[resolu] Je parais infecté!!!

maykiki

Posté(e) le 26 novembre 2008

- Signaler

Posté(e) le 26 novembre 2008 (modifié)

Bonjour a tous!

Alors avant tout je vous raconte les symptomes:

Depuis peu j ai ma connexion internet (Free connecte par wifi) qui se plante et il apparait au niveau des icones en bas a droite j ai le triangle alerte qui m indique alerte systeme detectee!

Il me faut alors eteindre ma connecion et la relancer et ca remarche.

Au demarrage du pc bien souvent j ai le message conflit d adresse ip detectee.

J ai essayer de reparer la connexion dont je me sers mais procedure impossible, impossible de lancer la procedure de nettoyage du cache DNS.

J ai essaye en passant par cmd / ipconfig /flushdns, idem, impossible.

Alors infecte ou non, je sais pas!

J ai suivi votre procedure mais impossible de lancer antivir en mode sans echec, ca me marque "log database could not be initialized."

J ai alors effectue le scan en mode normal. Voila les rapports, il apparait 9 infections mais je n y connais pas grand chose alors si quelqu un peut y jeter un coup d oeil et me debloquer cette connexion et le reste si besoin!!!

Merci a vous!

Avira AntiVir Personal

Report file date: lundi 24 novembre 2008 22:20

Scanning for 1049308 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: NOM-FB9B15D2723

Version information:

BUILD.DAT : 8.2.0.336 16933 Bytes 30/10/2008 11:40:00

AVSCAN.EXE : 8.1.4.7 315649 Bytes 18/07/2008 20:36:40

AVSCAN.DLL : 8.1.4.0 40705 Bytes 18/07/2008 20:36:40

LUKE.DLL : 8.1.4.5 164097 Bytes 18/07/2008 20:36:41

LUKERES.DLL : 8.1.4.0 12033 Bytes 18/07/2008 20:36:41

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 21:42:18

ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 20:33:08

ANTIVIR2.VDF : 7.1.0.124 376832 Bytes 23/11/2008 17:17:00

ANTIVIR3.VDF : 7.1.0.131 53248 Bytes 24/11/2008 17:17:01

Engineversion : 8.2.0.35

AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 20:32:38

AESCRIPT.DLL : 8.1.1.15 332156 Bytes 12/11/2008 20:33:07

AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 20:33:41

AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 20:34:04

AEPACK.DLL : 8.1.3.4 393591 Bytes 12/11/2008 20:33:06

AEOFFICE.DLL : 8.1.0.30 196986 Bytes 07/11/2008 20:33:40

AEHEUR.DLL : 8.1.0.71 1487222 Bytes 07/11/2008 20:33:39

AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 17:05:42

AEGEN.DLL : 8.1.1.5 323956 Bytes 21/11/2008 17:11:20

AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 20:32:31

AECORE.DLL : 8.1.5.1 172406 Bytes 21/11/2008 17:11:19

AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 20:32:29

AVWINLL.DLL : 1.0.0.12 15105 Bytes 18/07/2008 20:36:40

AVPREF.DLL : 8.0.2.0 38657 Bytes 18/07/2008 20:36:40

AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 20:38:00

AVREG.DLL : 8.0.0.1 33537 Bytes 18/07/2008 20:36:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 18/04/2008 10:07:35

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 18/07/2008 20:36:40

SQLITE3.DLL : 3.3.17.1 339968 Bytes 18/04/2008 10:07:36

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 18/07/2008 20:36:41

NETNT.DLL : 8.0.0.1 7937 Bytes 18/04/2008 10:07:36

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 18/07/2008 20:36:38

RCTEXT.DLL : 8.0.52.0 86273 Bytes 18/07/2008 20:36:38

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: lundi 24 novembre 2008 22:20

Starting search for hidden objects.

'70709' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'kbd.exe' - '1' Module(s) have been scanned

Scan process 'NOKIAM~1.EXE' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'apache.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned

Scan process 'lxcrcoms.exe' - '1' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned

Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'apache.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'a2service.exe' - '1' Module(s) have been scanned

Scan process 'WG111v3.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'RegistryBooster.exe' - '1' Module(s) have been scanned

Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'sclauncher.exe' - '1' Module(s) have been scanned

Scan process 'zlclient.exe' - '0' Module(s) have been scanned

Scan process 'ezprint.exe' - '1' Module(s) have been scanned

Scan process 'lxcrmon.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'vsmon.exe' - '0' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

47 processes with 47 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '65' files ).

Starting the file scan:

Begin scan in 'C:\' <HP_PAVILION>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Program Files\eMule1\Incoming\Jeux Progs Nokia n95.rar

[0] Archive type: RAR

--> nokia N95 programmas & Games\Programma's\Best Full Screen Caller v2.00\Best Full Screen Caller 2.00 keygen.exe

[DETECTION] Is the TR/Dldr.Agent.CQI Trojan

--> nokia N95 programmas & Games\Programma's\Best TaskMan v1.00 s60v3\keygen.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

--> nokia N95 programmas & Games\Programma's\Resco Photo Viewer For S60 3rd Edition v4.40\keygen.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

--> nokia N95 programmas & Games\Programma's\Resco Photo Viewer v4.43 S60v3 Symbian OS9.1\keygen.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

--> nokia N95 programmas & Games\Programma's\Smartphoneware AIO S60 9.1 3rd incl. Keygen\keygen.exe

[DETECTION] Is the TR/Drop.VB.fhe Trojan

--> nokia N95 programmas & Games\Programma's\Smartphoneware Best Full Screen Caller v2.0 S60 3rd\keygen.exe

[DETECTION] Is the TR/Dldr.Agent.CQI Trojan

--> nokia N95 programmas & Games\Programma's\Smartphoneware Best Message Storer v1.0\Smartphoneware Best Message Storer v1.0 keygen.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

--> nokia N95 programmas & Games\Programma's\Smartphoneware Best Safe v1.0\keygen.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

--> setup.exe

[DETECTION] Contains recognition pattern of the WORM/P2P.Kapucen.Gen worm

[NOTE] The file was moved to '49a021ff.qua'!

C:\Program Files\eMule1\Temp\006.part

[0] Archive type: ZIP

--> OFFICE XP 2005 SP3 ( word excel access powerpoint frontpage ) FRENCH FRANCAIS no fake cracked by FRELON VERT/FILES/OSP/1036/IE5/FR/IELPKZHT.CAB

[1] Archive type: CAB (Microsoft)

--> ADVPACK.DLL

[WARNING] No further files can be extracted from this archive. The archive will be closed

--> OFFICE XP 2005 SP3 ( word excel access powerpoint frontpage ) FRENCH FRANCAIS no fake cracked by FRELON VERT/FILES/OSP/1036/IE5/FR/SCAIME.CAB

[1] Archive type: CAB (Microsoft)

--> dimm.dll

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <Musique, Vidéo, Photos, Papiers>

Begin scan in 'E:\' <HP_RECOVERY>

End of the scan: lundi 24 novembre 2008 23:37

Used time: 1:16:45 Hour(s)

The scan has been done completely.

12671 Scanning directories

733956 Files were scanned

9 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

3 Files cannot be scanned

733944 Files not concerned

18751 Archives were scanned

9 Warnings

1 Notes

70709 Objects were scanned with rootkit scan

0 Hidden objects were found

Logfile of HijackThis v1.99.1

Scan saved at 10:20:44, on 25/11/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Lexmark 2400 Series\lxcrmon.exe

C:\Program Files\Lexmark 2400 Series\ezprint.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\SimpleCenter\bin\win\sclauncher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe

C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

c:\xampp\apache\bin\apache.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\lxcrcoms.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\xampp\apache\bin\apache.exe

C:\PROGRA~1\FICHIE~1\Nokia\MPLATF~1\NOKIAM~1.EXE

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\hijackthis\Maykiki.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [lxcrmon.exe] "C:\Program Files\Lexmark 2400 Series\lxcrmon.exe"

O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2400 Series\ezprint.exe"

O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [sclauncher] C:\Program Files\SimpleCenter\bin\win\sclauncher.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Nokia FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S

O4 - Global Startup: NETGEAR WG111v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apache2.2 - Unknown owner - c:\xampp\apache\bin\apache.exe" -k runservice (file missing)

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: lxcr_device - - C:\WINDOWS\system32\lxcrcoms.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Modifié le 28 novembre 2008 par maykiki

Citer

Apollo

Posté(e) le 26 novembre 2008

- Signaler

Posté(e) le 26 novembre 2008

Bonsoir,

Tu ES infecté.

1. Vire tes cracks et keygens.

2. Paramètre Antivir correctement:

Primary action: quarantine.

Second: delete.

Je te recommande un scan complet avec Antivir. Mets-le à jour d'abord (clic droit, start update sur l'icône près de l'horloge).

Une fois à jour, double-clique sur son icône près de l'horloge, cela ouvre l'interface principale, puis clique sur "Scan system now" à droite de "Last complete system scan".

/!\ Cela peut être long.

Tu peux sauvegarder le rapport en fin de parcours (bouton "Report").

Si Antivir détecte des fichiers infectés, mets en quarantaine (choisis "Move to quarantine" dans la liste des actions. Tu peux automatiser ce type d'action en cochant une case), comme ci dessous :

Cela permet de ne pas rester à la surveiller.

*Désinstalle ta version d'Hijackthis par ajout/suppr de programmes et remplace-la par celle-ci:

Télécharge HijackThisV2 sur ton bureau.

Double-clique sur HJTInstall.exe et suis les instructions d'installation.
--> Sous VISTA: désactiver l'UAC comme indiqué ICI , faire un clic droit/exécuter en temps qu'administrateur
Tu trouveras un tutoriel pour l'installation et la génération d'un rapport ici
Lance le, valide le message d'avertissement, puis clique sur Do a system scan and save a logfile.
A la fin de l'analyse, le bloc-notes va s'ouvrir. Copie-colle tout son contenu ici à la suite.
Poste le rapport généré sur le forum.

@++

Citer

maykiki

Posté(e) le 26 novembre 2008

Auteur

- Signaler

Posté(e) le 26 novembre 2008

Merci a toi de m avoir repondu aussi vite!

J ai supprime les keygen et les crack, il n y a plus aucune detection au niveau d antivir, quelques warning.

Probleme de conflit toujours present.

Voila les rapports!

Avira AntiVir Personal

Report file date: mercredi 26 novembre 2008 23:29

Scanning for 1054678 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: NOM-FB9B15D2723

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 26/11/2008 21:17:20

AVSCAN.DLL : 8.1.4.0 40705 Bytes 18/07/2008 20:36:40

LUKE.DLL : 8.1.4.5 164097 Bytes 18/07/2008 20:36:41

LUKERES.DLL : 8.1.4.0 12033 Bytes 18/07/2008 20:36:41

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 21:42:18

ANTIVIR1.VDF : 7.1.0.56 411136 Bytes 09/11/2008 20:33:08

ANTIVIR2.VDF : 7.1.0.124 376832 Bytes 23/11/2008 17:17:00

ANTIVIR3.VDF : 7.1.0.143 133120 Bytes 26/11/2008 21:17:21

Engineversion : 8.2.0.35

AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 20:32:38

AESCRIPT.DLL : 8.1.1.15 332156 Bytes 12/11/2008 20:33:07

AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 20:33:41

AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 20:34:04

AEPACK.DLL : 8.1.3.4 393591 Bytes 12/11/2008 20:33:06

AEOFFICE.DLL : 8.1.0.30 196986 Bytes 07/11/2008 20:33:40

AEHEUR.DLL : 8.1.0.71 1487222 Bytes 07/11/2008 20:33:39

AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 17:05:42

AEGEN.DLL : 8.1.1.5 323956 Bytes 21/11/2008 17:11:20

AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 20:32:31

AECORE.DLL : 8.1.5.1 172406 Bytes 21/11/2008 17:11:19

AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 20:32:29

AVWINLL.DLL : 1.0.0.12 15105 Bytes 18/07/2008 20:36:40

AVPREF.DLL : 8.0.2.0 38657 Bytes 18/07/2008 20:36:40

AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 20:38:00

AVREG.DLL : 8.0.0.1 33537 Bytes 18/07/2008 20:36:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 18/04/2008 10:07:35

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 18/07/2008 20:36:40

SQLITE3.DLL : 3.3.17.1 339968 Bytes 18/04/2008 10:07:36

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 18/07/2008 20:36:41

NETNT.DLL : 8.0.0.1 7937 Bytes 18/04/2008 10:07:36

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 18/07/2008 20:36:38

RCTEXT.DLL : 8.0.52.0 86273 Bytes 18/07/2008 20:36:38

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: quarantine

Secondary action.................: delete

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: mercredi 26 novembre 2008 23:29

Starting search for hidden objects.

'70659' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avwsc.exe' - '0' Module(s) have been scanned

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'WG111v3.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'NOKIAM~1.EXE' - '1' Module(s) have been scanned

Scan process 'kbd.exe' - '1' Module(s) have been scanned

Scan process 'apache.exe' - '1' Module(s) have been scanned

Scan process 'TeaTimer.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'sclauncher.exe' - '1' Module(s) have been scanned

Scan process 'zlclient.exe' - '0' Module(s) have been scanned

Scan process 'ezprint.exe' - '1' Module(s) have been scanned

Scan process 'lxcrmon.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned

Scan process 'lxcrcoms.exe' - '1' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned

Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'apache.exe' - '1' Module(s) have been scanned

Scan process 'a2service.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'vsmon.exe' - '0' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

43 processes with 43 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] System error [21]: Le périphérique n'est pas prêt.

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '65' files ).

Starting the file scan:

Begin scan in 'C:\' <HP_PAVILION>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <Musique, Vidéo, Photos, Papiers>

Begin scan in 'E:\' <HP_RECOVERY>

End of the scan: jeudi 27 novembre 2008 00:32

Used time: 1:02:59 Hour(s)

The scan has been done completely.

12631 Scanning directories

679395 Files were scanned

0 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

679393 Files not concerned

18084 Archives were scanned

6 Warnings

0 Notes

70659 Objects were scanned with rootkit scan

0 Hidden objects were found

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:39:17, on 27/11/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\a-squared Free\a2service.exe

c:\xampp\apache\bin\apache.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\lxcrcoms.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Lexmark 2400 Series\lxcrmon.exe

C:\Program Files\Lexmark 2400 Series\ezprint.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\SimpleCenter\bin\win\sclauncher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\xampp\apache\bin\apache.exe

C:\HP\KBD\KBD.EXE

C:\PROGRA~1\FICHIE~1\Nokia\MPLATF~1\NOKIAM~1.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe