rapport hijackthis (résolu)

[fchantel]

Bonjour,

 

depuis quelques temps, Norton antivirus détecte plusieurs fois par jour un virus Rookit, je n'arrive pas à m'en débarrasser.

j'ai donc effectuer un premier rapport hijack this, supprimer les fichiers infecter mais cela n'a rien changer.

je vous remercie de m'aider, voici le dernier scan avec Hijack this:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:29:15, on 08/05/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\Saitek\Software\Profiler.exe

C:\Program Files\Saitek\Software\SaiMfd.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Photo Viewer\album.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\TomTom HOME 2\HOMERunner.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Documents and Settings\Frederic\Frederic.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [PhotoViewer] C:\Program Files\Photo Viewer\album.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036

O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"

O4 - HKCU\..\Run: [Frederic] C:\Documents and Settings\Frederic\Frederic.exe /i

O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\NETWOR~1\protect.dll,_IWMPEvents@16

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: ChkDisk.dll

O4 - Startup: ChkDisk.lnk = ?

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: ILTZEQY - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Frederic\LOCALS~1\Temp\ILTZEQY.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

 

--

End of file - 8568 bytes

Modifié le 10 mai 2009 par fchantel

[Apollo]

Bonjour,

 

On va voir si un outil gratuit va faire mieux que Norton (ce qui n'est pas très dur).

 

Télécharge Malwarebytes' Anti-Malware (MBAM)

 

Si le lien ne fonctionne pas, télécharger ICI

Ce logiciel est à garder, il rendra encore de grands services!

 

Uniquement en cas de problème de mise à jour:

 

Télécharger mises à jour MBAM

Mises à jour + récentes pour MBAM

 

Exécute le fichier après l'installation de MBAM

 

Connecter les supports amovibles (clés usb etc.) avant de lancer l'analyse.

 

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen rapide"
  
• Clique sur "Rechercher"
  
• L'analyse démarre, le scan est relativement long, c'est normal.
  
• A la fin de l'analyse, un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

Si MBAM demande à redémarrer le pc, fais-le.

 

!!! Ne pas vider la quarantaine de MBAM sans avis !!!

 

Si redémarrage requis, poste un nouveau log Hijackthis après le reboot.

 

On verra s'il faut relancer une analyse complète plus tard avec ce même outil.

 

@ + tard.

[fchantel]

Merci pour votre aide:

voici le rapport de MBAM: j'ai donc supprimé les fichiers infectés

 

Malwarebytes' Anti-Malware 1.36

Version de la base de données: 2090

Windows 5.1.2600 Service Pack 2

 

08/05/2009 09:47:37

mbam-log-2009-05-08 (09-47-37).txt

 

Type de recherche: Examen rapide

Eléments examinés: 93951

Temps écoulé: 10 minute(s), 27 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 1

Clé(s) du Registre infectée(s): 22

Valeur(s) du Registre infectée(s): 2

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 140

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\autochk.dll (Trojan.FakeAlert) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\ib15_1.cbrowserhelper (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ib4.cbrowserhelper (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{0a51d436-5c4d-4a56-98d1-fcda488ce240} (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3022c80a-5a86-4161-94c8-4c7c8c4553f2} (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{14a5f3e7-b235-4d98-9264-5c67d2657bc4} (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{590ffb84-6a29-4797-9c0e-b15df2c4cdcb} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e6ce4cd-161b-4847-b8bf-e2ef72299d69} (Spyware.Sters) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{deceaaa2-370a-49bb-9362-68c3a58ddc62} (Adware.180Solutions) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ws2_32sik (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Trojan.Agent) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Dropper) -> Data: digiwet.dll -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\WINDOWS\system32\drv32dta (Stolen.Data) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Documents and Settings\Frederic\Local Settings\Temp\pdfupd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\wJQs.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temporary Internet Files\Content.IE5\P7ZB51SA\load[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temporary Internet Files\Content.IE5\QL9IZAL0\load[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\klg.tmp (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070106_104651.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070107_112909.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070108_185017.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070109_170313.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070110_184619.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070111_103536.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070111_222854.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070112_095923.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070113_093834.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070113_224051.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070114_094458.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070116_194822.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070117_193101.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070118_093644.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070118_141620.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070119_093850.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070119_184308.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070123_180142.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070124_093719.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070124_191007.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070125_175354.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070126_143242.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070127_101814.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070128_085413.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070130_190536.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070131_094943.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070201_143912.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070206_171033.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070207_094628.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070207_182450.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070208_093738.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070211_101444.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070212_145435.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070215_095246.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070215_200707.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070216_151251.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_082721.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_175656.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_180841.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_181320.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_182140.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_182648.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_182945.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_183617.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070217_190352.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_114825.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_115241.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_120346.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_121354.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_133906.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_184039.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_184623.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_185316.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_190122.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_191028.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_191939.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_220514.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_222130.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070218_224607.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_214216.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_214824.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_215321.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_221612.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_222333.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_222920.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070219_223453.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070220_224134.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070221_094608.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070221_182358.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070221_183756.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070222_102803.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070222_195556.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070226_210354.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070226_210800.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070226_211459.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070227_113607.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070228_223620.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070301_101418.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070301_193616.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070302_184659.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070304_103408.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070304_174424.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070305_182525.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070306_202023.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070307_085350.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070307_101446.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070307_184155.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070308_080910.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070309_090408.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070310_122546.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070311_071753.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070312_191119.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070313_154332.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070314_202238.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070315_101347.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070316_220416.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070324_141255.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070324_144329.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070324_221140.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070325_103806.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070326_095223.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070326_185552.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070327_195211.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070328_084406.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drv32dta\pstore_070329_101030.txt (Stolen.Data) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\autochk.dll (Trojan.Agent) -> Delete on reboot.

C:\Documents and Settings\NetworkService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\protect.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\wpv441240565622.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN2F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN34.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN46.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN47.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN55.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN60.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN61.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN6E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN6F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN72.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN87.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN8E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BN9A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BNA7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BNB2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BNBD.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\BNC9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\cina.ini (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\digiwet.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Frederic\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.

C:\Documents and Settings\Frederic\Local Settings\Temp\msb.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

[Apollo]

Ouch! Il était temps.

 

Redémarre le pc et fais ensuite un nouveau log Hijackthis stp.

 

Il faudra sûrement relancer MBAM pour analyse complète, je te dis ça après avoir lu le nouveau log.

 

@++

[fchantel]

voici le nouveau scan Hijack this après redémarrage

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:56:42, on 08/05/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\Saitek\Software\Profiler.exe

C:\Program Files\Saitek\Software\SaiMfd.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Photo Viewer\album.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\TomTom HOME 2\HOMERunner.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Frederic\Frederic.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [PhotoViewer] C:\Program Files\Photo Viewer\album.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"

O4 - HKCU\..\Run: [Frederic] C:\Documents and Settings\Frederic\Frederic.exe /i

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: ChkDisk.dll

O4 - Startup: ChkDisk.lnk = ?

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: ILTZEQY - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Frederic\LOCALS~1\Temp\ILTZEQY.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

 

--

End of file - 8278 bytes

[Apollo]

Re,

 

Il faudra penser à mettre Acrobat Reader à jour car il est bourré de failles.

De même, il faudra appliquer ces correctifs: http://www.vista-xp.fr/forum/topic3405.html

 

Relance Hijackthis avec Do a system scan only et coche les cases devant les lignes suivantes: SOUS VISTA: Clic droit sur Hijackthis/exécuter en temps qu'administrateur!

 

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: ChkDisk.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

 

Ferme toutes les applications ouvertes et les navigateurs et clique sur Fix Checked

 

===============

Relance MBAM, mais cette fois fais un examen complet; tu agis de la même manière que la première fois pour corriger les infections qui seraient encore trouvées.

 

Pense à connecter tes supports amovibles pour l'analyse. (clé usb et autres).

 

Poster le rapport ainsi qu'un nouveau log Hijackthis fait juste après.

 

@ + tard.

Modifié le 8 mai 2009 par Apollo

[fchantel]

voici le résultat du scan complet MBAM

 

Malwarebytes' Anti-Malware 1.36

Version de la base de données: 2090

Windows 5.1.2600 Service Pack 2

 

08/05/2009 11:46:48

mbam-log-2009-05-08 (11-46-48).txt

 

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 192041

Temps écoulé: 1 hour(s), 27 minute(s), 7 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 2

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 2

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\System Volume Information\_restore{A0F9BB12-32D8-4B90-A228-3F9E29993DDD}\RP760\A0155735.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A0F9BB12-32D8-4B90-A228-3F9E29993DDD}\RP763\A0155786.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

 

 

et celui de Hijackthis après avoir rebooté

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:50:59, on 08/05/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\Saitek\Software\Profiler.exe

C:\Program Files\Saitek\Software\SaiMfd.exe

C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe

C:\Program Files\Photo Viewer\album.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\TomTom HOME 2\HOMERunner.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Documents and Settings\Frederic\Frederic.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\Software\SaiMfd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

O4 - HKLM\..\Run: [PhotoViewer] C:\Program Files\Photo Viewer\album.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1036

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"

O4 - HKCU\..\Run: [Frederic] C:\Documents and Settings\Frederic\Frederic.exe /i

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: ChkDisk.dll

O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: ILTZEQY - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Frederic\LOCALS~1\Temp\ILTZEQY.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

 

--

End of file - 7530 bytes

 

 

le pb n'a pas l'air résolu, j'ai encore eu un virus Rookit détecté par Norton

merci à nouveau pour votre aide

[Apollo]

Re,

 

Norton doit bien lui donner un nom à ce rootkit.

Quel est-il?

 

Il ne faudra pas sous-estimer ce que je demande de faire au message #6.

C'est nécessaire et même indispensable, de même que de passer à une version supérieure d'Explorer.

 

@++

[fchantel]

oui, je pense à votre étape 6.

 

le nom du virus détecté par Norton est Hacktool.rootkit

directory: c:/ windows/system32/drivers/netsik.sys, celle ci est variable.

[Apollo]

Cela m'étonne que MBAM n'aie pas liquidé complètement ce rootkit.

 

Fais un scan en ligne et liquide tout ce qu'il trouve.

 

Prends le rapport à la fin stp.

 

http://www.bitdefender.fr/scan_fr/scan8/ie.html

 

@++