Log hijack, spy récalcitrant!

cLasX · le 27 novembre 2005

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\utilitaires\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe

O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O20 - AppInit_DLLs: MsgPlusLoader.dll

O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\lvjm0911e.dll

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\System32\r_server.exe" /service (file missing)

J'ai essayé d'enlever plusieurs fois cette ligne avec Hijack:

"O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\lvjm0911e.dll"

directement dans le dossier, en mode sans echecs ou en mode normale, rien à faire, elle revient à chaque fois avec un nom différent (.dll)

Merci de votre

le 27 novembre 2005

Bonsoir et bienvenue sur Zeb' Sécu.

Tu as deux antivirus, désinstalle celui de ton choix.

Télécharge SpySweeper (de Webroot) ICI (version d'essai - 14 jours):

Clic sur le lien Free Trial sous la rubrique "SpySweeper".
Installe le programme. Une fois installé, il se lancera.
L'option de le mettre à jour s'affichera; clic Yes.
Lorsque les mises à jour seront installées, clic Options sur la gauche.
Clic sur l'onglet Sweep Options.
Sous What to Sweep, coche les options suivantes:
- Sweep Memory
- Sweep Registry
- Sweep Cookies
- Sweep All User Accounts
- Enable Direct Disk Sweeping
- Sweep Contents of Compressed Files
- Sweep for Rootkits
- DÉCOCHE Do not Sweep System Restore Folder.
[*]Clic Sweep Now sur la gauche.

[*]Clic sur Start.

[*]Quand le scan est terminé, clic sur Next.

[*]Assure-toi que tous les items sont cochés, puis clic sur Next.

[*]Tous les items cochés seront éliminés.

[*]Si Spy Sweeper veut redémarrer pour terminer le nettoyage : ACCEPTE.

[*]Clic Session Log au haut - à droite, et copie tout ce qu'il y a dans la fenêtre.

[*]Clic sur l'onglet Summary, puis clic sur Finish.

[*]Colle le contenu du "Session Log" dans ta prochaine réponse avec un nouveau rapport HijackThis.

cLasX · le 27 novembre 2005

Voici le log de spy sweeper:

********
22:31: | Start of Session, dimanche 27 novembre 2005 |

22:31: Spy Sweeper started

22:31: Sweep initiated using definitions version 575

22:31: Starting Memory Sweep

22:36: Memory Sweep Complete, Elapsed Time: 00:04:45

22:36: Starting Registry Sweep

22:36: Found Trojan Horse: optixpro

22:36: HKLM\software\opro\ (28 subtraces) (ID = 136466)

22:36: Found Adware: delfin

22:36: HKLM\software\vidmon\ (1 subtraces) (ID = 890155)

22:36: HKLM\software\microsoft\windows\currentversion\uninstall\webdp\ (2 subtraces) (ID = 890173)

22:36: Found Adware: dollarrevenue

22:36: HKLM\software\microsoft\drsmartload\ (1 subtraces) (ID = 916795)

22:36: Found Adware: syswebtelecom

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1008\software\sponsoradulto2\ (1 subtraces) (ID = 143576)

22:36: Found System Monitor: klogger

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1007\software\kaksoftstudio\ (4 subtraces) (ID = 129686)

22:36: Found Adware: instant access

22:36: HKU\S-1-5-21-1078081533-1417001333-682003330-1006\software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0\ || goicfboogidikkejccmclpieicihhlpo bgdjdn (ID = 128845)

22:36: Found Adware: startnow startnow hijack

22:36: HKU\S-1-5-21-1078081533-1417001333-682003330-1006\software\microsoft\internet explorer\search\ || local page (ID = 142622)

22:36: HKU\S-1-5-21-1078081533-1417001333-682003330-1006\software\sponsoradulto2\ (158 subtraces) (ID = 143576)

22:36: HKU\S-1-5-21-1078081533-1417001333-682003330-1006\software\vidmon\ (1 subtraces) (ID = 890125)

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1005\software\microsoft\windows\currentversion\wintrust\trust providers\software publishing\trust database\0\ || goicfboogidikkejccmclpieicihhlpo bgdjdn (ID = 128845)

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1005\software\kaksoftstudio\ (4 subtraces) (ID = 129686)

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1005\software\sponsoradulto2\ (1 subtraces) (ID = 143576)

22:36: Found Adware: winantispyware 2005

22:36: HKU\WRSS_Profile_S-1-5-21-1078081533-1417001333-682003330-1005\software\microsoft\windows\currentversion\explorer\menuorder\start menu\programs\winfixer 2005\ (ID = 543254)

22:36: Registry Sweep Complete, Elapsed Time:00:00:33

22:36: Starting Cookie Sweep

22:36: Found Spy Cookie: adultfriendfinder cookie

22:36: invité@adultfriendfinder[2].txt (ID = 2165)

22:36: Found Spy Cookie: passion cookie

22:36: invité@passion[1].txt (ID = 3113)

22:36: Found Spy Cookie: xiti cookie

22:36: invité@xiti[1].txt (ID = 3717)

22:36: Found Spy Cookie: yieldmanager cookie

22:36: antoine@ad.yieldmanager[2].txt (ID = 3751)

22:36: Found Spy Cookie: rn11 cookie

22:36: antoine@rn11[2].txt (ID = 3261)

22:36: antoine@xiti[1].txt (ID = 3717)

22:36: jean françois@rn11[2].txt (ID = 3261)

22:36: jean françois@xiti[1].txt (ID = 3717)

22:36: Cookie Sweep Complete, Elapsed Time: 00:00:00

22:36: Starting File Sweep

22:36: c:\documents and settings\all users\application data\nfo (15 subtraces) (ID = -2147468687)

22:36: c:\windows\system32\nfomon (4 subtraces) (ID = -2147468684)

22:36: Found Adware: startnow

22:36: c:\documents and settings\jean françois\application data\hyperbar (1 subtraces) (ID = -2147480231)

22:36: Found Adware: hotconnect dialer

22:36: c:\program files\montorgueil (4 subtraces) (ID = -2147480502)

22:39: msclock32.dll (ID = 132845)

22:41: nfomon.exe (ID = 194610)

22:41: removewebdp.exe (ID = 166172)

22:42: Found Adware: look2me

22:42: a0000111.dll (ID = 159)

22:42: sophie.ico (ID = 71873)

22:42: nfom.dll (ID = 194609)

22:43: tmlpcert2005 (ID = 63918)

22:44: Found Adware: spysheriff

22:44: secure32.html (ID = 184319)

22:44: Found Trojan Horse: trojan-backdoor-us15info

22:44: tool3.exe (ID = 183857)

22:44: tool4.exe (ID = 183857)

22:44: mon0104.dbd (ID = 57676)

22:44: secure32.html (ID = 184319)

22:44: mon1920.dbd (ID = 57692)

22:44: mon2007.dbd (ID = 57693)

22:45: mon1215.dbd (ID = 57687)

22:45: timessquare.exe (ID = 194150)

22:45: a0000110.dll (ID = 159)

22:46: Found Adware: apropos

22:46: contextplus.exe (ID = 185940)

22:46: setup.exe (ID = 164820)

22:47: a0000109.dll (ID = 159)

22:47: Found Adware: targetsaver

22:47: zmozm.exe (ID = 195131)

22:47: a0000108.dll (ID = 159)

22:47: a0000107.dll (ID = 159)

22:48: Found Adware: lopdotcom

22:48: a0000114.exe (ID = 121)

22:48: nfo.ocx (ID = 194608)

22:48: a0000106.dll (ID = 159)

22:49: zmozl.exe (ID = 195130)

22:49: Found Adware: packagehtml dialer

22:49: backup-20050728-185158-276.dll (ID = 107363)

22:49: a0000105.exe (ID = 168558)

22:49: stub_113_4_0_4_0.exe (ID = 193995)

22:50: backup-20050728-185159-742.dll (ID = 107281)

22:50: a0001083.dll (ID = 159)

22:50: a0000104.dll (ID = 159)

22:51: ecsiin.stub.exe (ID = 196862)

22:51: a0000103.dll (ID = 159)

22:51: a0001085.dll (ID = 159)

22:52: a0000102.dll (ID = 159)

22:52: class-barrel (ID = 78229)

22:52: zmozc.dll (ID = 195129)

22:52: vocabulary (ID = 78283)

22:52: a0000101.dll (ID = 159)

22:52: a0000100.dll (ID = 159)

22:52: a0001084.dll (ID = 159)

22:53: a0000099.dll (ID = 159)

22:53: a0000098.dll (ID = 188672)

22:53: a0000097.dll (ID = 188672)

22:53: a0000096.dll (ID = 159)

22:53: a0000095.dll (ID = 159)

22:53: a0000094.dll (ID = 159)

22:54: a0000093.dll (ID = 159)

22:54: a0000092.dll (ID = 159)

22:54: a0000091.dll (ID = 159)

22:55: winfixer2005scannersetup.exe (ID = 164822)

22:56: a0000113.exe (ID = 122)

22:56: a0000112.exe (ID = 122)

22:56: wingenerics.dll (ID = 50187)

22:57: backup-20051125-232118-780.dll (ID = 156904)

22:57: backup-20051125-232118-780.inf (ID = 156869)

22:58: sysnetsvc32.inf (ID = 107282)

22:58: egauth.inf (ID = 114420)

22:58: egauth.inf (ID = 114420)

22:58: egdaccess.inf (ID = 63780)

22:58: egdaccess.inf (ID = 63780)

22:58: backup-20050728-185158-276.inf (ID = 107360)

22:58: backup-20050728-185159-542.inf (ID = 63912)

22:58: backup-20050728-185159-742.inf (ID = 107282)

22:58: Found Adware: command

22:58: l45gnh6pqe.vbs (ID = 185675)

22:58: mon0204.ddx (ID = 57682)

22:58: mon0504.ddx (ID = 57682)

22:58: mon0904.ddx (ID = 57684)

22:58: mon0412.ddx (ID = 57682)

22:58: mon0106.ddx (ID = 57679)

22:58: mon0315.ddx (ID = 57682)

22:58: mon1204.ddx (ID = 57682)

22:58: mon1909.ddx (ID = 57684)

22:58: mon1125.ddx (ID = 57685)

23:01: Found Trojan Horse: subseven

23:01: optix_133.zip (ID = 77479)

23:02: File Sweep Complete, Elapsed Time: 00:26:07

23:02: Full Sweep has completed. Elapsed time 00:31:47

23:02: Traces Found: 328

23:07: Removal process initiated

23:07: Quarantining All Traces: klogger

23:07: Quarantining All Traces: look2me

23:07: Quarantining All Traces: lopdotcom

23:07: Quarantining All Traces: spysheriff

23:07: Quarantining All Traces: trojan-backdoor-us15info

23:07: Quarantining All Traces: apropos

23:07: Quarantining All Traces: optixpro

23:07: Quarantining All Traces: startnow

23:07: Quarantining All Traces: subseven

23:07: Quarantining All Traces: command

23:07: Quarantining All Traces: delfin

23:07: Quarantining All Traces: dollarrevenue

23:07: Quarantining All Traces: hotconnect dialer

23:07: Quarantining All Traces: instant access

23:07: Quarantining All Traces: packagehtml dialer

23:07: Quarantining All Traces: startnow startnow hijack

23:07: Quarantining All Traces: syswebtelecom

23:07: Quarantining All Traces: targetsaver

23:07: Quarantining All Traces: winantispyware 2005

23:08: Quarantining All Traces: adultfriendfinder cookie

23:08: Quarantining All Traces: passion cookie

23:08: Quarantining All Traces: rn11 cookie

23:08: Quarantining All Traces: xiti cookie

23:08: Quarantining All Traces: yieldmanager cookie

23:08: Removal process completed. Elapsed time 00:01:20

Log de Hijack

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE

C:\Program Files\AVPersonal\AVWUPSRV.EXE

c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\WINDOWS\system32\svchost.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

c:\program files\mcafee.com\agent\mcagent.exe

c:\progra~1\mcafee.com\vso\mcvsescn.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\AVPersonal\AVGNT.EXE

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\iPod\bin\iPodService.exe

c:\progra~1\mcafee.com\vso\mcvsftsn.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe

C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\utilitaires\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray