S V P RAPPORT HIJACK

Chanel · le 6 mai 2008

J'ai le rapport premier si ça peut aider?

jacmanou · le 6 mai 2008

Maintenant que ton système est stabilisé, retente le passage de SDFix en mode sans échec.

Poste le rapport si il va au bout, et un nouveau rapport HijackThis.

Modifié le 6 mai 2008 par jacmanou

Chanel · le 7 mai 2008

Maintenant que ton système est stabilisé, retente le passage de SDFix en mode sans échec.

Poste le rapport si il va au bout, et un nouveau rapport HijackThis.

Bonjour,

toujours impossible après plusieurs essais , de plus un programme s'est installé en plein milieu de l'écran (corel photo album 6 !!!!) Je ne peux plus fermer l'ordi , seulement si je le débranche!

à plus ...j'espère

le 7 mai 2008

Bonsoir

J'ai fait Sdfix :System currentcontrolset control virtual device drivers Le format du peripherique virtuel dans le registre n'est pas valide FERMER ????

D'autre part j'ai fais un ccleaner , dans probléme je trouve reference d'installation invalide , et dans donnée

C.Program files/illusion soflworks/hidden et dangerous2text/cczech/fonts/set1

Cprogram files/corel photo album6/pcuui/images button

pouvez- vs me dire si je dois corriger les erreurs

Si vs pensez que les problèmes ne peuvent se résoudre, je laisse tomber, autant me le dire

Merci et bonne nuit

jacmanou · le 7 mai 2008

Ton problème dépasse mes compétences.

Je vais demander à quelqu'un de plus expérimenté de prendre le relais pour t'aider.

Bon courage.

pear · le 8 mai 2008

Bonjour,

Les rapports et vos commentaires ne montrent pas d'infection repérable.

J'aimerais que vous précisiez ceci:

J'ai retiré avast pour avira qui a découvert une multitude d'infections, les logiciels non désirés sont impossibles à désinstallés, tout se bloque ,certains lancent l'installation

Hors le dernier rapport Antivir ne montre rien(ceclui-ci :Avira AntiVir Personal

Report file date: mardi 6 mai 2008 21:44)

Vous pourriez poster celui où des infections sont découvertes ?

Et un scan en ligne avec un des logiciels proposés.

Si vous avez un problème de connexion:

1)Pour réparer la connexion Internet:

Panneau de configuration->Connexions réseaux->Propriétés->Réparer

2)Pour Windows XP SP2 il est possible de refaire un reset de Winsock

(dans le cas où un antivirus se charge dans les LSP il sera supprimé aussi),

cela se fait comme ceci :

Démarrer-Exécuter ->Cmd /k Netsh int ip reset resetlog.txt

Démarrer-Exécuter ->Cmd /k Netsh winsock reset catalog

Redémarrez l'ordinateur.

# Si vous utilisez Antivir (ce qui est recommandé), vous devez désactiver la protection en temps réel, Antivir détecte certains composant de navilog1 comme néfaste.

* Pour cela, faites un clic droit sur l'icône Antivir en bas à droite à côté de l'horloge puis Disable Guard.

Sous Vista:

Désactiver le contrôle des comptes utilisateurs ( le réactiver après la désinfection):

http://forum.malekal.com/viewtopic.php?f=59&t=6517

- Démarrer puis panneau de configuration->"Comptes d'utilisateurs"

- Cliquer ensuite sur désactiver et valider.

Télécharger Navilog1

. et enregistrez-le sur le bureau.

Ensuite double cliquer sur navilog1.exe pour lancer l'installation.

Une fois l'installation terminée, Faire un Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisir "Exécuter en tant qu'administrateur".

Au menu principal, Faire le choix 1

Suivre les instructions et patienter jusqu'au message :

*** Analyse Terminée le ..... ***

Poster le rapport

Vous avez installé Hijackthis dans un fichier temporaire.

Il ne le faut pas.

*

Téléchargez Hijackthis de TrendMicro.

