[résolu]alerte virus

le 8 juillet 2005

C'est reparti... Télécharge cet utilitaire:

http://www.purityscan.com/uninstall.html

Désactive tous programmes qui pourraient gêner les corrections. Démarre en mode sans échec et exécute le deux fois.

Redémarre normalement et poste un nouveau rapport Hijackthis.

Modifié le 8 juillet 2005 par Stonangel

rimbaut · le 8 juillet 2005

re bonsoir stonangel,

je ne suis pas actuellement chez moi et je n'ai pas pu faire la manip que tu m'as indiqué. Je la ferais des que je rentre demain ou dimanche au plus tard; je te tiens au courant ds ts les cas.

Merci pour ton aide et merci à tous

ipl_001 · le 8 juillet 2005

Merci encore, Stonangel !

tu as une grande patience et une grande générosité (en même temps que de sacrées connaissances) !

rimbaut · le 9 juillet 2005

bonsoir stonangel, bonsoir à tous,

je ne suis tjrs pas chez moi mais j'ai oublié d'indiquer un détail dont je ne connais pas l'importance.

De tps en tps il apparait ds la barre des taches une icone qui m'invite à installer un programme antiviral ????

je ne l'ai pas éxécuter et il me semble que ce programme est lié à l'invite figurant sur mon bureau.

Voilà dès demain je vais éxécuter ta manip.

Encore merci à bientôt

le 9 juillet 2005

Bonsoir rimbaut, ton fond d'écran on le fera sauter après.

rimbaut · le 10 juillet 2005

Bonsoir stonangel, bonsoir à tous,

J'ai effectué ttes la proc de desinfection et j'ai utilise 3 fois purityscan et je soumets mon log hj effectué en mode sans echec comme tt le reste d'ailleurs.

Logfile of HijackThis v1.99.1

Scan saved at 19:13:56, on 10/07/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVPersonal\AVGNT.EXE

C:\hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpmtm.dll/sp.html#37049

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Class - {28F322DD-9910-4EFE-1C53-52037148150A} - C:\WINDOWS\atlgu32.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe

O4 - HKLM\..\Run: [netpr32.exe] C:\WINDOWS\system32\netpr32.exe

O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min

O4 - HKLM\..\RunOnce: [ieat.exe] C:\WINDOWS\system32\ieat.exe

O4 - HKLM\..\RunOnce: [apifj32.exe] C:\WINDOWS\system32\apifj32.exe

O4 - HKLM\..\RunOnce: [mfcbl32.exe] C:\WINDOWS\system32\mfcbl32.exe

O4 - HKLM\..\RunOnce: [iegn.exe] C:\WINDOWS\iegn.exe

O4 - HKLM\..\RunOnce: [appkr32.exe] C:\WINDOWS\appkr32.exe

O4 - HKLM\..\RunOnce: [appck32.exe] C:\WINDOWS\system32\appck32.exe

O4 - HKLM\..\RunOnce: [mshm32.exe] C:\WINDOWS\system32\mshm32.exe

O4 - HKLM\..\RunOnce: [msdh.exe] C:\WINDOWS\system32\msdh.exe

O4 - HKLM\..\RunOnce: [d3zw32.exe] C:\WINDOWS\d3zw32.exe

O4 - HKLM\..\RunOnce: [winnw32.exe] C:\WINDOWS\system32\winnw32.exe

O4 - HKLM\..\RunOnce: [javasy.exe] C:\WINDOWS\system32\javasy.exe

O4 - HKLM\..\RunOnce: [atlgv32.exe] C:\WINDOWS\system32\atlgv32.exe

O4 - HKLM\..\RunOnce: [ielp.exe] C:\WINDOWS\system32\ielp.exe

O4 - HKLM\..\RunOnce: [d3mx32.exe] C:\WINDOWS\d3mx32.exe

O4 - HKLM\..\RunOnce: [ipzr.exe] C:\WINDOWS\ipzr.exe

O4 - HKLM\..\RunOnce: [ipde32.exe] C:\WINDOWS\ipde32.exe

O4 - HKLM\..\RunOnce: [msnb.exe] C:\WINDOWS\system32\msnb.exe

O4 - HKLM\..\RunOnce: [addtg.exe] C:\WINDOWS\addtg.exe

O4 - HKLM\..\RunOnce: [d3zi.exe] C:\WINDOWS\d3zi.exe

O4 - HKLM\..\RunOnce: [mfcvd.exe] C:\WINDOWS\mfcvd.exe

O4 - HKLM\..\RunOnce: [ieix32.exe] C:\WINDOWS\ieix32.exe

O4 - HKLM\..\RunOnce: [mfcau.exe] C:\WINDOWS\mfcau.exe

O4 - HKLM\..\RunOnce: [javazn.exe] C:\WINDOWS\system32\javazn.exe

O4 - HKLM\..\RunOnce: [apieh32.exe] C:\WINDOWS\apieh32.exe

O4 - HKLM\..\RunOnce: [ntco.exe] C:\WINDOWS\ntco.exe

O4 - HKLM\..\RunOnce: [d3ys32.exe] C:\WINDOWS\d3ys32.exe

O4 - HKLM\..\RunOnce: [ntrl.exe] C:\WINDOWS\system32\ntrl.exe

O4 - HKLM\..\RunOnce: [javait.exe] C:\WINDOWS\javait.exe

O4 - HKLM\..\RunOnce: [crvq32.exe] C:\WINDOWS\crvq32.exe

O4 - HKLM\..\RunOnce: [javacm32.exe] C:\WINDOWS\system32\javacm32.exe

O4 - HKLM\..\RunOnce: [mfchj32.exe] C:\WINDOWS\mfchj32.exe

O4 - HKLM\..\RunOnce: [crku32.exe] C:\WINDOWS\system32\crku32.exe

O4 - HKLM\..\RunOnce: [ieoz.exe] C:\WINDOWS\ieoz.exe

O4 - HKLM\..\RunOnce: [appsd32.exe] C:\WINDOWS\system32\appsd32.exe

O4 - HKLM\..\RunOnce: [d3xz32.exe] C:\WINDOWS\system32\d3xz32.exe

O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a2\a2guard.exe"

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab

O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ieat.exe" /s (file missing)

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe

O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe

O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

j'ajoute que j'ai scanner avec antivir il a detecté 97 trojans il se trouvait en debut de scan et ensuite à la fin ds le dossier "system volume information/_restore". Ils se succedaient à l'adresse suivante A0033389, AA0033900 ect ... jusqu'à AA0033424.

j'ai éffectué le log du scan d'antivir et voilà ce que ca donne

Start of scan: dimanche 10 juillet 2005 18:29

Memory test OK

Master boot record of hard disk HD0 OK

Boot record of drive C: OK

C:\

pagefile.sys

Access denied! Error during file opening!

This is a Windows swap file. This file is locked by Windows.

Error code: 0x000D

WARNING! Access error/file locked!

C:\WINDOWS

cwubby.txt

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sysyw.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

winhh32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

d3wi.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

mfcpg32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sdkox32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

javahh32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

netae32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sdkzb.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

winsd.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sysws.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

ipoa32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

netfz32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

mfcxf32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

appfi32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

netmv.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

crds.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

netni.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

mfcrv.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

winku32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sysnd32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

zpmtm.dll

[DETECTION] Is the Trojan horse TR/StartPa.DU.DLL.1

WAS DELETED!

wnfenj.log

[DETECTION] Is the Trojan horse TR/StartPa.DU.DLL.1

WAS DELETED!

C:\WINDOWS\system32

appjy32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

ntcz.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

d3uw32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

apida32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

javart32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

winnq.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

winlz.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

mfcby.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

crlc32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

d3tq.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

d3gw.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

appob32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

nethy.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

javasp32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

ieml.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

iptd.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

ipzr32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

atlff32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

ntpu32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

atlmg32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

javaei32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

sysoh.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

addaq32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

atluz32.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

msoy.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

syslw.exe

[DETECTION] Is the Trojan horse TR/Agent.BI.3

WAS DELETED!

C:\WINDOWS\system32\config

system.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

software.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

default.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

DEFAULT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SOFTWARE

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SYSTEM

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery

CoolWWWSearchAffWinshow.zip

ArchiveType: ZIP