Infecté par WORM/Brontok.C

[gazouz33]

Après avoir scanné mon Pc suite à toutes sortes de problèmes, voici le rapport d'Avira :

 

Report file date: vendredi 4 juillet 2008 15:59

Scanning for 1378593 virus strains and unwanted programs.

 

Licensed to: hiphop anonymous

Serial number: 1101603756-PEPWE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Save mode

Username: ADEL1

Computer name: ADEL

 

Version information:

BUILD.DAT : 8.1.0.344 19214 Bytes 28/05/2008 17:00:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 11:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 10:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 10:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 10:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 10:43:09

ANTIVIR2.VDF : 7.0.5.20 142336 Bytes 30/06/2008 10:43:19

ANTIVIR3.VDF : 7.0.5.50 139264 Bytes 04/07/2008 13:21:40

Engineversion : 8.1.0.64

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 11:58:21

AESCRIPT.DLL : 8.1.0.46 283002 Bytes 02/07/2008 17:21:01

AESCN.DLL : 8.1.0.22 119157 Bytes 02/07/2008 10:45:00

AERDL.DLL : 8.1.0.20 418165 Bytes 02/07/2008 10:44:58

AEPACK.DLL : 8.1.1.6 364918 Bytes 02/07/2008 10:44:51

AEOFFICE.DLL : 8.1.0.20 192891 Bytes 02/07/2008 10:44:19

AEHEUR.DLL : 8.1.0.35 1298806 Bytes 02/07/2008 17:20:57

AEHELP.DLL : 8.1.0.15 115063 Bytes 02/07/2008 10:43:40

AEGEN.DLL : 8.1.0.29 307573 Bytes 02/07/2008 10:43:39

AEEMU.DLL : 8.1.0.6 430451 Bytes 02/07/2008 10:43:33

AECORE.DLL : 8.1.0.32 168311 Bytes 02/07/2008 17:20:45

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 19:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 12:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 15:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 19:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 10:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 10:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 19:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 19:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 14:05:10

RCIMAGE.DLL : 8.0.0.31 2564353 Bytes 28/02/2008 11:19:50

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 13:45:45

 

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Premium\PROFILES\folder.avp

Logging..........................: low

Primary action...................: repair

Secondary action.................: quarantine

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: vendredi 4 juillet 2008 15:59

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

11 processes with 11 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '23' files ).

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\ADEL1\Bureau\perso\perso.exe

[DETECTION] Contains detection pattern of the worm WORM/Brontok.C

[NOTE] The file was moved to '48e049d7.qua'!

C:\Documents and Settings\ADEL1\Bureau\perso\SALIP\SALIP.exe

[DETECTION] Contains detection pattern of the worm WORM/Brontok.C

[NOTE] The file was moved to '48ba49b5.qua'!

C:\Program Files\Alcohol Soft\Alcohol 120\patch.exe

[DETECTION] Is the Trojan horse TR/Dropper.Gen

[NOTE] The file was moved to '48e24cfb.qua'!

 

End of the scan: vendredi 4 juillet 2008 17:02

Used time: 1:03:06 min

 

The scan has been done completely.

 

3983 Scanning directories

157574 Files were scanned

3 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

3 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

157571 Files not concerned

816 Archives were scanned

1 Warnings

3 Notes

 

et celui de HijackThis:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:18:56, on 04/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe

C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\DSLMON.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Avira\AntiVir PersonalEdition Premium\update.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.blingo.com/search?q=blingo

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blingo.com/search?q=blingo

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.blingo.com/friends?ref=k0mqBd7j..._ysP80cjUOrMT2A

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch_1.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Pando Toolbar BHO - {E3EA4FD1-CADE-4ae5-84F7-086EEE888BE4} - C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O3 - Toolbar: Pando Toolbar - {E3EA4FD9-CADE-4ae5-84F7-086EEE888BE4} - C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL

O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min

O4 - HKCU\..\Run: [ADIMON MFC Application] C:\Program Files\Huawei Technologies\Huawei SmartAX MT810\DSLMON.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: &Tout télécharger avec FlashGet - C:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a...zylomloader.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{EFF2A2E7-74EB-4E73-A5EA-DADA5E98C173}: NameServer = 41.221.20.4 213.140.2.12

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - (no file)

O23 - Service: 13BB7DC7 - Unknown owner - C:\WINDOWS\system32\6DE79875.EXE (file missing)

O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe

O23 - Service: Avira AntiVir Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe

O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe

O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Avira AntiVir Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

--

End of file - 6933 bytes

 

Dois je faire autre chose ? surtout que le PC reste toujours lent au démarrage de certaines applications (firefox)

 

Merci à tous, j'attends vos recommandations.

Modifié le 4 juillet 2008 par gazouz33

[pear]

Bonsoir,

 

Antivir a fait son travail en mettant la bestiole en quarantaine.

Votre rapport Hijackthis ne montre pas d'infection.

[gazouz33]

Bonsoir,

 

Antivir a fait son travail en mettant la bestiole en quarantaine.

Votre rapport Hijackthis ne montre pas d'infection.

 

Merci beaucoup, je suis ravi de m'être débarrassé de ces cochonnerie .

[gazouz33]

Bon, j'ai voulu en avoir le coeur net et j'ai passé un coup de MBAM et devinez quoi ? il trouvé deux autres infections.

Voici le rapport ça pourrait aider qui sait.

 

Malwarebytes' Anti-Malware 1.16

Version de la base de données: 846

 

21:38:39 04/07/2008

mbam-log-7-4-2008 (21-38-39).txt

 

Type de recherche: Examen complet (C:\|)

Eléments examinés: 82519

Temps écoulé: 26 minute(s), 52 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 1

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\Software\Microsoft\OLE\DRam prosessor (Trojan.Agent) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.