* Décompressez le dans un dossier à la racine du disque dur

renommer ce dossier par exemple Karcher

Sous Vista,,il faut faire clic-droit >> "Exécuter en tant qu'Administrateur" sur Hijackthis.exe sinon HJT tourne mais ne fixe rien.

* Lancer le fichier Hijackthis.exe

* Cliquer sur Do a system scan and save a log file

* Copier-coller le rapport dans un nouveau message ici

le 8 mai 2008

Merci de votre réponse, je vs transmets le rapport infectieux , les logiciels indésirables sont toujours là et je ne peux les désinstaller:corel photo album 6 , hidder et dangerous,max payne2,cal of duty, le club des cinq 4

Je ne peux plus fermer l'ordi vu que corel est en execution en permanence et bien sur impossible à virer

Ci-joint le rapport infectieux avira

Avira AntiVir Personal

Report file date: mardi 6 mai 2008 14:10

Scanning for 1253212 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: DH6VJ42J

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58

ANTIVIR2.VDF : 7.0.4.0 1554432 Bytes 05/05/2008 12:04:09

ANTIVIR3.VDF : 7.0.4.7 22528 Bytes 06/05/2008 12:04:09

Engineversion : 8.1.0.37

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.28 233851 Bytes 06/05/2008 12:04:15

AESCN.DLL : 8.1.0.15 119157 Bytes 06/05/2008 12:04:14

AERDL.DLL : 8.1.0.20 418165 Bytes 06/05/2008 12:04:14

AEPACK.DLL : 8.1.1.4 364918 Bytes 06/05/2008 12:04:13

AEOFFICE.DLL : 8.1.0.18 192890 Bytes 06/05/2008 12:04:13

AEHEUR.DLL : 8.1.0.21 1196407 Bytes 06/05/2008 12:04:12

AEHELP.DLL : 8.1.0.14 115063 Bytes 06/05/2008 12:04:11

AEGEN.DLL : 8.1.0.18 299381 Bytes 06/05/2008 12:04:10

AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43

AECORE.DLL : 8.1.0.27 168310 Bytes 06/05/2008 12:04:10

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: mardi 6 mai 2008 14:10

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'aoltray.exe' - '1' Module(s) have been scanned

Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ehRec.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

34 processes with 34 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '21' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\CHLOE\Mes documents\Ma musique\01 Track 1, xxx.wma

[DETECTION] Is the Trojan horse TR/Wimad.A.Gen

[NOTE] The file was moved to '48404b79.qua'!

C:\Documents and Settings\CHLOE\Mes documents\Ma musique\David Letterman gets pranked.wma

[DETECTION] Is the Trojan horse TR/Wimad.A.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\Program Files\DisqudurProtection\ucookw.exe

[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen

[NOTE] The file was moved to '488f568a.qua'!

C:\Program Files\Ravensburger\Le Club des Cinq 4\CC4.exe

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP525\A0126242.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48516a60.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP525\A0127212.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48516a63.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0212045.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0212046.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0213007.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0214004.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0215007.exe

[WARNING] The file could not be opened!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0220008.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526ad1.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP539\A0225007.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526ad7.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP543\A0288143.exe

[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP546\A0290400.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526b14.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP555\A0291741.exe

[DETECTION] Contains detection pattern of the dropper DR/Tool.Reboot.F.91

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP556\A0291767.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004

[WARNING]

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP564\A0292148.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526c03.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP564\A0292149.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526c08.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP564\A0292150.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.Gen

[NOTE] The file was moved to '48526c0a.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP564\A0292151.exe

[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen

[NOTE] The file was moved to '48526c0c.qua'!

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP564\A0292152.exe

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

[NOTE] The file was moved to '48526c0f.qua'!

End of the scan: mardi 6 mai 2008 16:37

Used time: 2:27:52 min

The scan has been done completely.

7483 Scanning directories

241212 Files were scanned

21 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

12 files were moved to quarantine

0 files were renamed

3 Files cannot be scanned

241191 Files not concerned

5045 Archives were scanned

16 Warnings

12 Notes

le 8 mai 2008

Suite au rapport infectieux, hijack et fix merci