PC infecté et bloqué

[Hart]

Bonjour,

 

alors, j'ai un pc qui est sur infecté, là il n'est pas en réseau et je n'arrive même pas à ouvrir le gestionnaire (ctrl alt supp) rien que ce soit ça ou msconfig ou ajout suppression de programme.

Je vais tenter de mettre hijack sur une clé et de le passer sur le pc mais une fenetre security monitor web reste affichée et tente de se connecter au net pffff

aie aie la misère lolll

 

comment puis-je être certain, si je fais des manip avec ma clé usb de ne pas m'infecter à mon tour via cette clé ???

Est-ce que si je la scan de suite avec mon AV celà limitera ET SURTOUT celà sera t'il efficace ??

 

Merci pour votre aide

Modifié le 18 août 2009 par Hart

[Hart]

bon je n'arrive pas à lancé hijackthis sur ce pc la fenêtre apparait furtivement pour disparaitre .....

 

[edit] Correction ==> j'ai réussi en Mode ss échec, je colle le rapport ci dessous [/edit]

 

Je voudrai passer Mbam mais vu que ce pc n'est chez moi pas en réseau, ai-je le moyen de télécharger ou rapatrier la dernière mise à jour ????

Je le passe en attendant mais sans mise à jour, j'ai téléchargé la dernière version.......

 

MBMAM

Malwarebytes' Anti-Malware 1.40

Version de la base de données: 2551

Windows 5.1.2600 Service Pack 2

 

19/08/2009 15:02:17

mbam-log-2009-08-19 (15-02-17).txt

 

Type de recherche: Examen rapide

Eléments examinés: 100043

Temps écoulé: 4 minute(s), 46 second(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 2

Elément(s) de données du Registre infecté(s): 1

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 3

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Admin\dvktfmd.exe \s,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\OXA7GH2J\x[1] (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\waw32.exe (Worm.Palevo) -> Delete on reboot.

C:\WINDOWS\system32\secupdat.dat (Backdoor.Bot) -> Quarantined and deleted successfully.

 

 

 

 

 

 

HIJACKTHIS DERNIER RAPPORT

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:37:18, on 19/08/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\Program Files\OLITEC\Moniteur WiFi OLITEC\Moniteur WiFi OLITEC.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Documents and Settings\Admin\Bureau\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.troner.net/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {280b5d37-4a76-467a-b3d6-942fca90acde} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O3 - Toolbar: (no name) - {66886C4D-B307-4ECA-A228-52CA9B9851A4} - (no file)

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32\run.cmd (User 'Default user')

O4 - Global Startup: Moniteur WiFi OLITEC.exe.lnk = ?

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/MaConfig_3_5_1_0.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

 

--

End of file - 5396 bytes

Modifié le 19 août 2009 par Hart

[Hart]

Je viens de passer toolbarSD sur ce pc et voici le rapport, malheueusement je ne sais aps ce que j'ai fait avec le rapport Mbam que j'ai passé juste avant mais j'ai refais une analyse (mbam normalement pas à jour vu pc pas connecté au réseau) et 0 infection à voir si je peux rapatrier la dernière mise à jour !!???

 

Voici le rapport toolbarSD :

 

 

-----------\\ ToolBar S&D 1.2.8 XP/Vista

 

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2

X86-based PC ( Uniprocessor Free : AMD Athlon XP 3000+ )

BIOS : Phoenix - AwardBIOS v6.00PG

USER : Admin ( Administrator )

BOOT : Normal boot

Antivirus : AVG Anti-Virus Free 8.5 (Activated)

A:\ (USB)

C:\ (Local Disk) - NTFS - Total:149 Go (Free:126 Go)

D:\ (CD or DVD)

E:\ (CD or DVD)

H:\ (USB) - FAT32 - Total:3880 Mo (Free:3 Go)

 

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )

Option : [1] ( 18/08/2009|18:19 )

 

-----------\\ Recherche de Fichiers / Dossiers ...

 

C:\WINDOWS\Prefetch\RUNDLL32.EXE-1F88488D.pf

 

-----------\\ [..\Internet Explorer\Main]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"'>http://go.microsoft.com/fwlink/?LinkId=69157"'>http://go.microsoft.com/fwlink/?LinkId=69157"'>http://go.microsoft.com/fwlink/?LinkId=69157"

"Search Page"="http://www.google.fr"

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Start Page Redirect Cache"="http://fr.msn.com/?ocid=iehp"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

 

 

--------------------\\ Recherche d'autres infections

 

 

Aucune autre infection trouvée !

 

 

1 - "C:\ToolBar SD\TB_1.txt" - 18/08/2009|18:19 - Option : [1]

 

-----------\\ Fin du rapport a 18:19:43,82

[Hart]

DERNIER RAPPORT AVIRA (passé sans mise à jour le pc n'est pas en réseau)

 

 

 

 

Avira AntiVir Personal

Report file date: mercredi 19 août 2009 15:38

 

Scanning for 1284893 virus strains and unwanted programs.

 

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 2) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : XPSP2-023965C62

 

Version information:

BUILD.DAT : 9.0.0.386 17962 Bytes 11/03/2009 15:55:00

AVSCAN.EXE : 9.0.3.3 464641 Bytes 24/02/2009 10:13:26

AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 08:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 09:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 08:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 10:30:36

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 18:33:26

ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 05:41:14

ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 05/03/2009 12:58:20

Engineversion : 8.2.0.100

AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 15:36:42

AESCRIPT.DLL : 8.1.1.56 352634 Bytes 26/02/2009 18:01:56

AESCN.DLL : 8.1.1.7 127347 Bytes 12/02/2009 09:44:25

AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 16:24:41

AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 11:06:10

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 18:01:56

AEHEUR.DLL : 8.1.0.100 1618295 Bytes 25/02/2009 13:49:16

AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 18:01:56

AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 11:06:10

AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 12:32:40

AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 12:22:44

AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 12:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 06:47:59

AVPREF.DLL : 9.0.0.1 43777 Bytes 05/12/2008 08:32:15

AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 12:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 08:32:09

AVARKT.DLL : 9.0.0.1 292609 Bytes 09/02/2009 05:52:24

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 08:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 13:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 06:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 08:32:10

RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09/02/2009 09:45:45

RCTEXT.DLL : 9.0.35.0 87297 Bytes 11/03/2009 13:55:12

 

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: on

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

 

Start of the scan: mercredi 19 août 2009 15:38

 

Initiating scan of system files:

Signed -> 'C:\WINDOWS\system32\svchost.exe'

Signed -> 'C:\WINDOWS\system32\winlogon.exe'

NOT signed -> 'C:\WINDOWS\explorer.exe'

[DETECTION] Contains HEUR/Modified.SystemFile suspicious code

[NOTE] A backup was created as '4afc019e.qua' ( QUARANTINE )

Signed -> 'C:\WINDOWS\system32\smss.exe'

Signed -> 'C:\WINDOWS\system32\wininet.DLL'

Signed -> 'C:\WINDOWS\system32\wsock32.DLL'

Signed -> 'C:\WINDOWS\system32\ws2_32.DLL'

Signed -> 'C:\WINDOWS\system32\services.exe'

Signed -> 'C:\WINDOWS\system32\lsass.exe'

Signed -> 'C:\WINDOWS\system32\csrss.exe'

Signed -> 'C:\WINDOWS\system32\drivers\kbdclass.sys'

NOT signed -> 'C:\WINDOWS\system32\spoolsv.exe'

[DETECTION] Contains HEUR/Modified.SystemFile suspicious code

[NOTE] A backup was created as '4afb019c.qua' ( QUARANTINE )

Signed -> 'C:\WINDOWS\system32\alg.exe'

Signed -> 'C:\WINDOWS\system32\wuauclt.exe'

Signed -> 'C:\WINDOWS\system32\advapi32.DLL'

NOT signed -> 'C:\WINDOWS\system32\user32.DLL'

[DETECTION] Contains HEUR/Modified.SystemFile suspicious code

[NOTE] A backup was created as '4af101a5.qua' ( QUARANTINE )

Signed -> 'C:\WINDOWS\system32\gdi32.DLL'

Signed -> 'C:\WINDOWS\system32\kernel32.DLL'

Signed -> 'C:\WINDOWS\system32\ntdll.DLL'

NOT signed -> 'C:\WINDOWS\system32\ntoskrnl.exe'

[DETECTION] Contains HEUR/Modified.SystemFile suspicious code

[NOTE] A backup was created as '4afb01a9.qua' ( QUARANTINE )

Signed -> 'C:\WINDOWS\system32\ctfmon.exe'

The system files were scanned ('21' files)

 

Starting search for hidden objects.

'27038' objects were checked, '0' hidden objects were found.

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'Moniteur WiFi OLITEC.exe' - '1' Module(s) have been scanned

Scan process 'FxSvr2.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'LogiTray.exe' - '1' Module(s) have been scanned

Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned

Scan process 'issch.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'slserv.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

24 processes with 24 modules were scanned

 

Starting master boot sector scan:

 

Start scanning boot sectors:

 

Starting to scan executable files (registry).

The registry was scanned ( '49' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\7KPD5OVW\11[1].exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UUSK117S\ins[1].exe

[DETECTION] Is the TR/Dropper.Gen Trojan

C:\Documents and Settings\All Users\Application Data\11859844\11859844.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

 

Beginning disinfection:

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\7KPD5OVW\11[1].exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4ae70442.qua'!

C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\UUSK117S\ins[1].exe

[DETECTION] Is the TR/Dropper.Gen Trojan

[NOTE] The file was moved to '4aff047f.qua'!

C:\Documents and Settings\All Users\Application Data\11859844\11859844.exe

[DETECTION] Is the TR/Dropper.Gen Trojan

[NOTE] The file was moved to '4ac40442.qua'!

 

 

End of the scan: mercredi 19 août 2009 15:54

Used time: 11:52 Minute(s)

 

The scan has been done completely.

 

1467 Scanned directories

47044 Files were scanned

3 Viruses and/or unwanted programs were found

4 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

7 Files were moved to quarantine

0 Files were renamed

1 Files cannot be scanned

47036 Files not concerned

459 Archives were scanned

1 Warnings

8 Notes

27038 Objects were scanned with rootkit scan

0 Hidden objects were found