Virus trojan.goldun

syl67 · le 1 novembre 2008

Merci Thanos,

Voici le rapport log.txt (je te préviens c'est long ! bonne lecture et à +

Syl67

Logfile of random's system information tool 1.04 (written by random/random)

Run by Sylvie at 2008-11-01 15:59:42

Microsoft Windows XP Édition familiale Service Pack 3

System drive D: has 46 GB (62%) free of 74 GB

Total RAM: 255 MB (23% free)

HijackThis download failed

======Scheduled tasks folder======

D:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur - Sylvie.job

D:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur.job

D:\WINDOWS\tasks\Symantec NetDetect.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

Google Toolbar Notifier BHO - D:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-28 652784]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"ccApp"=D:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe [2006-04-04 71304]

"URLLSTCK.exe"=D:\Program Files\Norton Internet Security\UrlLstCk.exe [2004-01-27 70760]

"NvCplDaemon"=D:\WINDOWS\System32\NvCpl.dll [2003-10-06 5058560]

"nwiz"=nwiz.exe /install []

"NeroCheck"=D:\WINDOWS\System32\\NeroCheck.exe [2001-07-09 155648]

"QuickTime Task"=D:\Program Files\QuickTime\qttask.exe [2004-03-20 98304]

"SunJavaUpdateSched"=D:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe [2004-02-22 32881]

"Cmaudio"=RunDll32 cmicnfg.cpl []

"Symantec NetDriver Monitor"=D:\PROGRA~1\SYMNET~1\SNDMon.exe [2005-04-29 100056]

"ImInstaller_IncrediMail"=D:\DOCUME~1\Sylvie\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe -startup -product IncrediMail []

"Google Desktop Search"=D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-02-07 1836544]

"zzz_ImInstaller_IncrediMail"=D:\DOCUME~1\Sylvie\LOCALS~1\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe -startup -product IncrediMail []

"TkBellExe"=D:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2007-09-13 185632]

"ISTray"=D:\Program Files\Spyware Doctor\pctsTray.exe [2008-07-16 1166216]

"Adobe Reader Speed Launcher"=D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=D:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"swg"=D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-05-27 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

D:\Program Files\Ahead\InCD\InCD.exe [2003-05-14 970802]

D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

DSLMON.lnk - D:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="D:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

D:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\adiusbaw.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\adiusbaw.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"D:\WINDOWS\Temporary Internet Files\Content.IE5\P8K3LD85\incredimail_install[1].exe"="D:\WINDOWS\Temporary Internet Files\Content.IE5\P8K3LD85\incredimail_install[1].exe:*:Enabled:IncrediMail Installer"

"D:\Documents and Settings\Sylvie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe"="D:\Documents and Settings\Sylvie\Local Settings\Temp\ImInstaller\IncrediMail\incredimail_install[1].exe:*:Enabled:IncrediMail Installer"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

"D:\WINDOWS\Temporary Internet Files\Content.IE5\75BCLZFK\incredimail_install[1].exe"="D:\WINDOWS\Temporary Internet Files\Content.IE5\75BCLZFK\incredimail_install[1].exe:*:Enabled:IncrediMail Installer"

"D:\WINDOWS\Temporary Internet Files\Content.IE5\IJPDAKR3\incredimail_install[1].exe"="D:\WINDOWS\Temporary Internet Files\Content.IE5\IJPDAKR3\incredimail_install[1].exe:*:Enabled:IncrediMail Installer"

"D:\Program Files\Messenger\msmsgs.exe"="D:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2008-11-01 13:14:43 ----D---- D:\Documents and Settings\Sylvie\Application Data\Malwarebytes

2008-11-01 13:14:06 ----D---- D:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-11-01 13:13:50 ----D---- D:\Program Files\Malwarebytes' Anti-Malware

2008-10-26 13:53:04 ----HDC---- D:\WINDOWS\$NtUninstallKB951978$

2008-10-24 21:30:47 ----D---- D:\WINDOWS\Prefetch

2008-10-24 19:54:54 ----HDC---- D:\WINDOWS\$NtUninstallKB958644$

2008-10-24 19:52:15 ----HDC---- D:\WINDOWS\$NtUninstallKB957095$

2008-10-24 19:48:16 ----HDC---- D:\WINDOWS\$NtUninstallKB956841$

2008-10-24 19:45:44 ----HDC---- D:\WINDOWS\$NtUninstallKB956803$

2008-10-24 19:43:10 ----HDC---- D:\WINDOWS\$NtUninstallKB954211$

2008-10-24 19:41:18 ----HDC---- D:\WINDOWS\$NtUninstallKB952954$

2008-10-24 19:39:04 ----HDC---- D:\WINDOWS\$NtUninstallKB952287$

2008-10-24 19:34:51 ----HDC---- D:\WINDOWS\$NtUninstallKB951748$

2008-10-24 19:34:09 ----HDC---- D:\WINDOWS\$NtUninstallKB951698$

2008-10-24 19:33:41 ----HDC---- D:\WINDOWS\$NtUninstallKB951376-v2$

2008-10-24 19:33:15 ----HDC---- D:\WINDOWS\$NtUninstallKB951376$

2008-10-24 19:32:39 ----HDC---- D:\WINDOWS\$NtUninstallKB951066$

2008-10-24 19:32:07 ----HDC---- D:\WINDOWS\$NtUninstallKB950974$

2008-10-24 19:31:21 ----HDC---- D:\WINDOWS\$NtUninstallKB950762$

2008-10-24 19:26:44 ----HDC---- D:\WINDOWS\$NtUninstallKB946648$

2008-10-24 19:17:53 ----HDC---- D:\WINDOWS\$NtUninstallKB938464$

2008-10-24 18:44:17 ----D---- D:\WINDOWS\l2schemas

2008-10-24 18:44:12 ----D---- D:\WINDOWS\system32\fr

2008-10-23 22:45:04 ----HDC---- D:\WINDOWS\$NtUninstallKB958644_0$

2008-10-23 21:45:27 ----N---- D:\WINDOWS\system32\wmphoto.dll

2008-10-23 21:45:24 ----N---- D:\WINDOWS\system32\wlanapi.dll

2008-10-23 21:45:20 ----N---- D:\WINDOWS\system32\windowscodecsext.dll

2008-10-23 21:45:20 ----N---- D:\WINDOWS\system32\windowscodecs.dll

2008-10-23 21:44:43 ----N---- D:\WINDOWS\system32\tspkg.dll

2008-10-23 21:44:42 ----N---- D:\WINDOWS\system32\tsgqec.dll

2008-10-23 21:44:22 ----N---- D:\WINDOWS\system32\setupn.exe

2008-10-23 21:44:17 ----N---- D:\WINDOWS\system32\rhttpaa.dll

2008-10-23 21:44:14 ----N---- D:\WINDOWS\system32\rasqec.dll

2008-10-23 21:44:13 ----N---- D:\WINDOWS\system32\qutil.dll

2008-10-23 21:44:11 ----N---- D:\WINDOWS\system32\qcliprov.dll

2008-10-23 21:44:11 ----N---- D:\WINDOWS\system32\qagentrt.dll

2008-10-23 21:44:11 ----N---- D:\WINDOWS\system32\qagent.dll

2008-10-23 21:44:09 ----N---- D:\WINDOWS\system32\photometadatahandler.dll

2008-10-23 21:44:04 ----N---- D:\WINDOWS\system32\onex.dll

2008-10-23 21:43:50 ----N---- D:\WINDOWS\system32\napstat.exe

2008-10-23 21:43:50 ----N---- D:\WINDOWS\system32\napmontr.dll

2008-10-23 21:43:50 ----N---- D:\WINDOWS\system32\napipsec.dll

2008-10-23 21:43:48 ----N---- D:\WINDOWS\system32\msxml6r.dll

2008-10-23 21:43:48 ----N---- D:\WINDOWS\system32\msxml6.dll

2008-10-23 21:43:45 ----N---- D:\WINDOWS\system32\msshavmsg.dll

2008-10-23 21:43:45 ----N---- D:\WINDOWS\system32\mssha.dll

2008-10-23 21:42:58 ----N---- D:\WINDOWS\system32\mmcperf.exe

2008-10-23 21:42:57 ----N---- D:\WINDOWS\system32\mmcfxcommon.dll

2008-10-23 21:42:57 ----N---- D:\WINDOWS\system32\mmcex.dll

2008-10-23 21:42:57 ----N---- D:\WINDOWS\system32\microsoft.managementconsole.dll

2008-10-23 21:42:39 ----N---- D:\WINDOWS\system32\l2gpstore.dll

2008-10-23 21:42:36 ----N---- D:\WINDOWS\system32\kmsvc.dll

2008-10-23 21:42:35 ----N---- D:\WINDOWS\system32\kbdpash.dll

2008-10-23 21:42:35 ----N---- D:\WINDOWS\system32\kbdnepr.dll

2008-10-23 21:42:34 ----N---- D:\WINDOWS\system32\kbdiultn.dll

2008-10-23 21:42:34 ----N---- D:\WINDOWS\system32\kbdbhc.dll

2008-10-23 21:41:42 ----A---- D:\WINDOWS\005613_.tmp

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eapsvc.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eapqec.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eappprxy.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eapphost.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eappgnui.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eappcfg.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eapp3hst.dll

2008-10-23 21:41:34 ----N---- D:\WINDOWS\system32\eapolqec.dll

2008-10-23 21:41:29 ----N---- D:\WINDOWS\system32\dot3ui.dll

2008-10-23 21:41:29 ----N---- D:\WINDOWS\system32\dot3svc.dll

2008-10-23 21:41:28 ----N---- D:\WINDOWS\system32\dot3msm.dll

2008-10-23 21:41:28 ----N---- D:\WINDOWS\system32\dot3gpclnt.dll

2008-10-23 21:41:28 ----N---- D:\WINDOWS\system32\dot3dlg.dll

2008-10-23 21:41:28 ----N---- D:\WINDOWS\system32\dot3cfg.dll

2008-10-23 21:41:28 ----N---- D:\WINDOWS\system32\dot3api.dll

2008-10-23 21:41:25 ----N---- D:\WINDOWS\system32\dimsroam.dll

2008-10-23 21:41:25 ----N---- D:\WINDOWS\system32\dimsntfy.dll

2008-10-23 21:41:02 ----N---- D:\WINDOWS\system32\dhcpqec.dll

2008-10-23 21:40:54 ----N---- D:\WINDOWS\system32\credssp.dll

2008-10-23 21:40:16 ----N---- D:\WINDOWS\system32\bitsprx4.dll

2008-10-23 21:40:15 ----N---- D:\WINDOWS\system32\azroles.dll

2008-10-23 21:39:05 ----N---- D:\WINDOWS\system32\aaclient.dll

2008-10-14 23:26:15 ----HDC---- D:\WINDOWS\$NtUninstallKB956803_0$

2008-10-14 23:26:06 ----HDC---- D:\WINDOWS\$NtUninstallKB956391$

2008-10-14 23:25:54 ----HDC---- D:\WINDOWS\$NtUninstallKB957095_0$

2008-10-14 23:24:33 ----HDC---- D:\WINDOWS\$NtUninstallKB954211_0$

2008-10-14 23:23:39 ----HDC---- D:\WINDOWS\$NtUninstallKB956841_0$

2008-10-14 22:16:21 ----D---- D:\Program Files\trend micro

2008-10-14 22:15:36 ----D---- D:\rsit

======List of files/folders modified in the last 1 months======

2008-11-01 15:58:02 ----D---- D:\WINDOWS\Temp

2008-11-01 15:56:31 ----D---- D:\Program Files\Mozilla Firefox

2008-11-01 15:18:04 ----AD---- D:\Documents and Settings\All Users\Application Data\TEMP

2008-11-01 14:50:53 ----RD---- D:\Program Files

2008-11-01 14:50:53 ----D---- D:\Program Files\Fichiers communs

2008-11-01 14:50:31 ----D---- D:\WINDOWS\system32\drivers

2008-11-01 14:50:31 ----D---- D:\WINDOWS\system32

2008-11-01 14:50:00 ----A---- D:\WINDOWS\SchedLgU.Txt

2008-11-01 13:15:31 ----D---- D:\Program Files\Fichiers communs\Symantec Shared

2008-10-31 23:07:48 ----D---- D:\Documents and Settings\All Users\Application Data\Google Updater

2008-10-31 22:50:28 ----D---- D:\Program Files\Spyware Doctor

2008-10-31 22:30:50 ----A---- D:\WINDOWS\system32\PerfStringBackup.INI

2008-10-26 18:25:24 ----D---- D:\WINDOWS

2008-10-26 13:53:22 ----HD---- D:\WINDOWS\inf

2008-10-26 13:53:11 ----RSHDC---- D:\WINDOWS\system32\dllcache

2008-10-26 10:05:35 ----D---- D:\WINDOWS\system32\CatRoot2

2008-10-26 10:01:43 ----HD---- D:\WINDOWS\$hf_mig$

2008-10-24 21:32:09 ----A---- D:\WINDOWS\OEWABLog.txt

2008-10-24 21:30:51 ----A---- D:\WINDOWS\setuplog.txt

2008-10-24 21:30:19 ----D---- D:\WINDOWS\system32\Setup

2008-10-24 21:30:19 ----D---- D:\WINDOWS\AppPatch

2008-10-24 21:30:19 ----D---- D:\Program Files\Messenger

2008-10-24 21:30:18 ----D---- D:\WINDOWS\system32\wbem

2008-10-24 21:30:17 ----RSD---- D:\WINDOWS\Fonts

2008-10-24 21:29:03 ----D---- D:\WINDOWS\security

2008-10-24 19:56:40 ----A---- D:\WINDOWS\imsins.BAK

2008-10-24 19:56:26 ----D---- D:\WINDOWS\system32\CatRoot

2008-10-24 18:46:43 ----D---- D:\WINDOWS\WinSxS

2008-10-24 18:46:15 ----D---- D:\WINDOWS\ServicePackFiles

2008-10-24 18:45:59 ----D---- D:\WINDOWS\network diagnostic

2008-10-24 18:45:58 ----D---- D:\WINDOWS\ime

2008-10-24 18:45:55 ----D---- D:\WINDOWS\Help

2008-10-24 18:44:50 ----D---- D:\WINDOWS\system32\fr-fr

2008-10-24 18:44:45 ----D---- D:\WINDOWS\system32\usmt

2008-10-24 18:44:13 ----SHD---- D:\WINDOWS\Installer

2008-10-24 18:44:10 ----D---- D:\WINDOWS\system32\bits

2008-10-24 18:44:10 ----D---- D:\WINDOWS\PeerNet

2008-10-24 18:44:08 ----D---- D:\Program Files\Movie Maker

2008-10-24 18:28:10 ----D---- D:\WINDOWS\system32\Restore

2008-10-24 18:28:09 ----D---- D:\WINDOWS\system32\npp

2008-10-24 18:28:06 ----D---- D:\WINDOWS\msagent

2008-10-24 18:28:03 ----D---- D:\WINDOWS\srchasst

2008-10-24 18:27:57 ----D---- D:\Program Files\NetMeeting

2008-10-24 18:27:54 ----D---- D:\WINDOWS\system32\Com

2008-10-24 18:27:19 ----D---- D:\Program Files\Windows Media Player

2008-10-24 18:27:18 ----D---- D:\Program Files\Windows NT

2008-10-24 18:27:17 ----D---- D:\Program Files\Outlook Express

2008-10-24 18:27:11 ----D---- D:\Program Files\Fichiers communs\System

2008-10-24 18:26:38 ----D---- D:\WINDOWS\system32\oobe

2008-10-24 18:26:34 ----D---- D:\WINDOWS\system

2008-10-24 18:18:32 ----D---- D:\WINDOWS\system32\ReinstallBackups

2008-10-24 18:17:44 ----HDC---- D:\WINDOWS\$NtServicePackUninstall$

2008-10-24 18:02:04 ----D---- D:\WINDOWS\EHome

2008-10-22 23:27:13 ----D---- D:\WINDOWS\Debug

2008-10-15 17:35:43 ----A---- D:\WINDOWS\system32\netapi32.dll

2008-10-14 23:25:22 ----D---- D:\Program Files\Internet Explorer

2008-10-07 20:19:40 ----A---- D:\WINDOWS\system32\MRT.exe

2008-10-06 19:40:52 ----D---- D:\Program Files\Picasa2

2008-10-04 11:16:20 ----SD---- D:\WINDOWS\Downloaded Program Files

2008-10-03 22:49:00 ----D---- D:\Documents and Settings\Sylvie\Application Data\Mozilla

2008-10-03 18:12:27 ----A---- D:\WINDOWS\system32\ieframe.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 IkSysFlt;System Filter Driver; D:\WINDOWS\system32\drivers\iksysflt.sys [2008-06-02 66952]

R1 IKSysSec;System Security Driver; D:\WINDOWS\system32\drivers\iksyssec.sys [2008-06-10 81288]

R1 InCDPass;InCdPass; D:\WINDOWS\System32\DRIVERS\InCDPass.sys [2003-05-14 26336]

R1 incdrm;InCD EasyWrite Reader; D:\WINDOWS\system32\drivers\incdrm.sys [2003-04-25 23920]

R1 intelppm;Pilote de processeur Intel; D:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40576]

R1 SAVRTPEL;SAVRTPEL; \??\D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []

R1 SYMTDI;SYMTDI; D:\WINDOWS\System32\Drivers\SYMTDI.SYS [2005-04-05 267192]

R3 Arp1394;Protocole client ARP 1394; D:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]

R3 cmuda;C-Media WDM Audio Interface; D:\WINDOWS\system32\drivers\cmuda.sys [2003-09-12 745920]

R3 Intels51;Creatix V.9X DSP Data Fax Modem; D:\WINDOWS\System32\DRIVERS\ctxs51.sys [2003-05-22 670203]

R3 ms_mpu401;Pilote UART MIDI MPU-401 Microsoft; D:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944]

R3 NAVENG;NAVENG; \??\D:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20081029.003\NAVENG.Sys []

R3 NAVEX15;NAVEX15; \??\D:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20081029.003\NavEx15.Sys []

R3 NIC1394;Pilote réseau 1394; D:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]

R3 nv;nv; D:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-10-06 1550043]

R3 SAVRT;SAVRT; \??\D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []

R3 SISNIC;Pilote de carte Fast Ethernet PCI SiS; D:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-04 32768]

R3 SYMDNS;SYMDNS; D:\WINDOWS\System32\Drivers\SYMDNS.SYS [2005-04-05 11512]

R3 SymEvent;SymEvent; \??\D:\Program Files\Symantec\SYMEVENT.SYS []

R3 SYMFW;SYMFW; D:\WINDOWS\System32\Drivers\SYMFW.SYS [2005-04-05 173208]

R3 SYMIDS;SYMIDS; D:\WINDOWS\System32\Drivers\SYMIDS.SYS [2005-04-05 36984]

R3 SYMIDSCO;SYMIDSCO; \??\D:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20081031.001\symidsco.sys []

R3 SYMNDIS;SYMNDIS; D:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2005-04-05 47192]

R3 SYMREDRV;SYMREDRV; D:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2005-04-05 17976]

R3 usbehci;Pilote miniport de contrôleur hôte amélioré USB 2.0 Microsoft; D:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;Concentrateur USB2; D:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; D:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]

R3 usbstor;Pilote de stockage de masse USB; D:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

R4 InCDfs;InCD File System; D:\WINDOWS\system32\drivers\InCDfs.sys [2003-05-14 85296]

S1 adiusbaw;USB ADSL WAN Adapter; D:\WINDOWS\System32\DRIVERS\adiusbaw.sys []

S2 ADILOADER;General Purpose USB Driver (adildr.sys); D:\WINDOWS\System32\Drivers\adildr.sys [2003-07-17 46167]

S3 adiusbae;USB ADSL LAN Adapter; D:\WINDOWS\system32\DRIVERS\adiusbae.sys [2003-09-29 117673]

S3 SiS7018;Service pour le pilote d'échantillonnage AC'97 (WDM); D:\WINDOWS\system32\drivers\ac97sis.sys [2001-08-17 297728]

S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; D:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]

S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; D:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

S4 IntelIde;IntelIde; D:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ccEvtMgr;Symantec Event Manager; D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [2006-04-04 255624]

R2 ccProxy;Symantec Network Proxy; D:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe [2005-03-21 218712]

R2 ccSetMgr;Symantec Settings Manager; D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [2006-04-04 235144]

R2 gusvc;Google Updater Service; D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-28 168432]

R2 InCDsrv;InCD File System Service; D:\Program Files\Ahead\InCD\InCDsrv.exe [2003-05-14 753716]

R2 navapsvc;Service Norton AntiVirus Auto-Protect; D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2005-07-07 158832]

R2 NVSvc;NVIDIA Display Driver Service; D:\WINDOWS\System32\nvsvc32.exe [2003-10-06 81920]

R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique; D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-02-20 100032]

R2 sdAuxService;PC Tools Auxiliary Service; D:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]

R2 sdCoreService;PC Tools Security Service; D:\Program Files\Spyware Doctor\pctsSvc.exe [2008-08-07 1073544]

R2 SNDSrvc;Symantec Network Drivers Service; D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe [2005-04-05 206552]

R2 SymWSC;SymWMI Service; D:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe [2004-11-02 316544]

R3 SAVScan;SAVScan; D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe [2005-01-25 194272]

S2 SBService;ScriptBlocking Service; D:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe [2003-06-24 66784]

S3 aspnet_state;Service d'état ASP.NET; D:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]

S3 ccPwdSvc;Symantec Password Validation; D:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe [2006-04-04 87688]

S3 LiveUpdate;LiveUpdate; D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE [2006-02-20 2041536]

S3 ose;Office Source Engine; D:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; D:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]

S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; D:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

syl67 · le 1 novembre 2008

Re-salut !

En ce qui concerne la 2e étape : JavaRa.zip ....

je n'ai pas pu aller + loin que "search for updates"

blocage au niveau de l'opt° "update using jucheck.exe

Puis je lancer la recherche avec la 2e opt° proposée ""update using sun java's website?

Merci d'avance - A +

Syl67

Thanos · le 1 novembre 2008

salut

blocage au niveau de l'opt° "update using jucheck.exe

Il est possible que le parefeu intégré à Norton ait bloqué le processus jucheck.exe : as tu reçu une alerte de la part de Norton ?

Puis je lancer la recherche avec la 2e opt° proposée ""update using sun java's website?
Merci d'avance - A +

Oui, bien sûr Une fois que tu as cliqué sur le bouton Search for Update > coche le bouton radio "update using sun java's website" > clique sur les boutons Search > Open WebPage > La page internet s'ouvre > choisis le premier lien > Java SE Runtime Environment (JRE) 6 Update 10 et télécharge le fichier sur ton Bureau.

Installe le programme.

Une fois ceci fait, relance JavaRa puis clique sur le bouton Remove Older Versions et poste le rapport généré stp.

Ton rapport RSIT ne montre rien de mauvais, mais je vais te demander de faire un dernier scan pour nous assurer que tout va bien >>

Assure toi que les contrôles activeX soient bien configurés dans les options internet comme décrit sur ce lien=> Cybersécurité

Fais un scan en ligne Kaspersky
Clique sur Accept
Une barre jaune va te demander si tu acceptes d'installer le Kavwebscan_Unicode.cab, installe l'Active X.
clique une nouvelle fois sur "Accept"
Les bases de mises à jour vont s'installer, patiente un moment
Clique sur Next.
Clique sur My Computer, le scan se met en route; attends la fin du scan sans fermer la fenêtre sinon il s'arrêtera.

A la fin du scan, si des objets infectés sont découverts, clique sur Save report as... Choisis bureau et nomme le rapport "rapport Kaspersky" et dans le champ d'enregistrement, choisis "fichiers texte" enregistre alors le rapport.

Copie/colle la totalité du fichier texte ouvert, par clic droit dessus, sélectionner tout/copier.

Colle ce rapport dans ta réponse sur le forum.

Aide en cas de problème :Cybersécurité

NOTE: Le scan est à faire avec Internet Explorer.

Poste aussi le rapport.

Question: est ce que tu n'as pas oublié de télécharger Hijackthis comme demandé dans le point 3 de ma précédente procédure?

@+

syl67 · le 2 novembre 2008

bonsoir Thanos,

Merci. voici déja le rapport :

JavaRa 1.11 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Nov 02 21:23:58 2008

Found and removed: D:\Windows\System32\jpicpl32.cpl

Found and removed: D:\Windows\Installer\{7148F0A8-6813-11D6-A77B-00B0D0142040}

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.4

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7148F0A8-6813-11D6-A77B-00B0D0142040}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F841731866D117AB7000B0D410204

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F841731866D117AB7000B0D410204

Found and removed: SOFTWARE\Classes\JavaPlugin.142_04

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.4.2_04

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.4.2_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.4.2_04

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

------------------------------------

Finished reporting.

Je m'occupe maint. du scan suivant.

@ +

syl67

syl67 · le 2 novembre 2008

Rebonsoir,

J'ai suivi la 3e étape de la procédure précéd. (Hijackthis ...) (un rapport s'est affiché je peux te l'envoyer sur demande)

Puis j'ai exécuter la 4e étape (c.a.d. relancé RSIT.exe)

Voici le rapport log.tex

Logfile of random's system information tool 1.04 (written by random/random)

Run by Sylvie at 2008-11-02 21:44:38

Microsoft Windows XP Édition familiale Service Pack 3

System drive D: has 46 GB (62%) free of 74 GB

Total RAM: 255 MB (21% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:45:30, on 02/11/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer.EXE

D:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

D:\Program Files\QuickTime\qttask.exe

D:\WINDOWS\system32\RunDll32.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\Program Files\Spyware Doctor\pctsTray.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

D:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exe

D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

D:\Program Files\Ahead\InCD\InCDsrv.exe

D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

D:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

D:\WINDOWS\System32\nvsvc32.exe

D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

D:\Program Files\Spyware Doctor\pctsAuxs.exe

D:\Program Files\Spyware Doctor\pctsSvc.exe

D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

D:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

D:\PROGRA~1\INCRED~1\bin\IMApp.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Documents and Settings\Sylvie\Bureau\HiJackThis.exe

D:\Documents and Settings\Sylvie\Bureau\RSIT.exe

D:\Program Files\Messenger\msmsgs.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - D:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: LiveUpdate - Symantec Corporation - D:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~2.EXE

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - D:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

--

End of file - 4032 bytes