HiJackThis > IEAV [Résolu]

AtrusAldegarde · le 27 Juin 2008 17:01

Bonjour à tous,

Je viens poster ici, car malgré les deux autres post que j'ai pu lire sur ce forum concernant la résolution face à IEAV je ne trouve pas de correspondance dans mes logs de hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:47:26, on 27/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesFichiers communsMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesCheckPointSecuRemoteinSR_Service.exe
C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesRealVNCVNC4WinVNC4.exe
C:Program FilesHewlett-PackardSharedhpqwmiex.exe
C:WINDOWSSystem32alg.exe
C:Program FilesAlienGUIsewbload.exe
C:WINDOWSExplorer.EXE
C:Program FilesCheckPointSecuRemoteinSR_GUI.Exe
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesJavajre1.6.0_05injusched.exe
C:PROGRA~1CAETRUST~1 ealmon.exe
C:Program FilesMicrosoft IntelliPointpoint32.exe
C:Program FilesNotebook Hardware Control
hc.exe
C:Program FilesCACA Internet Security Suitecctraycctray.exe
C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe
C:WINDOWSsystem32 undll32.exe
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesAdobePhotoshop Album Edition Découverte3.2Appsapdproxy.exe
C:Program FilesEnigma Software GroupSpyHunterSpyHunter3.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesWinZipWZQKPICK.EXE
C:PROGRA~1MI3AA1~1 apimgr.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesiPodiniPodService.exe
C:Program FilesCACA Internet Security Suiteccprovsp.exe
C:WINDOWSExplorer.EXE
C:Program FilesMicrosoft OfficeOFFICE11EXCEL.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesMicrosoft OfficeOFFICE11OUTLOOK.EXE
C:Program FilesMicrosoft OfficeOFFICE11WINWORD.EXE
?C:WINDOWSsystem32WBEMWMIADAP.EXE
C:Documents and SettingsFR371078BureauHiJackThis.exe
C:WINDOWSsystem32wbemwmiprvse.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sitranet/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: VideoCodec Class - {926A61C9-5C20-4583-ACA7-ACE21088816E} - C:WINDOWSsystem32RichVideoCodec.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_05injusched.exe"
O4 - HKLM..Run: [Realtime Monitor] C:PROGRA~1CAETRUST~1 ealmon.exe -s
O4 - HKLM..Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [IntelliPoint] "C:Program FilesMicrosoft IntelliPointpoint32.exe"
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Adobe Photo Downloader] "C:Program FilesAdobePhotoshop Album Edition Découverte3.2Appsapdproxy.exe"
O4 - HKLM..Run: [SpyHunter Security Suite] C:Program FilesEnigma Software GroupSpyHunterSpyHunter3.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKUSS-1-5-19..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [Config] %systemroot%system32 un.cmd (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:Program FilesRealVNCVNC4WinVNC4.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/FR371078/LOCALS~1/Temp/msohtml1/02/clip_image002.jpg

--
End of file - 10342 bytes

Est-ce que l'un d'entre vous aurez la gentillesse de bien vouloir prendre un peu de son temps pour regarder ce log et m'expliquer où cette salo$*%!° de virus peut bien être?

En effet j'ai utilisé Malwarebytes' Anti-Malware en mode sans échec, il m'a trouvé quelques erreurs que j'ai effacé, rebooté sans restauration, mais malgré tout dès que je lance IE j'ai toujours le même soucis. Du coup j'ai desinstallé IE, je suis passé sous Firefox en attendant, mais je n'aime pas laissé ce ieav sur mon PC...

Voila! Merci d'avance de votre aide en tout cas et bonne journée.
Cdt,
Atrus

joedalton · le 27 Juin 2008 18:06

Salut a toi
ton pc est infecté par un trojan fix ces lignes en mode sans echec et poste ton nouveau rapport :wink:

O2 - BHO: VideoCodec Class - {926A61C9-5C20-4583-ACA7-ACE21088816E} - C:WINDOWSsystem32RichVideoCodec.dll

et celle la aussi

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKUSS-1-5-19..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SERVICE LOCAL')

O4 - HKUSS-1-5-20..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SERVICE RESEAU')

O4 - HKUSS-1-5-18..RunOnce: [Config] %systemroot%system32 un.cmd (User 'SYSTEM')

O4 - HKUS.DEFAULT..RunOnce: [Config] %systemroot%system32 un.cmd (User 'Default user')

AtrusAldegarde · le 27 Juin 2008 20:05

Bonjour Joedalton,

Merci pour ton intervention rapide !

Alors voici le nouveau rapport, en sachant que j'ai du fix certaines lignes en mode normal car elles n'étaient pas présentes en "mode sans échec". Suite au reboot, voici le nouveau rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:02:42, on 27/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesFichiers communsMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesCheckPointSecuRemoteinSR_Service.exe
C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesRealVNCVNC4WinVNC4.exe
C:Program FilesHewlett-PackardSharedhpqwmiex.exe
C:WINDOWSSystem32alg.exe
C:Program FilesAlienGUIsewbload.exe
C:WINDOWSExplorer.EXE
C:Program FilesSynapticsSynTPSynTPEnh.exe
C:Program FilesJavajre1.6.0_05injusched.exe
C:PROGRA~1CAETRUST~1 ealmon.exe
C:Program FilesMicrosoft IntelliPointpoint32.exe
C:Program FilesNotebook Hardware Control
hc.exe
C:WINDOWSsystem32 undll32.exe
C:Program FilesCACA Internet Security Suitecctraycctray.exe
C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe
C:Program FilesCheckPointSecuRemoteinSR_GUI.Exe
C:Program FilesiTunesiTunesHelper.exe
C:Program FilesAdobeReader 8.0ReaderReader_sl.exe
C:Program FilesAdobePhotoshop Album Edition Découverte3.2Appsapdproxy.exe
C:Program FilesEnigma Software GroupSpyHunterSpyHunter3.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:Program FilesWinZipWZQKPICK.EXE
C:PROGRA~1MI3AA1~1 apimgr.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesiPodiniPodService.exe
C:WINDOWSsystem32wuauclt.exe
C:Documents and SettingsFR371078BureauHiJackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://sitranet/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: VideoCodec Class - {926A61C9-5C20-4583-ACA7-ACE21088816E} - C:WINDOWSsystem32RichVideoCodec.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [SynTPEnh] C:Program FilesSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_05injusched.exe"
O4 - HKLM..Run: [Realtime Monitor] C:PROGRA~1CAETRUST~1 ealmon.exe -s
O4 - HKLM..Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [IntelliPoint] "C:Program FilesMicrosoft IntelliPointpoint32.exe"
O4 - HKLM..Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [iTunesHelper] "C:Program FilesiTunesiTunesHelper.exe"
O4 - HKLM..Run: [Adobe Reader Speed Launcher] "C:Program FilesAdobeReader 8.0ReaderReader_sl.exe"
O4 - HKLM..Run: [Adobe Photo Downloader] "C:Program FilesAdobePhotoshop Album Edition Découverte3.2Appsapdproxy.exe"
O4 - HKLM..Run: [SpyHunter Security Suite] C:Program FilesEnigma Software GroupSpyHunterSpyHunter3.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKUSS-1-5-19..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net ... plugin.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:Program FilesRealVNCVNC4WinVNC4.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/FR371078/LOCALS~1/Temp/msohtml1/02/clip_image002.jpg

--
End of file - 10167 bytes

Merci d'avance de ton retour

joedalton · le 27 Juin 2008 20:12

Tiens Astrus fix moi ca au passage
O2 - BHO: VideoCodec Class - {926A61C9-5C20-4583-ACA7-ACE21088816E} - C:WINDOWSsystem32RichVideoCodec.dll

apres je te propose un petit nettoyage de ta machine ici a la ligne :wink:

>>>
http://www.pc-infopratique.com/article- ... du-pc.html

H3bus · le 27 Juin 2008 20:48

Salut, fixe bien les lignes proposées par Joe, car tu as été infecté par Trojan-Downloader.Zlob.Media-Codec

_ SmitFraudix:

Tu télécharges SmitFraudix.

Double-cliques sur l'icône SmitFraudix.exe pour lancer l'application.
Tu verras un écran bleu à choix multiple, appuies sur la touche
[1] puis sur [Entrée].

Quand l'analyse est finie, tu nous postes le rapport généré par
SmitFraudix; si tu ne le trouves pas ou que le Bloc-notes ne s'ouvre pas
avec le rapport à l'intérieur, tu le trouveras ici: C: apport.txt.

Nettoyage 2:

Tu redémarres en Mode sans échec ([F8] au démarrage).

Tu te logges ensuite sur ta session puis tu lances SmitFraudix.

Tu appuis sur la touche [2] puis [Entrée].
Si tu as une ligne demandant le nettoyage de la base de registre,
appuies sur la touche [O] - pour Oui.

Quand l'analyse sera finie, un rapport sera généré.
Tu l'enregistres car il n'est pas sauvegardé par défaut.

joedalton · le 27 Juin 2008 20:50

merci H3 de prendre le relais

mais Astrus n'oublie pas le nettoyage apres l'analyse Smitfraud :wink:

H3bus · le 28 Juin 2008 10:40

Je prends pas le relai, j'apportais juste une précision pour nettoyer le Trojan avec un programme qui est pas dans le dossier nettoyage.

AtrusAldegarde · le 28 Juin 2008 14:33

Merci encore pour votre et désolé du temps de réponse mais je viens juste de tout finir...

Alors pour prendre dans l'ordre, voici le log hijackthis suite à la suppression des lignes citées en premier :

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSexplorer.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSexplorer.exe
C:PersoToolsHiJackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:Program FilesEoRezoEoAdvEoRezoBHO.dll
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKUSS-1-5-20..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-20..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAvast4ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe

--
End of file - 6387 bytes

J'ai ensuite effectué pas à pas tout le poste concernant le nettoyage du PC (dediou c'est long! :p). Ensuite j'ai dont utilisé le Smitfraudfix et voici le premier log :

SmitFraudFix v2.328

Rapport fait à 15:17:08,43, 28/06/2008
Executé à partir de C:Documents and SettingsFR371078BureauSmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAvast4aswUpdSv.exe
C:Program FilesAvast4ashServ.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesAlienGUIsewbload.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesFichiers communsMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesCheckPointSecuRemoteinSR_Service.exe
C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesHewlett-PackardSharedhpqwmiex.exe
C:WINDOWSExplorer.EXE
C:Program FilesAvast4ashMaiSv.exe
C:Program FilesAvast4ashWebSv.exe
C:Program FilesCheckPointSecuRemoteinSR_GUI.Exe
C:Program FilesNotebook Hardware Control
hc.exe
C:Program FilesCACA Internet Security Suitecctraycctray.exe
C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:WINDOWSsystem32ctfmon.exe
C:PROGRA~1MI3AA1~1 apimgr.exe
C:Program FilesWinZipWZQKPICK.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSExplorer.EXE
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
C:Program FilesCACA Internet Security Suiteccprovsp.exe
C:Documents and SettingsFR371078BureauSmitfraudFixPolicies.exe
C:WINDOWSsystem32cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1 www.legal-at-spybot.info
127.0.0.1 legal-at-spybot.info

»»»»»»»»»»»»»»»»»»»»»»»» C:

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSWeb

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32

»»»»»»»»»»»»»»»»»»»»»»»» C:WINDOWSsystem32LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsFR371078

»»»»»»»»»»»»»»»»»»»»»»»» C:Documents and SettingsFR371078Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:DOCUME~1FR371078Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDesktopComponents\0]
"Source"="file:///C:/DOCUME~1/FR371078/LOCALS~1/Temp/msohtml1/02/clip_image002.jpg"
"SubscribedURL"="file:///C:/DOCUME~1/FR371078/LOCALS~1/Temp/msohtml1/02/clip_image002.jpg"
"FriendlyName"=""

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDesktopComponents1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=" "

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLMSYSTEMCCSServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS2ServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCCSServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS2ServicesTcpipParameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Et voici le second suite au nettoyage en mode sans échec :

/edit ... impossible à coller il ne prend pas tout, j'essaie de le mettre dans une autre réponse ci-dessous

AtrusAldegarde · le 28 Juin 2008 14:41

SmitFraudFix v2.328

Rapport fait à 15:24:03,68, 28/06/2008
Executé à partir de C:Documents and SettingsFR371078BureauSmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

******* (pas la place :()

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLMSYSTEMCCSServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS2ServicesTcpip..{9DB1515D-EC24-4147-AE86-5A172F3EB777}: DhcpNameServer=192.168.1.1
HKLMSYSTEMCCSServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS1ServicesTcpipParameters: DhcpNameServer=192.168.1.1
HKLMSYSTEMCS2ServicesTcpipParameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon]
"System"=" "

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Voila, je relance le process de nettoyage complet et je vous tiens au courant ce soir! En tout cas encore merci de aide et j'espère que cela va fonctionner !

Merci encore.
Cdt,
Atrus

joedalton · le 28 Juin 2008 15:06

Salut atrus ton rapport hijackthis est ok,tu n'est plus infecté mais tu pourras fixer ces lignes aussi,mais attend un autre avis:

O4 - HKUSS-1-5-20..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE RESEAU'

O4 - HKUSS-1-5-18..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SYSTEM')

O4 - HKUS.DEFAULT..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'Default user')

AtrusAldegarde · le 28 Juin 2008 18:25

Bonjour,

J'ai peur que ce ne soit pas le cas :cry:

J'ai voulu vérifier que tout soit clean, je me promène dans l'explorer de windows et la message d'erreur :

Attention, Admin! Some dangerous trojan horses detected in your system. Microsoft Xp corrupted. This may lead to the destruction of important files in C:WINDOWS. Dowload protection software now!

Le même que j'avais lorsque je lancé IE auparavant.

Désormais dès que j'ai ce message le processus "explorer.exe" utilise 561Mo de mémoire et rend le système extrement lent, impossible de lancer le gestionnaire des tâches ou faire un alt-tab. De plus une fois que ce message apparait, 3 onglets IE Antivirus (http://free-viruscan.com/id/4912933/4/1/) s'ouvrent tout seul dans Firefox et du coup j'ai des freezes d'environ 1 min temps réel.

Je ne sais pas si ces explications peuvent vous aider.

Merci d'avance...

joedalton · le 28 Juin 2008 18:57

Salut atrus peux tu nous reposter un rapport hijackthis s'il te plait

AtrusAldegarde · le 28 Juin 2008 19:19

Bonjour,

Ouinnnnnnnn c'est de pire en pire, j'ai mis au moins 45 mon à faire le log et réussir à poster :(

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:14:04, on 28/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAvast4aswUpdSv.exe
C:Program FilesAvast4ashServ.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesFichiers communsMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesCheckPointSecuRemoteinSR_Service.exe
C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesHewlett-PackardSharedhpqwmiex.exe
C:Program FilesAvast4ashMaiSv.exe
C:Program FilesAvast4ashWebSv.exe
C:Program FilesAlienGUIsewbload.exe
C:WINDOWSExplorer.EXE
C:Program FilesCheckPointSecuRemoteinSR_GUI.Exe
C:Program FilesNotebook Hardware Control
hc.exe
C:Program FilesCACA Internet Security Suitecctraycctray.exe
C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesWinZipWZQKPICK.EXE
C:PROGRA~1MI3AA1~1 apimgr.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSsystem32 askmgr.exe
C:Program FilesCACA Internet Security Suiteccprovsp.exe
C:PersoToolsHiJackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:Program FilesEoRezoEoAdvEoRezoBHO.dll
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKUSS-1-5-19..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O17 - HKLMSystemCCSServicesTcpip..{232F90CD-9799-4008-A777-9807C35049B3}: NameServer = 10.6.2.13,10.26.2.11,10.5.8.33
O17 - HKLMSystemCS1ServicesTcpip..{232F90CD-9799-4008-A777-9807C35049B3}: NameServer = 10.6.2.13,10.26.2.11,10.5.8.33
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAvast4ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe

--
End of file - 8065 bytes

joedalton · le 28 Juin 2008 19:51

Atrus fix les 4 lignes que je t'ai posté sur le post plus haut en mode sans echec. et après active ton pare feu windows,c'est important et pste ton rapport

AtrusAldegarde · le 29 Juin 2008 00:57

Merci Joedalton je vois que tu n'abandonnes pas! Merci

1er log en mode "sans échec" suite à la suppression des 3 lignes citées dans ton précédent post et aprés avoir réactiver le pare-feu de Windows :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:38:30, on 29/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Safe mode with network support

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSExplorer.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:PersoToolsHiJackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:Program FilesEoRezoEoAdvEoRezoBHO.dll
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKUSS-1-5-20..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAvast4ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe

--
End of file - 6131 bytes

Et ici le 2ème log suite au passage en mode normal :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:55:20, on 29/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesAvast4aswUpdSv.exe
C:Program FilesAvast4ashServ.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSMicrosoft.NETFrameworkv2.0.50727mscorsvw.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesCAeTrust AntivirusInoTask.exe
C:Program FilesFichiers communsMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32
vsvc32.exe
C:Program FilesCheckPointSecuRemoteinSR_Service.exe
C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesHewlett-PackardSharedhpqwmiex.exe
C:Program FilesAvast4ashMaiSv.exe
C:Program FilesAvast4ashWebSv.exe
C:Program FilesAlienGUIsewbload.exe
C:WINDOWSExplorer.EXE
C:Program FilesCheckPointSecuRemoteinSR_GUI.Exe
C:Program FilesNotebook Hardware Control
hc.exe
C:Program FilesCACA Internet Security Suitecctraycctray.exe
C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe
C:Program FilesMicrosoft ActiveSyncwcescomm.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:PROGRA~1MI3AA1~1 apimgr.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesWinZipWZQKPICK.EXE
C:Program FilesCACA Internet Security Suiteccprovsp.exe
C:WINDOWSExplorer.EXE
C:PersoToolsHiJackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,ShellNext = http://sitranet/
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = 10.4.4.129:8080
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = ;*.local;10.*;<local>
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:Program FilesEoRezoEoAdvEoRezoBHO.dll
O2 - BHO: WinView plugin - {8AE578E0-6DF5-41E0-869F-F65A32D2F6BD} - C:WINDOWSsystem32z_view.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier2.0.301.7164swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar2.dll
O4 - HKLM..Run: [QlbCtrl] %ProgramFiles%Hewlett-PackardHP Quick Launch ButtonsQlbCtrl.exe /Start
O4 - HKLM..Run: [Cpqset] C:Program FilesHPQDefault Settingscpqset.exe
O4 - HKLM..Run: [NotebookHardwareControl] "C:Program FilesNotebook Hardware Control
hc.exe" -quiet
O4 - HKLM..Run: [cctray] "C:Program FilesCACA Internet Security Suitecctraycctray.exe"
O4 - HKLM..Run: [QOELOADER] "C:Program FilesCACA Internet Security SuiteCA Anti-SpamQSP-5.1.18.0QOELoader.exe"
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncwcescomm.exe"
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKUSS-1-5-19..RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%System32syssetub.dll" "%SystemRoot%System32syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-19..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'SYSTEM')
O4 - HKUS.DEFAULT..RunOnce: [tscuninstall] %systemroot%system32 scupgrd.exe (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:PROGRA~1MI3AA1~1INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~3OFFICE11REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:PROGRA~1SPYBOT~1SDHelper.dll
O15 - Trusted IP range: http://10.31.21.131
O15 - Trusted IP range: http://10.31.21.135
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:Program FilesAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:Program FilesAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:Program FilesAvast4ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:Program FilesAvast4ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:Program FilesCACA Internet Security Suiteccprovsp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:Program FilesHewlett-PackardSharedhpqwmiex.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:Program FilesCheckPointSecuRemoteinSR_WatchDog.exe

--
End of file - 7611 bytes

Cdt,
Atrus

HiJackThis > IEAV [Résolu]

HiJackThis > IEAV [Résolu]

Sujets similaires

Qui est en ligne