[Résolu] Analyse d'un log d'HJT suite infection de mon ordinateur

Radsgort · le 20 octobre 2009

Bonjour à tous,

Je viens demander de l'aide, je souhaite faire analyser ce rapport.

je voudrais mettre un peu d'ordre dans mon pc.

je vous remercie par avance

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 07:02:32, on 20/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\HP_Administrateur\Mes documents\David\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm

O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm

O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/dow...llerControl.cab

O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} (PhotoboxPhotowaysUploader5 Control) - http://assets.photobox.com/assets/aurigma/...?20090304071056

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1192632476703

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://files-mjf.jeuxvideo-flash.com/popca...ader_v10_fr.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: EasyBits Magic Desktop Services for Windows NT (ezntsvc) - EasyBits Software Corp. - C:\WINDOWS\system32\ezNTSvc.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 11167 bytes

Modifié le 28 octobre 2009 par Radsgort

Radsgort · le 20 octobre 2009

Bonjour à tous

Aurais-je commis une erreur en venant demander de l'aide sur ce forum ?, si c'est le cas je m'en excuse par avance par contre si c'est mon empressement à trouver une réponse qui semble excessif c'est qu'il y à urgence mais je saurais me montrer patient en attendant je consulte le tuto HJT .

merci

Thanos · le 20 octobre 2009

Salut et bienvenue sur le forum

Quelques liens pour t'aider à commencer :

On va voir ensemble ce qui se passe sur ton PC ; comme tous les intervenants ici, nous aidons bénévolement en fonction de nos activités personnelles. On va essayer d'aller au plus vite, mais il faudra peut-être parfois être patient pour attendre une réponse, pas d'affolement

Pour répondre ou ajouter un post, un rapport, etc, utilise le bouton .

(bouton qui se trouve entre "Flash" et "Nouveau")

*********

Aurais-je commis une erreur en venant demander de l'aide sur ce forum ?

Non par contre tu n'as pas exposé le problème auquel tu es confronté ? il n'y a pas de signe visible d'infection sur ce rapport (ce qui ne veux pas dire que le pc est sain!)

Pourquoi as tu lancé hijackthis en mode sans échec ? y a t-il des signes qui te font penser que le pc est infecté ?

Tu as utilisé Malwarebytes Anti-Malware: as t-il détecté quelque chose ?

On va en voir un peu plus comme ceci: lance le programme en mode normal (si possible) >>

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
Si tu ne vois pas ces deux rapports, tu les trouveras dans le dossier C:\rsit

Radsgort · le 20 octobre 2009

Bonsoir Thanos,

Merci par avance

1) Oui une analyse Malwarebytes Anti-Malware voici le rapport :

Malwarebytes' Anti-Malware 1.41

Version de la base de données: 2973

Windows 5.1.2600 Service Pack 2

17/10/2009 17:19:22

mbam-log-2009-10-17 (17-19-17).txt

Type de recherche: Examen complet (C:\|)

Eléments examinés: 276657

Temps écoulé: 1 hour(s), 27 minute(s), 15 second(s)

Processus mémoire infecté(s): 2

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 18

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 18

Dossier(s) infecté(s): 8

Fichier(s) infecté(s): 96

Processus mémoire infecté(s):

C:\Program Files\Winsudate\gibsvc.exe (Adware.édité) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> No action taken.

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winsvc (Adware.édité) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\winsvc (Adware.édité) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\winsvc (Adware.édité) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winsvc (Adware.édité) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.AntiVirus2008) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a3ed5288-f558-4f6e-8d5c-740cb6f89029} (Rogue.Multiple) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{b4c656c9-f2e9-4e77-b3f4-443df2bd778f} (Rogue.Eorezo) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{b0d071a1-36b3-4757-a126-14c89c56013a} (Rogue.Eorezo) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{b6acb3f1-6a83-432c-b854-3e1056f87f4e} (Rogue.Eorezo) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{819db72d-1c28-4387-9778-e2ff3dc86f74} (Rogue.Eorezo) -> No action taken.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> No action taken.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\IGB (Rogue.Residue) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\RegistrySmart (Rogue.RegistrySmart) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\IGB (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\softwarehelper (Rogue.Eorezo) -> No action taken.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1cedae29-fa41-4ae6-bd3d-d3cbba6a701c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e94cd3c3-e65d-4892-98bf-03b73e253df1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1cedae29-fa41-4ae6-bd3d-d3cbba6a701c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{23362283-6608-4f23-844f-feeb77804aa6}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e94cd3c3-e65d-4892-98bf-03b73e253df1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{1cedae29-fa41-4ae6-bd3d-d3cbba6a701c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{23362283-6608-4f23-844f-feeb77804aa6}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\NameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{e94cd3c3-e65d-4892-98bf-03b73e253df1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{1cedae29-fa41-4ae6-bd3d-d3cbba6a701c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{63c4f7b4-aa13-4268-89c3-3d4d0ae18c6f}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{e94cd3c3-e65d-4892-98bf-03b73e253df1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.116.152,85.255.112.19 -> No action taken.

Dossier(s) infecté(s):

C:\Program Files\InternetGameBox (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\favoris (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\skins (Adware.EGDAccess) -> No action taken.

C:\Program Files\RegistrySmart (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\Winsudate (Adware.édité) -> No action taken.

Fichier(s) infecté(s):

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\dfoeg_navps.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\dfoeg_nav.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\dfoeg.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\mocogai_navps.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\mocogai_nav.dat (Adware.Navipromo.H) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\mocogai.dat (Adware.Navipromo.H) -> No action taken.

C:\Program Files\Winsudate\gibsvc.exe (Adware.édité) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Rogue.Eorezo) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Application Data\EoRezo\SoftwareUpdate\SoftwareUpdate.exe (Rogue.Eorezo) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Mes documents\backups\backup-20091017-145749-412.dll (Rogue.Eorezo) -> No action taken.

C:\Documents and Settings\HP_Administrateur\Mes documents\backups\backup-20091017-145935-963.dll (Rogue.Eorezo) -> No action taken.

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0VERAH6V\gibsvc[1].exe (Adware.édité) -> No action taken.

C:\Program Files\EoRezo\EoEngine.exe (Rogue.Eorezo) -> No action taken.

C:\Program Files\EoRezo\EoAdv\EoAdv.dll (Rogue.Eorezo) -> No action taken.

C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (Rogue.Eorezo) -> No action taken.

C:\Program Files\Winsudate\gibcom.dll (Adware.édité) -> No action taken.

C:\Program Files\Winsudate\gibidl.dll (Adware.édité) -> No action taken.

C:\Program Files\Winsudate\gibupt.exe (Adware.édité) -> No action taken.

C:\Program Files\Winsudate\gibusr.exe (Adware.édité) -> No action taken.

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP612\A0427689.exe (Adware.édité) -> No action taken.

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP612\A0427688.dll (Adware.édité) -> No action taken.

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP612\A0427690.exe (Adware.édité) -> No action taken.

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP612\A0427691.exe (Adware.édité) -> No action taken.

C:\Program Files\InternetGameBox\language (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\AttenteOff.html (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\AttenteOn.html (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\configv2_en.xml (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\configv2_es.xml (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\configv2_fr.xml (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\NoS2F.bin (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\ressources\favoris\defaultv2.swf (Adware.EGDAccess) -> No action taken.

C:\Program Files\InternetGameBox\skins\skinv2.skn (Adware.EGDAccess) -> No action taken.

C:\Program Files\RegistrySmart\Errors.stg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Results.stg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_16_10_24_38.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_16_11_30_14.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_16_18_15_44.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_17_10_22_07.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_17_19_02_17.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_19_14_05_36.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_20_12_24_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_20_20_15_01.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_21_12_30_43.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_21_12_50_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_21_13_58_02.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_21_19_50_09.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_22_13_54_22.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_22_17_19_03.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_22_17_29_08.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_22_17_42_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_22_19_02_47.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_25_18_52_49.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_25_19_03_25.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_26_14_31_02.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_27_14_55_28.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_27_15_13_59.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_27_15_27_37.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_28_14_55_56.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_28_19_45_54.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_29_19_46_38.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_30_19_24_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_31_17_48_32.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_08_31_18_51_44.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_01_15_13_59.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_01_17_11_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_01_17_36_23.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_03_10_23_24.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_03_16_31_34.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_05_14_56_20.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_05_15_36_13.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_05_16_15_59.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_11_08_57.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_11_31_58.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_14_41_52.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_16_42_24.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_17_00_05.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_17_30_22.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_17_36_09.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_10_17_47_16.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Log\log_2008_09_12_15_48_47.eklog (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2007-10-17_17-14-29.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2007-11-03_15-32-26.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-01-14_18-08-46.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-04-09_19-45-33.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-04-12_14-04-44.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-05-17_11-46-33.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-07-13_13-39-13.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\2008-08-16_11-35-57.reg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\Errors.stg (Rogue.RegistrySmart) -> No action taken.

C:\Program Files\RegistrySmart\Registry Backups\Results.stg (Rogue.RegistrySmart) -> No action taken.

C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> No action taken.

C:\WINDOWS\0535251103110107106.yux (KoobFace.Trace) -> No action taken.

C:\WINDOWS\010112010146120114.xe (KoobFace.Trace) -> No action taken.

C:\WINDOWS\0101120101465753.xe (KoobFace.Trace) -> No action taken.

C:\WINDOWS\prxid93ps.dat (Malware.Trace) -> No action taken.

C:\WINDOWS\dxxdv34567.bat (KoobFace.Trace) -> No action taken.

2) Rapport log_HJT

Logfile of random's system information tool 1.06 (written by random/random)

Run by HP_Administrateur at 2009-10-20 23:04:23

Microsoft Windows XP Professionnel Service Pack 3

System drive C: has 199 GB (83%) free of 238 GB

Total RAM: 1022 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:04:28, on 20/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\system32\ezNTSvc.exe

C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\HP_Administrateur\Bureau\RSIT.exe

C:\Program Files\Hijackthis\HP_Administrateur.exe