[Résolu] Impossibilité d'installer Spyboot

Syrius · le 6 juin 2009

Re,

Le rapport Tollbar :

-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )

BIOS : BIOS Date: 05/20/08 17:31:05 Ver: 08.00.12

USER : Didier ( Administrator )

BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.26 (Activated)

Firewall : ZoneAlarm Firewall 7.0.483.000 (Activated)

C:\ (Local Disk) - NTFS - Total:232 Go (Free:198 Go)

D:\ (CD or DVD)

E:\ (USB)

F:\ (USB)

G:\ (USB)

H:\ (USB)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [2] ( 06/06/2009|22:38 )

-----------\\ SUPPRESSION

Supprime! - [service] ASKService

Supprime! - [service] ASKUpgrade

Supprime! - C:\Program Files\AskBarDis\bar

Supprime! - C:\Program Files\AskBarDis\unins000.dat

Supprime! - C:\Program Files\AskBarDis\unins000.exe

Supprime! - C:\Program Files\AskBarDis

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ Extensions

(Didier) - {b66bc4c3-6d25-4a10-8c59-01daa9063051} => foxgame

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Start Page"="http://fr.msn.com/"

"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Start Page"="http://www.msn.com/"

--------------------\\ Recherche d'autres infections

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters]

NameServer REG_SZ 85.255.112.151,85.255.112.207

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\..\{1F25289F-0614-4995-A723-ADF6DBE613A9}]

NameServer REG_SZ 85.255.112.151,85.255.112.207

==> WAREOUT <==

1 - "C:\ToolBar SD\TB_1.txt" - 06/06/2009|22:11 - Option : [1]

2 - "C:\ToolBar SD\TB_2.txt" - 06/06/2009|22:39 - Option : [2]

-----------\\ Fin du rapport a 22:39:07,84

Et le rapport OTMoveIt3 :

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== FILES ==========

c:\windows\Internet Logs\xDB1.tmp moved successfully.

c:\windows\Internet Logs\xDB2.tmp moved successfully.

c:\windows\Internet Logs\xDB3.tmp moved successfully.

c:\windows\Internet Logs\xDB4.tmp moved successfully.

c:\windows\Internet Logs\xDB5.tmp moved successfully.

========== REGISTRY ==========

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\Didier\LOCALS~1\Temp\etilqs_BVOqgU5gnlrixyegzGeD scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Internet Explorer cache folder emptied.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Temporary Internet Files\Content.IE5\7HC21MJE\CA447JB0CAR2LHKBCAG94F0LCAJ9I24DCAUPKHJMCAJEBYQNCA2LH9RXCA5UJRDQCA5HUPORCAT

TVA74CA4S1YXVCAYBQ0LRCAJW3E0TCAJ3UJIPCA2JURJTCAS7Z2MSCAIY71TOCA80PZNCCA7ZXGCBCAUZ

ZR61 scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

User's Temporary Internet Files folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.

Local Service Temp folder emptied.

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

Local Service Temporary Internet Files folder emptied.

Network Service Temp folder emptied.

Network Service Temporary Internet Files folder emptied.

File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_10c.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\spnserv.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\spserv.dat scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\ZLT04d0a.TMP scheduled to be deleted on reboot.

File delete failed. C:\WINDOWS\temp\ZLT04d0d.TMP scheduled to be deleted on reboot.

Windows Temp folder emptied.

Java cache emptied.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Didier\Local Settings\Application Data\Mozilla\Firefox\Profiles\hlfyzubj.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 06062009_224150

Apollo · le 6 juin 2009

Re,

Si le pc n'a pas été redémarré, fais-le pour qu'OtMoveIt finisse son travail.

Si cela a été fait:

Télécharge SmitfraudFix sur ton bureau.

Double-clique sur smitfraudfix.exe
Sous Vista --> clic droit Exécuter en temps qu'administrateur.
Sélectionne 1 pour créer un rapport des fichiers responsables de l'infection.
Poste le rapport sur le forum dans ta prochaine réponse.
Process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

NB: Si vous disposez de Kaspersky, utilisez l'un de ces deux miroirs pour télécharger SFF.

http://siri.geekstogo.com/SmitfraudFix.exe

http://downloads.securitycadets.com/SmitfraudFix.exe

@++

Syrius · le 6 juin 2009

Le rapport de SmitfraudFix :

SmitFraudFix v2.419

Rapport fait à 23:21:57,85, 06/06/2009

Executé à partir de C:\Program Files\Mozilla Firefox\SmitfraudFix

OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT

Le type du système de fichiers est NTFS

Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Program Files\Fichiers communs\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0K2.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Didier\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe

C:\Documents and Settings\Didier\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\SmitfraudFix\Policies.exe

C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Didier

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Didier\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Didier\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Didier\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch