[résolu]Assistance hijackthis

julieh · le 11 octobre 2005

Voila, EWIDO est en train de tourner :

il trouve des trucs dans Mozilla. Je lui ai dit de ne rien faire. Je vous posterai le rapport avant de faire quoi que ce soit.

Jack_Burton · le 11 octobre 2005

Voila, EWIDO est en train de tourner :
il trouve des trucs dans Mozilla. Je lui ai dit de ne rien faire. Je vous posterai le rapport avant de faire quoi que ce soit.

586765[/snapback]

Ca doit surement etre des cookies, rien de grave, tout le monde s en "chope" en naviguant sur le web !

Modifié le 11 octobre 2005 par Jack_Burton

julieh · le 11 octobre 2005

Tu as raison, apparemment, ce sont des cookies.

:mozilla.23:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Comclick : Ignoré

:mozilla.25:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Atdmt : Ignoré

:mozilla.28:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Doubleclick : Ignoré

:mozilla.38:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Mediaplex : Ignoré

:mozilla.40:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Adtech : Ignoré

:mozilla.41:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Adtech : Ignoré

:mozilla.44:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Advertising : Ignoré

:mozilla.45:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Advertising : Ignoré

:mozilla.46:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Bluestreak : Ignoré

:mozilla.51:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Estat : Ignoré

:mozilla.52:C:\Documents and Settings\Alex\Application Data\Mozilla\Firefox\Profiles\9qz45423.default\cookies.txt -> Spyware.Cookie.Valueclick : Ignoré

:mozilla.9:C:\Documents and Settings\Alex\Application Data\Phoenix\Profiles\default\mtbmcgag.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Ignoré

:mozilla.7:C:\Documents and Settings\Alex\Application Data\Thunderbird\Profiles\default\7tjhrqb3.slt\cookies.txt -> Spyware.Cookie.Bluestreak : Ignoré

:mozilla.11:C:\Documents and Settings\Alex\Application Data\Thunderbird\Profiles\default\7tjhrqb3.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Ignoré

C:\Documents and Settings\All Users\Documents\sauvegarde\My Archives\08_SAUVEGARDE_cle_atrier.zip/Tout fou le camps .exe -> Not-A-Virus.Joke.Melter : Ignoré

:mozilla.11:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Ignoré

:mozilla.12:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Weborama : Ignoré

:mozilla.46:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Bluestreak : Ignoré

:mozilla.47:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.247realmedia : Ignoré

:mozilla.53:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Valueclick : Ignoré

:mozilla.54:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Valueclick : Ignoré

:mozilla.60:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Estat : Ignoré

:mozilla.62:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Mediaplex : Ignoré

:mozilla.63:C:\Documents and Settings\Julie\Application Data\Mozilla\Firefox\Profiles\kp4p15qw.default\cookies.txt -> Spyware.Cookie.Doubleclick : Ignoré

:mozilla.7:C:\Documents and Settings\Julie_boulot\Application Data\Thunderbird\Profiles\default\7tjhrqb3.slt\cookies.txt -> Spyware.Cookie.Bluestreak : Ignoré

:mozilla.11:C:\Documents and Settings\Julie_boulot\Application Data\Thunderbird\Profiles\default\7tjhrqb3.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Ignoré

C:\Documents and Settings\Julie_boulot\Cookies\Julie_boulot@247realmedia[2].txt -> Spyware.Cookie.247realmedia : Ignoré

C:\Documents and Settings\Julie_boulot\Cookies\Julie_boulot@estat[1].txt -> Spyware.Cookie.Estat : Ignoré

C:\Documents and Settings\Julie_boulot\Cookies\Julie_boulot@tradedoubler[2].txt -> Spyware.Cookie.Tradedoubler : Ignoré

Donc, le PC va pas mal.

Par contre,

- j'ai refait un Spybot et il me dit que j'ai SmitFraud.C (copie ecran)

- Antivir m'a signalé Phisp/SunBkfraud.G sans pouvoir l'effacer.

Qu'est-ce qu'il faut en penser ?

En attendant, j'essaie de voir si je peux récupérer ma connection ADsl en réinstallant mon cd Free.

+

Modifié le 11 octobre 2005 par julieh

Jack_Burton · le 11 octobre 2005

Oui ce sont que des cookies donc pas d inquiétude

j'ai refait un Spybot et il me dit que j'ai SmitFraud.C

Et a la fin il ne te propose pas de le supprimer??

julieh · le 11 octobre 2005

Oui ce sont que des cookies donc pas d inquiétude
Et a la fin il ne te propose pas de le supprimer??

586898[/snapback]

Ok. Pour Spybot c'est fait : il a corrigé le problème

Mais pour Antivir, il a pas pu corriger.

Et puis j'ai relu la procédure : mon hijackthis n'a pas été fait en mode normal. Je l'ai fait en mode sans échec. Je recommence donc correctement (excusez-moi).

----------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1

Scan saved at 18:09:05, on 11/10/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

C:\Program Files\ewido\security suite\ewidoctrl.exe

C:\Program Files\ewido\security suite\ewidoguard.exe

C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\HijackThis\HijackThis.exe

C:\Program Files\LiveUpdate\LiveUpdate.exe

C:\Program Files\Google\Google Talk\googletalk.exe

C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [bTCLiveUpdate] "C:\Program Files\LiveUpdate\LiveUpdate.exe" /autostart

O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart

O16 - DPF: ppctlcab -

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -

O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} -

O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} -

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} -

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll

O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

------------------------------------------------------------------------------------------------

Jack_Burton · le 11 octobre 2005

Re,

Ton rapport est toujours propre.

Tu peux encore fixer ces lignes inutiles :

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O16 - DPF: ppctlcab -

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -

O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -

O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} -

O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} -

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} -

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} -

N oublie pas de désinstaller Ewido, il n est gratuit que pendant 14 jours.

- Antivir m'a signalé Phisp/SunBkfraud.G sans pouvoir l'effacer.

Antivir ne l a pas effacé certes, mais il a du t indiquer l emplacement de ce "virus" non?

Peux tu me donner le nom de ce fichier et son emplacement stp?

Edit : un petit oubli, désactive le Tea Timer de Spybot avant de fixer les lignes en mode normal.

Modifié le 11 octobre 2005 par Jack_Burton

julieh · le 11 octobre 2005

Merci beaucoup Jack. Je fixe ça tout de suite.

J'ai refait un scan Antivir mais je comprends pas tout. Pourrais-tu me dire si quelquechose cloche ?

Creation date of the report file: mardi 11 octobre 2005 18:47

AntiVir®/XP (2000 + NT) PersonalEdition Classic

Build 1068 of 21.09.2005

Mainprogram 6.32.00.07 of 16.09.2005

VDF file 6.32.0.64 (0) of 06.10.2005

This program is for PERSONAL USE only.

Any other use is PROHIBITED.

Informations regarding commercial versions of AntiVir may be obtained from:

www.hbedv.com.

Scanning for 228713 virus strains and unwanted programs.

Licensed for: AntiVir Personal Edition

Serial number: 0000149991-WURGE-0001

Please enter the workstation and

contact name with phone number in this form:

Name ___________________________________________

Street ___________________________________________

Town ___________________________________________

Phone/Fax ___________________________________________

Email ___________________________________________

Platform: Windows NT Workstation

Windows version: 5.1 Build 2600 (Service Pack 1)

Username: Julie_boulot

Computername: XP_Julie

Processor: Pentium

Working memory: 392196 KB free

Version information:

AVWIN.DLL : 6.32.00.04 561192 16.08.2005 10:22:36

AVEWIN32.DLL : 6.32.0.6 832000 20.09.2005 12:50:22

AVGNT.EXE : 6.32.00.00 168039 29.07.2005 10:19:28

AVGUARD.EXE : 6.32.00.06 207912 07.09.2005 16:34:50

GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 11:24:10

AVGCMSG.DLL : 6.32.00.00 258165 29.07.2005 10:19:30

AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 08:07:16

AVPACK32.DLL : 6.31.01.07 327720 07.09.2005 09:08:28

AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 18:10:20

AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 18:10:22

AVSched32.EXE : 6.32.00.01 110632 20.09.2005 14:16:24

AVSched32.DLL : 6.30.00.00 122880 01.02.2005 11:24:10

AVREG.DLL : 6.31.00.05 41000 07.09.2005 16:34:50

AVRep.DLL : 6.32.00.60 1404968 05.10.2005 16:17:28

INETUPD.EXE : 6.32.00.05 254011 16.08.2005 16:46:08

INETUPD.DLL : 6.32.00.05 143360 16.08.2005 16:46:08

CTL3D32.DLL : 2.31.000 27136 30.08.2002 09:00:00

MFC42.DLL : 6.00.8665.0 995383 30.08.2002 09:00:00

MSVCRT.DLL : 7.0.2600.1106 (xpsp1.020828-1920

MSVCRT.DLL : 7.0.2600.1106 323072 30.08.2002 09:00:00

CTL3DV2.DLL : No information

Configuration file:

Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI

Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG

Start path: C:\Program Files\AVPersonal

Command line:

Start mode: unknown

Mode of report file:

[ ] Do not create report

[X] Overwrite report

[ ] Append new report

Data in report file:

[X] Infected files

[ ] Infected files with paths

[ ] All scJulied files

[ ] Full information

Abridge report file:

[ ] Abridge report file

Warnings in report:

[X] Access denied/file locked

[X] Wrong file size in directory

[X] Wrong creation time in directory

[ ] COM file is too large

[X] Invalid start address

[X] Invalid EXE header

[X] Possibly damaged

Summary report:

[X] Create summary report

Output file: AVWIN.ACT

Maximum number of entries: 100

Where to search:

[X] Memory

[X] Boot record of selected drives

[ ] Report unknown boot sectors

[X] All files

[ ] Program files

Response in case of a detection:

[X] Repair with prompt

[ ] Repair without prompt

[ ] Delete with prompt

[ ] Delete without prompt

[ ] Write in report file only

[X] Acoustic alarm

Response in case of destroyed files:

[X] Delete with prompt

[ ] Delete without prompt

[ ] Ignore

Response in case of destroyed files:

[X] No change

[ ] Current system time

[ ] Correct date

Drag&drop settings:

[X] Scan subdirectories

Profile settings:

[X] Scan subdirectories

Archive options

[X] Search archive

[X] Archive types to leave out

1002 1001 1000

Miscellaneous options:

Temporary path: %TEMP% -> C:\DOCUME~1\Julie_B~1\LOCALS~1\Temp

[X] Overwrite infected files

[ ] Detect idle time

[X] Allow interruptions of scan

[ ] Load AVWin®/NT Guard on System start

General settings:

[X] Save options on exiting AntiVir

Priority: medium

Drives:

A: Floppy drive

C: Hard disk

D: CD-ROM

E: CD-ROM

F: Floppy drive

Start of scan: mardi 11 octobre 2005 18:47

Memory test OK

Master boot record of hard disk HD0 OK

Master boot record of hard disk HD1 OK

Boot record of drive C: OK

C:\

pagefile.sys

Access denied! Error during file opening!

This is a Windows swap file. This file is locked by Windows.

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson

user.dmp

Access denied! Error during file opening!

Error code: 0x000D

WARNING! Access error/file locked!

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery

AdobeImageReady.zip

ArchiveType: ZIP