Je suis actuellement sur le PC d'une amie qui a été visiblement infectée par un cheval de troie
Elle m'a appelé en disant qu'en ouvrant sa clé USB, où se trouvent des photos qu'elle venait d'amener à développer chez son photographe, son antivirus (AVG) avait détecté un cheval de troie (je suppose que c'est le PC du photographe qui devait être contaminé puisque la clé USB auparavant ne l'était pas)
1er problème: elle a ouvert quand même les photos malgré l'avertissement d'AVG, mais elle ne sait pas si c'est AVANT de mettre le trojan en quarantaine ou APRES
2e problème: elle a mis le cheval de troie en quarantaine MAIS l'a supprimé
3e problème: elle ne se rappele plus du nom du cheval de troie
Je suis sur son PC où actuellement AVG ne détecte rien d'anormal, ni sur son PC, ni sur la clé USB
En revanche, impossible d'ouvrir la clé USB autrement que par la commande "explorer". En double-cliquant dans le Poste de Travail, il y'a un accès refusé
Je ne sais pas si le PC est contaminé ou non
C'est pour celà que je sollicite votre aide
Je viens de faire une analyse avec HijackThis, et voilà le contenu du LOG:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:03:50, on 11/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32rss01a.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesIntelIntelDHCCUAlertService.exe
C:PROGRA~1FICHIE~1AOLACSAOLacsd.exe
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:WINDOWSeHomeehRecvr.exe
C:WINDOWSeHomeehSched.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
C:Program FilesCAeTrust AntivirusInoRpc.exe
C:WINDOWSExplorer.EXE
C:Program FilesCAeTrust AntivirusInoRT.exe
C:Program FilesFichiers communsMicrosoft SharedVS7Debugmdm.exe
C:WINDOWSehomeehtray.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:PROGRA~1COMMON~1X10Commonx10nets.exe
C:PROGRA~1AVGAVG8avgrsx.exe
C:WINDOWSRTHDCPL.EXE
C:Program FilesFichiers communsIntelIntelDHNMSSupportIntelHCTAgent.exe
C:PROGRA~1CAETRUST~1 ealmon.exe
C:Program FilesFichiers communsAOLACSAOLDial.exe
C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe
C:PROGRA~1WanadooCnxMon.exe
C:PROGRA~1WanadooTaskbarIcon.exe
C:PROGRA~1AVGAVG8avgemc.exe
C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmm_tray.exe
C:Program FilesJavajre1.6.0_05injusched.exe
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:PROGRA~1AVGAVG8avgtray.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
C:Program FilesWindows Media PlayerWMPNSCFG.exe
C:Program FilesMSN MessengerMsnMsgr.Exe
C:Program FilesIntelIntelDHIntel® Quick Resume Technology DriversElservice.exe
C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe
C:Program FilesHPDigital Imaginginhpqtra08.exe
C:Program FilesNikonPictureProjectNkbMonitor.exe
C:Program FilesWanadooEspaceWanadoo.exe
C:Program FilesWanadooComComp.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32dllhost.exe
C:Program FilesWanadooWatch.exe
C:WINDOWSeHomeehmsas.exe
C:Program FilesHPDigital ImaginginhpqSTE08.exe
C:Program FilesHPDigital Imaginginhpqbam08.exe
C:Program FilesHPDigital Imaginginhpqgpc01.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesHPDigital ImagingSmart Web Printinghpswp_clipbook.exe
C:Program FilesMicrosoft OfficeOffice10WINWORD.EXE
C:PROGRA~1AVGAVG8avgscanx.exe
C:Program FilesJavajre1.6.0_05injucheck.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.wanadoo.fr/go/page_recherche/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wanadoo.fr
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =
R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:Program FilesAVGAVG8avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.6.0_05inssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesFichiers communsMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:PROGRA~1AVGAVG8AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:Program FilesGoogleGoogleToolbarNotifier5.0.926.3450swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:Program FilesGoogleGoogle ToolbarComponentfastsearch_219B3E1547538286.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_BHO.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:Program FilesAOL Toolbar oolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:PROGRA~1AVGAVG8AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:Program FilesGoogleGoogle ToolbarGoogleToolbar.dll
O4 - HKLM..Run: [ehTray] C:WINDOWSehomeehtray.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..Run: [SkyTel] SkyTel.EXE
O4 - HKLM..Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..Run: [CCUTRAYICON] C:Program FilesIntelIntelDHCCUCCU_TrayIcon.exe
O4 - HKLM..Run: [NMSSupport] "C:Program FilesFichiers communsIntelIntelDHNMSSupportIntelHCTAgent.exe" /startup
O4 - HKLM..Run: [AntivirusRegistration] C:Program FilesCAEtrust AntivirusRegister.exe
O4 - HKLM..Run: [Realtime Monitor] C:PROGRA~1CAETRUST~1 ealmon.exe -s
O4 - HKLM..Run: [AOLDialer] C:Program FilesFichiers communsAOLACSAOLDial.exe
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [IAAnotif] C:Program FilesIntelIntel Matrix Storage ManagerIaanotif.exe
O4 - HKLM..Run: [WooCnxMon] C:PROGRA~1WanadooCnxMon.exe
O4 - HKLM..Run: [WOOWATCH] C:PROGRA~1WanadooWatch.exe
O4 - HKLM..Run: [WOOTASKBARICON] C:PROGRA~1WanadooTaskbarIcon.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [MMTray] C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmm_tray.exe
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.6.0_05injusched.exe"
O4 - HKLM..Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe
O4 - HKLM..Run: [hpqSRMon] C:Program FilesHPDigital ImaginginhpqSRMon.exe
O4 - HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Orange Link] "C:PROGRA~1ORANGE~1APPLIC~1CommunicationAgentCommunicationAgent.exe" -ICom_StartNoSplashScreen
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifierGoogleToolbarNotifier.exe
O4 - HKCU..Run: [WMPNSCFG] C:Program FilesWindows Media PlayerWMPNSCFG.exe
O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSsystem32CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imaginginhpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:Program FilesAdobeAcrobat 7.0Reader eader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:Program FilesNikonPictureProjectNkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.6.0_05inssv.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:Program FilesAOL Toolbar oolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:Program FilesAOL Toolbar oolbar.dll
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:Program FilesHPDigital ImagingSmart Web Printinghpswp_BHO.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:PROGRA~1WANADO~1Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:PROGRA~1WANADO~1Wanadoo Messager.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.carrefour-multimedia.fr/
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1153818313234
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1153818398984
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://claireclarachou09.spaces.live.com/P...ad/MsnPUpld.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O17 - HKLMSystemCCSServicesTcpip..{ACD5BE4E-9A69-4BA9-8275-65384428CDA0}: NameServer = 81.253.149.1 80.10.246.3
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:Program FilesAVGAVG8avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Intel® Alert Service (AlertService) - Intel Corporation - C:Program FilesIntelIntelDHCCUAlertService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:PROGRA~1FICHIE~1AOLACSAOLacsd.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:WINDOWSsystem32rsvc01a.exe
O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:Program FilesIntelIntelDHIntel® Quick Resume Technology DriversElservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:Program FilesGoogleCommonGoogle UpdaterGoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:Program FilesIntelIntel Matrix Storage ManagerIaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:Program FilesCAeTrust AntivirusInoTask.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32
vsvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:PROGRA~1COMMON~1X10Commonx10nets.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/ASSOCI~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg
--
End of file - 12945 bytes
Qu'en pensez-vous? Le PC est-il infecté? Que dois-je faire?
Je vous remercie beaucoup
