Rapport hijack, Panda et Vundofix

[clems0784]

Voila le scan de Panda :

Incident Status Location

 

Virus:Trj/Eiro.P Not desinfected C:\sbd789.exe[systemboot.exe]

Virus:Trj/Pintxatore.C Not desinfected C:\sbd789.exe[dez.exe]

Hacktool:HackTool/DiskInfo.A Not desinfected C:\WINDOWS\system32\dllcache\DISKINFO.EXE

Virus:W32/Sdbot.ftp Disinfected C:\WINDOWS\system32\i

Virus:Bck/Obot.B Disinfected C:\WINDOWS\system32\pmkhh.dll

Virus:Bck/Obot.B Disinfected C:\WINDOWS\system32\pmnnk.dll

Virus:Bck/Obot.B Disinfected C:\WINDOWS\system32\vtuts.dll

 

 

Le scan de Vundofix :

VundoFix V2.15 by Atri

--------------------------------------------------------------------------------------

 

Listing files contained in the vundofix folder.

--------------------------------------------------------------------------------------

 

killvundo.bat

process.exe

ReadMe.txt

vundo.reg

vundofix.txt

 

--------------------------------------------------------------------------------------

 

Filepaths entered

--------------------------------------------------------------------------------------

 

The filepath entered was C:\WINDOWS\System32\pmnnl.dll

 

The second filepath entered was C:\WINDOWS\System32\Innmp.*

 

--------------------------------------------------------------------------------------

 

Log from Process

--------------------------------------------------------------------------------------

 

 

Killing PID 152 'smss.exe'

 

Killing PID 716 'explorer.exe'

Killing PID 716 'explorer.exe'

 

 

Killing PID 228 'winlogon.exe'

--------------------------------------------------------------------------------------

 

C:\WINDOWS\System32\pmnnl.dll Deleted sucessfully.

C:\WINDOWS\System32\Innmp.* Deleted sucessfully.

 

Fixing Registry

--------------------------------------------------------------------------------------

 

Et enfin le scan de HijackThis :

 

Logfile of HijackThis v1.99.1

Scan saved at 21:57:41, on 28/12/2005

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVPersonal\AVGUARD.EXE

C:\Program Files\AVPersonal\AVWUPSRV.EXE

C:\WINDOWS\System32\scvhost32dll.exe

c:\windows\system32\dllcache\runbatch.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

C:\Program Files\AVPersonal\AVGNT.EXE

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\WINDOWS\system32\cmd.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-internet.fr

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-internet.fr/navig/lanceur/item9.phtml

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\System32\pmnnl.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [adiras] adiras.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min

O4 - HKLM\..\RunOnce: [Panda_cleaner_124925] C:\WINDOWS\System32\ActiveScan\pavdr.exe 124925

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{F73FA331-470B-4619-98DA-6D6AD2ED2237}: NameServer = 194.117.200.10 194.117.200.15

O20 - Winlogon Notify: pmnnl - C:\WINDOWS\System32\pmnnl.dll (file missing)

O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE

O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE

O23 - Service: kasjduijeuusdfs (dllhost32) - Unknown owner - C:\WINDOWS\System32\scvhost32dll.exe

O23 - Service: FireDaemon Service: eventsec (eventsec) - Unknown owner - c:\windows\system32\dllcache\FireDaemon.EXE (file missing)

O23 - Service: PixelModule (pxlmdl) - Unknown owner - C:\WINDOWS\nvidcgui.exe (file missing)

O23 - Service: FireDaemon Service: runbatch (runbatch) - Unknown owner - c:\windows\system32\dllcache\FireDaemon.EXE (file missing)

O23 - Service: ms svc host (scvhost) - Unknown owner - C:\WINDOWS\System32\svchost32.exe (file missing)

O23 - Service: Service Hosts (ServiceHost) - Unknown owner - C:\WINDOWS\shost.exe (file missing)

 

Que dois-je faire maintenant ?

[Thanos]

clems0784 ,s'il te plait ne lance pas un nouveau message,à chacune de tes réponses,sinon ca va devenir incompréhensible!:je continue la discussion sur le premier message que tu as posté.Un modérateur va devoir fermer ce topic.

La suite ici=> http://forum.zebulon.fr/index.php?showtopic=83212

Modifié le 29 décembre 2005 par charles ingals