Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

[Résolu] Antivirusxp 2008

thiemec

Par thiemec
dans Analyses et éradication malwares

 Partager

Messages recommandés

thiemec Junior Member

thiemec

Posté(e)
  • Auteur
Posté(e)

voici le rapport....merci

 

 

 

Malwarebytes' Anti-Malware 1.23

Version de la base de données: 999

Windows 5.1.2600 Service Pack 2

 

00:18:09 28/07/2008

mbam-log-7-28-2008 (00-18-09).txt

 

Type de recherche: Examen rapide

Eléments examinés: 56295

Temps écoulé: 10 minute(s), 23 second(s)

 

Processus mémoire infecté(s): 4

Module(s) mémoire infecté(s): 4

Clé(s) du Registre infectée(s): 17

Valeur(s) du Registre infectée(s): 10

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 13

Fichier(s) infecté(s): 38

 

Processus mémoire infecté(s):

C:\Program Files\rhclq1j0eeqn\rhclq1j0eeqn.exe (Rogue.Multiple) -> Unloaded process successfully.

C:\WINDOWS\system32\lphcgq1j0eeqn.exe (Trojan.FakeAlert) -> Unloaded process successfully.

C:\WINDOWS\system32\pphcgq1j0eeqn.exe (Trojan.FakeAlert) -> Unloaded process successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Unloaded process successfully.

 

Module(s) mémoire infecté(s):

C:\Program Files\rhclq1j0eeqn\MFC71.dll (Rogue.Multiple) -> Delete on reboot.

C:\Program Files\rhclq1j0eeqn\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.

C:\Program Files\rhclq1j0eeqn\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.

C:\WINDOWS\system32\blphcgq1j0eeqn.scr (Trojan.FakeAlert) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhclq1j0eeqn (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\rhclq1j0eeqn (Rogue.Multiple) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qndsfmao.bawr (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qndsfmao.bvqe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhclq1j0eeqn (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcgq1j0eeqn (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\Program Files\Live_TV (Adware.Agent) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\rhclq1j0eeqn\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Program Files\rhclq1j0eeqn\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\rhclq1j0eeqn.exe (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\rhclq1j0eeqn.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\rhclq1j0eeqn\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\0VNN5r.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\2hFAH7.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\8puVZT.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\CnCLOb.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\eVeDbx.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\nR1gAm.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rXgfCE.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\SK739t.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\XSNQeg.syz (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\BMaea4f2aa.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BMaea4f2aa.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\blphcgq1j0eeqn.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\lphcgq1j0eeqn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\phcgq1j0eeqn.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pphcgq1j0eeqn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Thierry\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

thiemec Junior Member

thiemec

Posté(e)
  • Auteur
Posté(e)

ha....1ere vue j ai redemarre et....pas d alertes....la derniere manip me disais que les derniers virus allaient etre supprimés au demarrage, pour l instant ça semble bon :P

 

je lance un hijack

 

voila

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:26:18, on 28/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

D:\Prog\avast\aswUpdSv.exe

D:\Prog\avast\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

D:\Prog\avast\ashDisp.exe

D:\prog\EnMixCPL.exe

D:\Prog\Winamp\winampa.exe

D:\PDVDServ.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\hphmon05.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

D:\Prog\avast\ashMaiSv.exe

D:\Prog\avast\ashWebSv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {FA5C4026-14B7-4FE2-8A6E-2787E9486A40} - C:\WINDOWS\system32\vtUNFwWQ.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

O4 - HKLM\..\Run: [avast!] D:\Prog\avast\ashDisp.exe

O4 - HKLM\..\Run: [EnvyHFCPL] d:\prog\EnMixCPL.exe

O4 - HKLM\..\Run: [WinampAgent] D:\Prog\Winamp\winampa.exe

O4 - HKLM\..\Run: [RemoteControl] D:\PDVDServ.exe

O4 - HKLM\..\Run: [LanguageShortcut] D:\Language\Language.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"

O4 - HKLM\..\Run: [bMaea4f2aa] Rundll32.exe "C:\WINDOWS\system32\fexrojbk.dll",s

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [sfKg6wIPu] C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

O4 - HKCU\..\Run: [sign Love] C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1\typeseekmpeg.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1211745107059

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_...geUploader4.cab

O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photobox.fr/discount/clients/up...er_v2.2.0.6.cab

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a...zylomloader.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layou...IPSUploader.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O20 - Winlogon Notify: efcaxvs - efcaxvs.dll (file missing)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Prog\avast\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Prog\avast\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Prog\avast\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Prog\avast\ashWebSv.exe

O23 - Service: Droppix Service - Droppix - C:\Program Files\Fichiers communs\Droppix\DxService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

O24 - Desktop Component 0: Privacy Protection - (no file)

 

--

End of file - 10430 bytes

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Relance hijackThis, coche ces lignes et clique sur le bouton fix checked, en bas à gauche :

O2 - BHO: (no name) - {FA5C4026-14B7-4FE2-8A6E-2787E9486A40} - C:\WINDOWS\system32\vtUNFwWQ.dll (file missing)

O4 - HKLM\..\Run: [bMaea4f2aa] Rundll32.exe "C:\WINDOWS\system32\fexrojbk.dll",s

O20 - Winlogon Notify: efcaxvs - efcaxvs.dll (file missing)

O24 - Desktop Component 0: Privacy Protection - (no file)

 

Ensuite, sélectionne entièrement l'encadré ci-dessous , puis clique droit et choisis Copier

C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe
C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1

Relance Lop S&D

Choisis cette fois ci l'Option 4 ( LopScript )

Une page blanche va s'ouvrir , clique droit dessus et choisis Coller

Ferme la page , il te sera demandé de l'enregistrer , clique sur [Enregistrer]

Ne ferme pas la fenêtre lors de la suppression !

Poste le rapport généré ( C:\lopR.txt )

 

( Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide )

thiemec Junior Member

thiemec

Posté(e)
  • Auteur
Posté(e)

voila

 

 

--------------------\\ Lop S&D 4.2.2-4 XP/Vista

 

[ Windows XP (NT 5.1) Build 2600, Service Pack 2 ]

[ USER : Thierry ] [ "C:\Lop SD" ] [ Selection : 4 ]

[ 28/07/2008 | 0:40:29.76 ] [ PC : P4-BUREAU ]

[ MAJ : 25-07-2008 | 17:45 ]

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ LopScript //////////////////////////////////

 

C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe

C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1

 

 

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION /////////////////////////////

 

Supprime! - C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@adultfriendfinder[2].txt

Supprime! - C:\DOCUME~1\Thierry\Cookies\thierry@advertising[2].txt

RestaurÚ! - Fichier Hosts

 

//////////////////////////////////////-\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

 

--------------------\\ Listing des dossiers dans APPLIC~1

 

[28/07/2008|00:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\.zreglib

[04/06/2007|17:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe

[06/03/2008|16:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Droppix

[24/07/2008|20:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink

[28/10/2007|10:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes

[27/06/2007|18:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google

[25/05/2007|19:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\hpzinstall.log

[03/02/2008|03:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft

[28/10/2007|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LightScribe

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd

[08/04/2008|23:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech

[26/07/2008|20:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes

[26/05/2008|00:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!

[08/04/2008|23:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft

[04/06/2007|17:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle

[17/07/2007|17:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime

[04/06/2007|22:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SlySoft

[03/02/2008|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

[24/05/2007|23:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec

[06/03/2008|07:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

[31/08/2007|13:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!

[25/05/2007|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion

[15/09/2007|13:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

 

[25/05/2007|00:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini

[01/12/2007|01:12] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

 

 

[31/08/2007|13:36] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

 

[24/05/2007|22:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

 

[08/04/2008|01:55] C:\DOCUME~1\Thierry\APPLIC~1\Adobe

[10/06/2008|21:22] C:\DOCUME~1\Thierry\APPLIC~1\AdobeUM

[06/03/2008|16:18] C:\DOCUME~1\Thierry\APPLIC~1\CyberLink

[25/05/2007|00:45] C:\DOCUME~1\Thierry\APPLIC~1\desktop.ini

[28/10/2007|11:49] C:\DOCUME~1\Thierry\APPLIC~1\Droppix

[28/10/2007|11:10] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink

[27/10/2007|20:55] C:\DOCUME~1\Thierry\APPLIC~1\DVD Shrink 3.0

[15/01/2008|01:32] C:\DOCUME~1\Thierry\APPLIC~1\dvdcss

[24/05/2007|23:13] C:\DOCUME~1\Thierry\APPLIC~1\Help

[24/05/2007|23:02] C:\DOCUME~1\Thierry\APPLIC~1\Identities

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\inst.exe

[24/05/2007|23:15] C:\DOCUME~1\Thierry\APPLIC~1\IsolatedStorage

[24/05/2007|23:40] C:\DOCUME~1\Thierry\APPLIC~1\Macromedia

[26/07/2008|20:03] C:\DOCUME~1\Thierry\APPLIC~1\Malwarebytes

[26/05/2008|10:07] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft

[06/06/2007|23:03] C:\DOCUME~1\Thierry\APPLIC~1\Microsoft Web Folders

[24/05/2007|23:52] C:\DOCUME~1\Thierry\APPLIC~1\Mozilla

[25/05/2007|13:53] C:\DOCUME~1\Thierry\APPLIC~1\MSNInstaller

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.cat

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.inf

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.log

[13/01/2008|12:10] C:\DOCUME~1\Thierry\APPLIC~1\pcouffin.sys

[04/06/2007|22:32] C:\DOCUME~1\Thierry\APPLIC~1\SlySoft

[13/11/2007|19:03] C:\DOCUME~1\Thierry\APPLIC~1\STOIK

[05/07/2007|15:54] C:\DOCUME~1\Thierry\APPLIC~1\Sun

[03/06/2008|23:52] C:\DOCUME~1\Thierry\APPLIC~1\UseNeXT

[21/06/2007|21:52] C:\DOCUME~1\Thierry\APPLIC~1\vlc

[27/06/2008|21:11] C:\DOCUME~1\Thierry\APPLIC~1\Vso

[03/11/2007|15:03] C:\DOCUME~1\Thierry\APPLIC~1\Yahoo!

 

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

 

[27/07/2008 23:22][--a------] C:\WINDOWS\tasks\HP Usg Daily.job

[28/07/2008 00:22][--ah-----] C:\WINDOWS\tasks\SA.DAT

[05/08/2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

 

--------------------\\ Listing des dossiers dans C:\Program Files

 

[19/01/2008|17:22] C:\Program Files\321Studios

[03/06/2007|19:21] C:\Program Files\Ahead

[11/07/2008|14:55] C:\Program Files\aMSN

[01/07/2007|17:29] C:\Program Files\aswclnr.log

[24/05/2007|23:08] C:\Program Files\ATI Technologies

[20/11/2007|19:20] C:\Program Files\Audacity

[01/09/2007|15:18] C:\Program Files\AviSynth 2.5

[24/05/2007|22:53] C:\Program Files\ComPlus Applications

[04/07/2008|07:18] C:\Program Files\CopyFaceLong

[23/06/2008|15:26] C:\Program Files\CruX

[06/03/2008|16:13] C:\Program Files\Cyberlink

[06/03/2008|16:06] C:\Program Files\Digital Photo Navigator 1.5

[28/10/2007|11:48] C:\Program Files\Droppix

[16/07/2007|17:30] C:\Program Files\DVD Decrypter

[28/10/2007|11:43] C:\Program Files\DVD Shrink

[08/09/2007|16:50] C:\Program Files\DVDFab HD Decrypter 3

[13/01/2008|12:10] C:\Program Files\DVDFab Platinum 4

[19/01/2008|15:59] C:\Program Files\Elaborate Bytes

[19/01/2008|16:49] C:\Program Files\FairUse Wizard 2

[02/04/2008|20:41] C:\Program Files\Fichiers communs

[25/05/2007|19:22] C:\Program Files\Hewlett-Packard

[26/07/2008|21:16] C:\Program Files\hjt.exe

[25/05/2007|19:22] C:\Program Files\HP

[28/10/2007|11:48] C:\Program Files\illiminable

[06/03/2008|16:14] C:\Program Files\InstallShield Installation Information

[11/06/2008|12:45] C:\Program Files\Internet Explorer

[21/10/2007|20:32] C:\Program Files\Java

[03/02/2008|03:27] C:\Program Files\Lavasoft

[08/04/2008|23:07] C:\Program Files\Logitech

[26/07/2008|20:03] C:\Program Files\Malwarebytes' Anti-Malware

[16/07/2007|22:04] C:\Program Files\Messenger

[26/05/2008|00:12] C:\Program Files\Messenger Plus! Live

[26/05/2008|00:46] C:\Program Files\Microsoft CAPICOM 2.1.0.2

[06/06/2007|23:02] C:\Program Files\microsoft frontpage

[02/06/2007|11:14] C:\Program Files\Microsoft IntelliPoint

[06/06/2007|23:03] C:\Program Files\Microsoft Office

[06/06/2007|23:07] C:\Program Files\Microsoft Visual Studio

[24/05/2007|22:54] C:\Program Files\Movie Maker

[25/07/2008|16:37] C:\Program Files\Mozilla Firefox

[25/05/2007|13:53] C:\Program Files\MSN

[24/05/2007|22:53] C:\Program Files\MSN Gaming Zone

[26/05/2008|00:12] C:\Program Files\MSN Messenger

[16/07/2007|22:01] C:\Program Files\MSXML 4.0

[24/05/2007|22:54] C:\Program Files\NetMeeting

[05/07/2007|03:05] C:\Program Files\Neuf

[24/05/2007|22:53] C:\Program Files\Online Services

[16/07/2007|22:03] C:\Program Files\Outlook Express

[28/08/2007|13:26] C:\Program Files\Pinnacle

[25/05/2007|14:07] C:\Program Files\Program Files

[04/06/2007|17:56] C:\Program Files\QuickTime

[08/09/2007|19:13] C:\Program Files\SlySoft

[03/02/2008|03:43] C:\Program Files\Spybot - Search & Destroy

[13/11/2007|19:02] C:\Program Files\STOIK Imaging

[26/07/2008|21:16] C:\Program Files\Trend Micro

[24/05/2007|23:02] C:\Program Files\Uninstall Information

[17/04/2008|23:54] C:\Program Files\UseNeXT

[25/05/2007|15:09] C:\Program Files\Winamp

[26/05/2008|00:12] C:\Program Files\Windows Live

[31/08/2007|13:25] C:\Program Files\Windows Media Connect 2

[31/08/2007|13:25] C:\Program Files\Windows Media Player

[24/05/2007|22:52] C:\Program Files\Windows NT

[24/05/2007|22:55] C:\Program Files\WindowsUpdate

[03/06/2007|20:02] C:\Program Files\WinRAR

[24/05/2007|22:57] C:\Program Files\xerox

[25/05/2007|12:54] C:\Program Files\Yahoo!

 

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

 

[05/06/2007|21:36] C:\Program Files\Fichiers communs\Adobe

[03/06/2007|20:05] C:\Program Files\Fichiers communs\Ahead

[06/06/2007|23:07] C:\Program Files\Fichiers communs\Designer

[28/10/2007|11:49] C:\Program Files\Fichiers communs\Droppix

[04/06/2007|17:18] C:\Program Files\Fichiers communs\InstallShield

[05/07/2007|15:52] C:\Program Files\Fichiers communs\Java

[28/10/2007|11:48] C:\Program Files\Fichiers communs\LightScribe

[08/04/2008|23:08] C:\Program Files\Fichiers communs\LogiShrd

[16/09/2007|23:31] C:\Program Files\Fichiers communs\Microsoft Shared

[24/05/2007|22:54] C:\Program Files\Fichiers communs\MSSoap

[25/05/2007|00:45] C:\Program Files\Fichiers communs\ODBC

[24/05/2007|22:54] C:\Program Files\Fichiers communs\Services

[25/05/2007|00:45] C:\Program Files\Fichiers communs\SpeechEngines

[16/07/2007|22:03] C:\Program Files\Fichiers communs\System

[03/02/2008|03:27] C:\Program Files\Fichiers communs\Wise Installation Wizard

 

--------------------\\ Process

 

( 53 Processus )

 

... OK !

 

--------------------\\ Recherche avec S_Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Recherche de Fichiers / Dossiers Lop

 

Aucun fichier / dossier Lop trouvé !

 

--------------------\\ Verification du Registre

 

..... OK !

 

--------------------\\ Verification du fichier Hosts

 

Fichier Hosts PROPRE

 

 

--------------------\\ Recherche de fichiers avec Catchme

 

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-07-28 00:43:06

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 18

 

--------------------\\ Recherche d'autres infections

 

--------------------\\ Cracks & Keygens ..

 

=> C:\DOCUME~1\Thierry\Recent\keygen de dvd fab express.lnk

 

 

[F:27][D:43]-> C:\DOCUME~1\Thierry\LOCALS~1\Temp

[F:2191][D:0]-> C:\DOCUME~1\Thierry\Cookies

[F:16101][D:32]-> C:\DOCUME~1\Thierry\LOCALS~1\TEMPOR~1\content.IE5

 

--------------------\\ Fin du rapport a 0:44:21.73

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Ok, poste un nouveau log Hijackthis, on finit (avec un autre outil).

Hou, le vilain Keygen. Beaucoup d'infections arrivent par les cracks...

thiemec Junior Member

thiemec

Posté(e)
  • Auteur
Posté(e)

voila... pour info plus, apparemment de prob avec antivirxp08 , mais fond d ecran blanc

 

oui :P

un petit keygen...

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:56:59, on 28/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

D:\Prog\avast\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

D:\Prog\avast\ashServ.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

D:\Prog\avast\ashDisp.exe

D:\prog\EnMixCPL.exe

D:\Prog\Winamp\winampa.exe

D:\PDVDServ.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\hphmon05.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\CyberLink\PCM4Everio\EverioService.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam10\QuickCam10.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

D:\Prog\avast\ashMaiSv.exe

D:\Prog\avast\ashWebSv.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [Autoconfigurateur WiFi Neuf] C:\Program Files\Neuf\Kit\WiFi\9wifi.exe

O4 - HKLM\..\Run: [avast!] D:\Prog\avast\ashDisp.exe

O4 - HKLM\..\Run: [EnvyHFCPL] d:\prog\EnMixCPL.exe

O4 - HKLM\..\Run: [WinampAgent] D:\Prog\Winamp\winampa.exe

O4 - HKLM\..\Run: [RemoteControl] D:\PDVDServ.exe

O4 - HKLM\..\Run: [LanguageShortcut] D:\Language\Language.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [EverioService] "C:\Program Files\CyberLink\PCM4Everio\EverioService.exe"

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [sfKg6wIPu] C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe

O4 - HKCU\..\Run: [sign Love] C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1\typeseekmpeg.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.0.0.1213 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1211745107059

O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_...geUploader4.cab

O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/a...gnerADP-1.0.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photobox.fr/discount/clients/up...er_v2.2.0.6.cab

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/a...zylomloader.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/layou...IPSUploader.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Prog\avast\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - ALWIL Software - D:\Prog\avast\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Prog\avast\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - D:\Prog\avast\ashWebSv.exe

O23 - Service: Droppix Service - Droppix - C:\Program Files\Fichiers communs\Droppix\DxService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

O24 - Desktop Component 0: Privacy Protection - (no file)

 

--

End of file - 10193 bytes

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)
oui :P

un petit keygen...

Il y a des chances que ce soit ça qui t'ait apporté une partie des infections présentes...

 

 

 

Télécharge OTMoveIt2 par OldTimer.

  • Enregistre ce fichier sur le Bureau.
  • Fais un double clic sur OTMoveIt2.exe pour lancer l'exécution de l'outil. (Note: Si tu utilises Vista, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).
  • Copie les lignes de la zone "Code" ci-dessous dans le Presse-papiers en les sélectionnant toutes puis en appuyant simultanément sur les touches CTRL et C (ou, après les avoir sélectionnées, en faisant un clic droit puis en choisissant Copier):
    C:\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe
C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1\typeseekmpeg.exe
EmptyTemp


  • Retourne dans la fenêtre de OTMoveIt2, fais un clic droit dans la zone de gauche intitulée "Paste List Of Files/Folders to Move" (sous la barre jaune) puis choisir Coller.
  • Clique sur le bouton rouge Moveit!.
  • Ferme OTMoveIt2
  • Poste dans ta prochaine réponse le rapport de OTMoveIt2 (contenu du fichier SystemDrive\_OTMoveIt\MovedFiles\********_******.log - les *** sont des chiffres représentant la date [moisjourannée] et l'heure)
    [SystemDrive représente la partition sur laquelle est installé le système, généralement C:]

Note: Si un fichier ou un dossier ne peut pas être déplacé immédiatement, un redémarrage sera peut-être nécessaire pour permettre de terminer le processus de déplacement. Si le redémarrage de la machine vous est demandé, choisir Oui/Yes.

thiemec Junior Member

thiemec

Posté(e)
  • Auteur
Posté(e)

File/Folder :\Documents and Settings\Thierry\Application Data\Microsoft\Windows\jcauhi.exe not found.

File/Folder C:\DOCUME~1\Thierry\APPLIC~1\COPYFA~1\typeseekmpeg.exe not found.

< EmptyTemp >

File delete failed. C:\DOCUME~1\Thierry\LOCALS~1\Temp\ mon004.log scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\Thierry\LOCALS~1\Temp\Perflib_Perfdata_b4.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_640.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.

Temp folders emptied.

IE temp folders emptied.

 

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07282008_010650

 

Files moved on Reboot...

C:\DOCUME~1\Thierry\LOCALS~1\Temp\ mon004.log moved successfully.

File C:\DOCUME~1\Thierry\LOCALS~1\Temp\Perflib_Perfdata_b4.dat not found!

File C:\WINDOWS\temp\Perflib_Perfdata_640.dat not found!

File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...