare.Win32.Shopper.r'

20/04/2008 18:35:36 File: c:\documents and settings\nino\local settings\application data\mozilla\firefox\profiles\udjaow85.default\cache(2)\18a49f4dd01//stream//data0050 not disinfected skipped by user

20/04/2008 18:35:36 File: c:\documents and settings\nino\local settings\application data\mozilla\firefox\profiles\udjaow85.default\cache(2)\18a49f4dd01//stream//data0051 ok scanned

20/04/2008 18:35:36 File: c:\documents and settings\nino\local settings\application data\mozilla\firefox\profiles\udjaow85.default\cache(2)\18a49f4dd01//stream//data0052 ok scanned

20/04/2008 18:35:36 File: c:\documents and settings\nino\local settings\application data\mozilla\firefox\profiles\udjaow85.default\cache(2)\18a49f4dd01//stream//data0053 ok scanned

20/04/2008 18:35:37 File: c:\system volume information\_restore{af05b64f-8a87-4d7b-aa2c-588964b52fdd}\rp63\a0007974.exe detected adware 'not-a-virus:AdWare.Win32.Shopper.r' by hash

20/04/2008 18:35:52 File: c:\system volume information\_restore{af05b64f-8a87-4d7b-aa2c-588964b52fdd}\rp63\a0007974.exe not disinfected skipped by user

 

 

Statistics

----------

Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted

------ ------- -------- --------- ------- ------------------- -------- ------------ ------------------ ---------

All objects 604673 1 1 0 0 7294 566 4 2

System memory 694 0 0 0 0 0 0 0 0

Startup objects 434 0 0 0 0 0 7 0 0

Disk boot sectors 4 0 0 0 0 0 0 0 0

Mes documents 7 0 0 0 0 0 0 0 0

Mail databases 2 0 0 0 0 1 0 0 0

Poste de travail 302331 1 1 0 0 3647 283 2 1

Disquette 3.5 (A:) 0 0 0 0 0 0 0 0 0

Disque local (C:) 301187 0 0 0 0 3646 276 2 1

Lecteur CD (D:) 0 0 0 0 0 0 0 0 0

Lecteur CD (E:) 0 0 0 0 0 0 0 0 0

Lecteur CD (F:) 0 0 0 0 0 0 0 0 0

Disque local (H:) 7 0 0 0 0 0 0 0 0

Disque local (I:) 7 0 0 0 0 0 0 0 0

 

 

Settings

--------

Parameter Value

--------- -----

Security Level Recommended

Action Prompt for action when the scan is complete

Run mode Manually

File types Scan all files

Scan only new and changed files No

Scan archives All

Scan embedded OLE objects All

Skip if object is larger than No

Skip if scan takes longer than No

Parse email formats No

Scan password-protected archives No

Enable iChecker technology No

Enable iSwift technology No

Show detected threats on "Detected" tab Yes

 

 

Quarantine

----------

Status Object Size Added

------ ------ ---- -----

 

 

Backup

------

Status Object Size

------ ------ ----

 

 

Rapport Hickjack :

 

Logfile of HijackThis v1.99.1

Scan saved at 21:07:10, on 20/04/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\Google Updater\GoogleUpdater.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Nino\Bureau\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.cleverbridge.com/30/cookie?x-no...ifier%3d8_08_en

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min /nosplsh

O4 - HKLM\..\Run: [VF0070 STISvc] RunDLL32.exe V0070Pin.dll,RunDLL32EP 513

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: ImageMixer for HDD Camcorder.lnk.disabled

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{33042AA5-4A55-47EE-B9DE-A485108CA539}: NameServer = 193.95.66.10,213.150.161.34

O17 - HKLM\System\CS1\Services\Tcpip\..\{33042AA5-4A55-47EE-B9DE-A485108CA539}: NameServer = 193.95.66.10,213.150.161.34

O17 - HKLM\System\CS2\Services\Tcpip\..\{33042AA5-4A55-47EE-B9DE-A485108CA539}: NameServer = 193.95.66.10,213.150.161.34

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

 

 

Merci pour votre aide !