[Résolu] Pouvez-vous vérifier si mon PC est infecté ?

[loudakota]

Bonsoir,

je me suis appercu que j etais infecter par newdonet, j ai suivi la procedure qui est dans le forum pour l eradiquer.Je voulais savoir si j en etais bien debarrasser et si il n y avait pas d autres infections.quelle ligne puis je fixer sans risque .

Merci de votre aide.

Logfile of HijackThis v1.99.1

Scan saved at 19:52:31, on 19/02/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\LEXBCES.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\LEXPPS.EXE

D:\Program Files\AntiVir PersonalEdition Classic\sched.exe

D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

D:\WINDOWS\system32\oodag.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\ZoneLabs\vsmon.exe

D:\WINDOWS\system32\Ati2evxx.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\nvraidservice.exe

D:\WINDOWS\SOUNDMAN.EXE

D:\Program Files\ATI Technologies\ATI.ACE\cli.exe

D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

D:\Program Files\DAEMON Tools\daemon.exe

D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

D:\WINDOWS\System32\wbem\unsecapp.exe

D:\Documents and Settings\loudakota\Bureau\rk-launcher_rk_launcher_0.4_francais_14854\RKLauncher.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\WINDOWS\System32\rsvp.exe

D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\dsidebar.exe

D:\Program Files\MSN Messenger\msnmsgr.exe

D:\Program Files\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neuf.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\sbhelp.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - D:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll

O4 - HKLM\..\Run: [NVRaidService] D:\WINDOWS\system32\nvraidservice.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ATICCC] "D:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKCU\..\Run: [sTYLEXP] D:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [sIDEBAR] "D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\dsidebar.exe"

O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: RK Launcher.lnk = ?

O4 - Global Startup: ATI CATALYST System Tray.lnk = D:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Subscribe in Desktop Sidebar - res://D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\sbhelp.dll/menuhandler.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\sbhelp.dll

O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - D:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\sbhelp.dll

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kav...can_unicode.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1138919978437

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: O&O Defrag - O&O Software GmbH - D:\WINDOWS\system32\oodag.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - D:\WINDOWS\SYSTEM32\slserv.exe

O23 - Service: StyleXPService - Unknown owner - D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

[did71]

Bonsoir loudakota,

 

le rapport ne montre aucune trace d'infection.

 

télécharge ewido, met le à jour et scan :

http://www.ewido.net/fr/

 

poste le rapport ewido ensuite

 

a+

[loudakota]

rebonsoir voici le rapport ewido

--------------------------------------------------------

ewido anti-malware - Rapport de scan

---------------------------------------------------------

 

+ Créé le: 21:48:32, 19/02/2006

+ Somme de contrôle: 66C3B743

 

+ Résultats du scan:

 

:mozilla.8:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder

:mozilla.9:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder

:mozilla.10:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Valueclick : Nettoyer et sauvegarder

:mozilla.12:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder

:mozilla.15:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder

:mozilla.16:D:\Documents and Settings\loudakota\Application Data\Mozilla\Firefox\Profiles\z9yuxqdq.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder

 

 

::Fin du rapport

 

merci de ton aide

[did71]

re,

 

juste des cookies trouvés par ewido et supprimés dons aucun soucis.

 

a+

[loudakota]

ok merci