Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

avira s'est déclenché

vieuxrusé

Par vieuxrusé
dans Analyses et éradication malwares

 Partager

Messages recommandés

vieuxrusé Member

vieuxrusé

Posté(e)
Posté(e)

Bonjour à tous après qu'AVIRA se soit déclenché me signalant un trojan j'ai donc fait un scan total puis en mettant les intrus touvé en quarantaine je vous joint donc le rapport final AVIRA puis à la suite le rapport Hijack en espèrant avoir supprimé tous les malveillants j'avais fait un scan également avec malwabyte.

Pour info le PC n'est pas lent et ne plante pas

Bonne lecture merci

Vieuxrusé

 

 

 

 

Avira AntiVir Personal

Report file date: mardi 20 janvier 2009 16:01

 

Scanning for 1230368 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: XPSP2-0181848AE

 

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 16:00:19

AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 09:47:00

ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 14/01/2009 15:19:31

ANTIVIR2.VDF : 7.1.1.114 2048 Bytes 14/01/2009 15:19:32

ANTIVIR3.VDF : 7.1.1.142 385024 Bytes 19/01/2009 17:43:54

Engineversion : 8.2.0.57

AEVDF.DLL : 8.1.0.6 102772 Bytes 18/10/2008 18:58:59

AESCRIPT.DLL : 8.1.1.26 340347 Bytes 17/01/2009 15:17:24

AESCN.DLL : 8.1.1.5 123251 Bytes 08/11/2008 13:23:11

AERDL.DLL : 8.1.1.3 438645 Bytes 06/11/2008 13:17:14

AEPACK.DLL : 8.1.3.5 393588 Bytes 09/01/2009 15:17:21

AEOFFICE.DLL : 8.1.0.33 196987 Bytes 12/12/2008 17:10:37

AEHEUR.DLL : 8.1.0.84 1540471 Bytes 17/01/2009 15:17:22

AEHELP.DLL : 8.1.2.0 119159 Bytes 18/11/2008 16:59:00

AEGEN.DLL : 8.1.1.10 323957 Bytes 17/01/2009 15:17:16

AEEMU.DLL : 8.1.0.9 393588 Bytes 18/10/2008 18:58:29

AECORE.DLL : 8.1.5.2 172405 Bytes 28/11/2008 16:16:30

AEBB.DLL : 8.1.0.3 53618 Bytes 18/10/2008 18:57:52

AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 18/10/2008 18:57:51

AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: e:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: mardi 20 janvier 2009 16:01

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'update.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned

Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned

Scan process 'daemon.exe' - '1' Module(s) have been scanned

Scan process 'robotaskbaricon.exe' - '1' Module(s) have been scanned

Scan process 'NBService.exe' - '1' Module(s) have been scanned

Scan process 'hphmon04.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

33 processes with 33 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '54' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <Nouveau nom>

C:\resycled\ntldr.com

[DETECTION] Is the TR/TDss.BD.72 Trojan

[NOTE] The file was moved to '49e2e720.qua'!

C:\System Volume Information\_restore{FC376516-F458-462F-A7DC-B438450729A3}\RP94\A0052578.com

[DETECTION] Is the TR/TDss.BD.72 Trojan

[NOTE] The file was moved to '49a6ec2d.qua'!

C:\System Volume Information\_restore{FC376516-F458-462F-A7DC-B438450729A3}\RP96\A0053977.exe

[DETECTION] Contains recognition pattern of the DR/AutoTDSS.bcw.33 dropper

[NOTE] The file was moved to '49a6ec42.qua'!

C:\System Volume Information\_restore{FC376516-F458-462F-A7DC-B438450729A3}\RP97\A0054196.com

[DETECTION] Is the TR/TDss.BD.72 Trojan

[NOTE] The file was moved to '49a6ec5c.qua'!

C:\telecharfirefox\SmitfraudFix.exe

[0] Archive type: RAR SFX (self extracting)

--> SmitfraudFix\Agent.OMZ.Fix.exe

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

[NOTE] The file was moved to '49dfed07.qua'!

C:\telecharfirefox\SmitfraudFix\Agent.OMZ.Fix.exe

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

[NOTE] The file was moved to '49dbed83.qua'!

Begin scan in 'E:\'

E:\pagefile.sys

[WARNING] The file could not be opened!

E:\Program Files\Mozilla Firefox\SmitfraudFix\Agent.OMZ.Fix.exe

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

[NOTE] The file was moved to '49dbfdb6.qua'!

E:\WINDOWS\system32\Agent.OMZ.Fix.exe

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

[NOTE] The file was moved to '49dc04b1.qua'!

E:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

 

 

End of the scan: mercredi 21 janvier 2009 12:38

Used time: 20:37:45 Hour(s)

 

The scan has been done completely.

 

7428 Scanning directories

307956 Files were scanned

8 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

8 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

307946 Files not concerned

4043 Archives were scanned

2 Warnings

8 Notes

 

------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:59:12, on 21/01/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\system32\spoolsv.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

E:\Program Files\Java\jre6\bin\jqs.exe

E:\WINDOWS\system32\RUNDLL32.EXE

E:\Program Files\Java\jre6\bin\jusched.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

E:\WINDOWS\system32\hphmon04.exe

E:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe

C:\Program Files\Siber Systems\RoboTaskBarIcon.exe

c:\Program Files\CDBurnerXP\NMSAccessU.exe

E:\WINDOWS\system32\nvsvc32.exe

c:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe

E:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe

C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe

C:\logiciels\crypt\CryptLoad.exe

c:\PROGRA~1\FREEDO~1\fdm.exe

E:\Program Files\Mozilla Firefox\firefox.exe

E:\WINDOWS\system32\notepad.exe

C:\logiciels\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - c:\Program Files\Free Download Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\roboform.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [JeticoPFStartup] "c:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"

O4 - HKLM\..\Run: [HPHmon04] E:\WINDOWS\system32\hphmon04.exe

O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\RoboTaskBarIcon.exe"

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [AlcoholAutomount] "c:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "E:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "E:\WINDOWS\msagent" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "E:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "E:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')

O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = E:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Enregistrer le formulaire - file://C:\Program Files\Siber Systems\RoboFormComSavePass.html

O8 - Extra context menu item: Personnaliser le menu - file://C:\Program Files\Siber Systems\RoboFormComCustomizeIEMenu.html

O8 - Extra context menu item: Remplir le formulaire - file://C:\Program Files\Siber Systems\RoboFormComFillForms.html

O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://c:\Program Files\Free Download Manager\dlall.htm

O8 - Extra context menu item: Télécharger avec Free Download Manager - file://c:\Program Files\Free Download Manager\dllink.htm

O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://c:\Program Files\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://c:\Program Files\Free Download Manager\dlfvideo.htm

O9 - Extra button: Remplir - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\RoboFormComFillForms.html

O9 - Extra 'Tools' menuitem: Remplir le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\RoboFormComFillForms.html

O9 - Extra button: Enregistrer - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\RoboFormComSavePass.html

O9 - Extra 'Tools' menuitem: Enregistrer le formulaire - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\RoboFormComSavePass.html

O9 - Extra button: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\RoboFormComShowToolbar.html

O9 - Extra 'Tools' menuitem: Barre RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\RoboFormComShowToolbar.html

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @E:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @E:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O10 - Broken Internet access because of LSP provider 'e:\program files\bonjour\mdnsnsp.dll' missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - E:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: NMSAccessU - Unknown owner - c:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPH11 - HP - E:\WINDOWS\system32\HPHipm11.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - c:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

 

--

End of file - 8263 bytes

pear Devil Member !

pear

Posté(e)
Posté(e)

Bonjour,

 

Rien d'important .

Videz la corbeille.

Désinstallez la Restauration Système.

 

Poste de Travail->Propriétés->Restauration Système.

Cocher la case "Désactiver la Restauration sur tous les lecteurs".

Vous la décocherez ensuite.

Un nouveau point de restauration sera créé au redémarrage.

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...