Pc pas en forme [résolu]

[djibril15]

Avira AntiVir Personal

Report file date: samedi 21 juin 2008 16:59

 

Scanning for 1349608 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows 2000

Windows version: (Service Pack 4) [5.0.2195]

Boot mode: Save mode

Username: x1

Computer name: X

 

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58

ANTIVIR2.VDF : 7.0.4.195 2546176 Bytes 14/06/2008 14:48:18

ANTIVIR3.VDF : 7.0.4.232 250880 Bytes 20/06/2008 14:48:18

Engineversion : 8.1.0.59

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22

AESCRIPT.DLL : 8.1.0.44 278907 Bytes 21/06/2008 14:48:24

AESCN.DLL : 8.1.0.22 119157 Bytes 21/06/2008 14:48:24

AERDL.DLL : 8.1.0.20 418165 Bytes 21/06/2008 14:48:24

AEPACK.DLL : 8.1.1.6 364918 Bytes 21/06/2008 14:48:22

AEOFFICE.DLL : 8.1.0.20 192891 Bytes 21/06/2008 14:48:22

AEHEUR.DLL : 8.1.0.32 1274231 Bytes 21/06/2008 14:48:22

AEHELP.DLL : 8.1.0.15 115063 Bytes 21/06/2008 14:48:20

AEGEN.DLL : 8.1.0.29 307573 Bytes 21/06/2008 14:48:20

AEEMU.DLL : 8.1.0.6 430451 Bytes 21/06/2008 14:48:20

AECORE.DLL : 8.1.0.31 168310 Bytes 21/06/2008 14:48:20

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12

 

Configuration settings for the scan:

Jobname..........................: Local Hard Disks

Configuration file...............: c:\program files\avira\antivir personaledition classic\alldiscs.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, E:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: samedi 21 juin 2008 16:59

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'WinMgmt.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

11 processes with 11 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '19' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <WIN2KSP4>

C:\PAGEFILE.SYS

[WARNING] The file could not be opened!

C:\15.tmp

[0] Archive type: RSRC

--> Object

[DETECTION] Is the Trojan horse TR/Proxy.Xorpix.AR.43

[NOTE] The file was moved to '488b17c3.qua'!

C:\1B.tmp

[0] Archive type: RSRC

--> Object

[DETECTION] Is the Trojan horse TR/Proxy.Xorpix.AR.43

[NOTE] The file was moved to '488b17d0.qua'!

C:\WINNT\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

C:\WINNT\system32\drivers\atapi.sys

[WARNING] The file could not be opened!

C:\WINNT\system32\MRI\btuxderr.exe

[DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen

[NOTE] The file was moved to '48d218c6.qua'!

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\488b17c3.qua

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\488b17c3.qua

[1] Archive type: RSRC

--> Object

[DETECTION] Is the Trojan horse TR/Proxy.Xorpix.AR.43

[NOTE] The file was moved to '489519b5.qua'!

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\488b17d0.qua

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\488b17d0.qua

[1] Archive type: RSRC

--> Object

[DETECTION] Is the Trojan horse TR/Proxy.Xorpix.AR.43

[NOTE] The file was moved to '489519b6.qua'!

C:\Program Files\backups\backup-20080621-153832-857.dll

[DETECTION] Is the Trojan horse TR/Vundo.Gen

[NOTE] The file was moved to '48c01c42.qua'!

C:\Temp\reywdl.exe

[DETECTION] Contains detection pattern of the dropper DR/Dldr.Small.buy.181

[NOTE] The file was moved to '48d61fff.qua'!

Begin scan in 'D:\' <COPIE CD>

Begin scan in 'E:\' <XAVIER>

E:\agof star\Program Files\BWLOAD110.exe

[DETECTION] Is the Trojan horse TR/Spy.Ayolog.IY

[NOTE] The file was moved to '48a9268e.qua'!

E:\agof star\Program Files\Starcraft\BWLOAD110.exe

[DETECTION] Is the Trojan horse TR/Spy.Ayolog.IY

[NOTE] The file was moved to '48a926a1.qua'!

 

 

End of the scan: samedi 21 juin 2008 18:27

Used time: 1:27:48 min

 

The scan has been done completely.

 

4802 Scanning directories

319875 Files were scanned

9 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

9 files were moved to quarantine

0 files were renamed

3 Files cannot be scanned

319866 Files not concerned

6964 Archives were scanned

3 Warnings

9 Notes

[angelique]

• vide la quarantaine d'antivir et poste un dernier nouveau rapport HJT pout verif.

 

Le pc est ok ??

[djibril15]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 19:47:08, on 21/06/2008

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

Boot mode: Normal

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINNT\system32\drivers\CDAC11BA.EXE

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\ahead\INCD\InCD.exe

C:\WINNT\SOUNDMAN.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINNT\system32\internat.exe

D:\Program Files\Nikon\PictureProject\NkbMonitor.exe

C:\Program Files\SuperCopier\SuperCopier.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\HiJackThis_v2.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [EM_EXEC] C:\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [inCD] C:\ahead\INCD\InCD.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [internat.exe] internat.exe

O4 - HKCU\..\Run: [RegistryBooster 2 d’Uniblue ] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

O4 - HKCU\..\Run: [superCopier.exe] C:\Program Files\SuperCopier\SuperCopier.exe

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - Global Startup: NkbMonitor.exe.lnk = D:\Program Files\Nikon\PictureProject\NkbMonitor.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{E9085E86-4F1B-4D62-952B-986D631BB992}: NameServer = 193.252.19.3,193.252.19.4

O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\system32\browseui.dll

O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\system32\browseui.dll

O23 - Service: Avertissement (Alerter) - Unknown owner - C:\WINNT\System32\services.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Gestion d'applications (AppMgmt) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe (file missing)

O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe

O23 - Service: Explorateur d'ordinateur (Browser) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE

O23 - Service: Client DHCP (Dhcp) - Unknown owner - C:\WINNT\System32\services.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINNT\System32\dmadmin.exe

O23 - Service: Gestionnaire de disque logique (dmserver) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Client DNS (Dnscache) - Unknown owner - C:\WINNT\System32\services.exe

O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Service de télécopie (Fax) - Unknown owner - C:\WINNT\system32\faxsvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Serveur (lanmanserver) - Unknown owner - C:\WINNT\System32\services.exe

O23 - Service: Station de travail (lanmanworkstation) - Unknown owner - C:\WINNT\System32\services.exe

O23 - Service: Service d'application d'assistance TCP/IP NetBIOS (LmHosts) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINNT\System32\mnmsrvc.exe

O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINNT\system32\netdde.exe

O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:\WINNT\system32\netdde.exe

O23 - Service: Ouverture de session réseau (Netlogon) - Unknown owner - C:\WINNT\system32\lsass.exe

O23 - Service: Fournisseur de la prise en charge de sécurité LM NT (NtLmSsp) - Unknown owner - C:\WINNT\System32\lsass.exe

O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Agent de stratégie IPSEC (PolicyAgent) - Unknown owner - C:\WINNT\system32\lsass.exe

O23 - Service: Cycling Manager 2007 Drivers Auto Removal (pr2akt6c) (pr2akt6c) - Cyanide - C:\WINNT\system32\pr2akt6c.exe

O23 - Service: Emplacement protégé (ProtectedStorage) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Gestionnaire de comptes de sécurité (SamSs) - Unknown owner - C:\WINNT\system32\lsass.exe

O23 - Service: Prise en charge des cartes à puces (SCardDrv) - Unknown owner - C:\WINNT\System32\SCardSvr.exe

O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINNT\System32\SCardSvr.exe

O23 - Service: Service d'exécution par délégation (seclogon) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Still Image Service (StiSvc) - Unknown owner - C:\WINNT\system32\stisvc.exe

O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINNT\system32\smlogsvc.exe

O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINNT\system32\tlntsvr.exe

O23 - Service: Client de suivi de lien distribué (TrkWks) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Gestionnaire d'utilitaires (UtilMan) - Unknown owner - C:\WINNT\System32\UtilMan.exe

O23 - Service: Horloge Windows (W32Time) - Unknown owner - C:\WINNT\system32\services.exe

O23 - Service: Infrastructure de gestion Windows (WinMgmt) - Unknown owner - C:\WINNT\System32\WBEM\WinMgmt.exe

O23 - Service: Extensions du pilote WMI (Wmi) - Unknown owner - C:\WINNT\system32\Services.exe

O24 - Desktop Component 0: (no name) - file:///E:/Mes%20documents/Mes%20images/610_hp.jpg

 

--

End of file - 8269 bytes

 

 

 

 

Le PC semble OK. Merci infiniment

[angelique]

• corrige & fixchecked avec Hijackthis :

 

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

 

» supprime le backup d'HJT , C:\Program Files\backups

 

• configure tes services correctement en fonction de tes besoins:

 

http://speedweb1.free.fr/frames2.php?page=service4

 

sinon c'est ok! , utilise l'onglet "editer" sous ton 1er message et ajoute [resolu] dans le titre.

 

@+

[djibril15]

Merci bien