Demande d'aide pour désinfecter mon PC

pomdorak · le 11 juillet 2005

....Bonjour, bonjour...

j'ai installé Hijack, mais bon...Pfff, pas tout à fait au point.. :-(

Si vous pouviez me filer un coup de pouce, cela serait fort appréciable..Merci.

Logfile of HijackThis v1.99.1

Scan saved at 03:41:46, on 11/07/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Acer\eManager\anbmServ.exe

C:\Program Files\Executive Software\Diskeeper\DkService.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Arcade\PCMService.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\acer\epm\epm-dm.exe

C:\Program Files\Launch Manager\QtZgAcer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\acer\eRecovery\Monitor.exe

C:\Program Files\PeerGuardian2\pg2.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\eMule\eMule.exe

C:\Program Files\Dudez\ProtoWall.exe

C:\Program Files\Messenger\msmsgs.exe

D:\Post incoming\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe

O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot

O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE

O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKCU\..\Run: [ProtoWall] C:\Program Files\Dudez\ProtoWall.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1119812539375

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

Voilà, voilà...je pensais tout fixer, mais si vous pouviez me conseiler au mieux..Merci encore

le 11 juillet 2005

Salut et bienvenu sur zebulon,

ton système est bien infecté

emule en est une des causes principales, donc, je te conseille de suivre la procédure complète de nettoyage et de reposter un log hijackthis

http://forum.zebulon.fr/index.php?showtopic=69176&st=0

de ce fait, cela deviendra plus simple

pomdorak · le 11 juillet 2005

...Bon, je m'y colle alors... Merci.

pomdorak · le 11 juillet 2005

Alors..........voici le rapport du scan de Antivir:

Start of scan: lundi 11 juillet 2005 13:52

Memory test OK

Master boot record of hard disk HD0 OK

Master boot record of hard disk HD1 OK

Boot record of drive C: OK

Boot record of drive D: OK

Boot record of drive F: OK

C:\

pagefile.sys

Access denied! Error during file opening!

This is a Windows swap file. This file is locked by Windows.

Error code: 0x000D

WARNING! Access error/file locked!

hiberfil.sys

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\WINDOWS\system32\config

system.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

software.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

default.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

DEFAULT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SECURITY

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SOFTWARE

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SYSTEM

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

SAM

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\WINDOWS\Temp

Perflib_Perfdata_ac.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\NetworkService

ntuser.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

NTUSER.DAT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows

UsrClass.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

UsrClass.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\LocalService

ntuser.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

NTUSER.DAT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows

UsrClass.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

UsrClass.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\Grégory

ntuser.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

NTUSER.DAT

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\Grégory\Local Settings\Application Data\Microsoft\Windows

UsrClass.dat

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

UsrClass.dat.LOG

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\Grégory\Application Data\Mozilla\Firefox\Profiles\8tnwr1ca.default

parent.lock

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Program Files\WinRAR

rarnew.dat

ArchiveType: RAR

NOTE! The archive is created by multiple volumes

F:\Ma musique\Musique\Albums\Talking Heads -\Talking Heads - 1977-2004 - All Full Complete Discography - 12 Albums\1993 - Talking Heads - Once In A Life Time.3CD.boxset\talking heads once in a lifetime cd 1

talking_heads-02-love_goes_to_a_building_on_fire-esc.mp3

Access denied! Error during file opening!

Error code: 0x0002

WARNING! Access error/file locked!

F:\Cloneurs DvD -DvX\clonedvd

CloneDVD.part1.rar

ArchiveType: RAR

NOTE! The archive is created by multiple volumes

..Moi , personnelement, je n'y trouve rien à comprendre...dur l'informatique

ipl_001 · le 11 juillet 2005

Bonsoir pomdorak, tesgaz, bonsoir à tous,

Je te souhaite la bienvenue sur Zeb'Sécurité ! Merci de venir sur notre forum !

Ce n'est pas le log d'AntiVir qui nous intéresse mais que tu supprimes les fichiers inutiles, que tu passes AntiVir et que tu postes le rapport de HijackThis (en mode sans échec) !

pomdorak · le 12 juillet 2005

Voilà voilà.....

Logfile of HijackThis v1.99.1

Scan saved at 15:32:39, on 12/07/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Acer\eManager\anbmServ.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\acer\epm\epm-dm.exe

C:\Program Files\Launch Manager\QtZgAcer.EXE

C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

C:\Program Files\Norton AntiVirus\CfgWiz.exe

C:\Program Files\acer\eRecovery\Monitor.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

C:\Program Files\Symantec\LiveUpdate\LUAll.exe

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\msiexec.exe