Aujourd'hui, j'ai récupéré Zlob Trojan. J'ai déctivé la restauration et passé hijackthis. Je suis avec Windows XP.
Voici le rapport. Si quelqu'un peut me guider pour la suite. Arigato d'avance.
Ratelekar
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:55:57, on 26/04/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesSymantecNorton Ghost 2003GhostStartService.exe
C:WINDOWSSystem32nvsvc32.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32ZONELABSvsmon.exe
C:Program FilesVideo ActiveX Objectisamntr.exe
C:Program FilesVideo ActiveX Objectpmsnrr.exe
C:Program FilesSymantecNorton Ghost 2003GhostStartTrayApp.exe
C:Program FilesVideo ActiveX Objectisamini.exe
C:Program FilesQuickTimeqttask.exe
C:Program FilesVideo ActiveX Objectpmmnt.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesMicrosoft ActiveSyncWCESCOMM.EXE
C:Program FilesSkypePhoneSkype.exe
C:program filesvoipstunt.comvoipstuntvoipstunt.exe
C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe
C:Program FilesAntiViral Toolkit Proavpm.exe
C:Program FilesGetRightgetright.exe
C:Program FilesSony CorporationImage TransferSonyTray.exe
C:Program FilesZone LabsZoneAlarmzapro.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesVideo ActiveX Objectisamini.exe
C:DownloadsHiJackThis_v2.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
http://login.live.com/login.srf?id=2&svc=mail&cbid=24325&msppjph=1&tw=900&fs=1&lc=1036&_lang=FRR1 - HKCUSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,HomeOldSP = about:blank
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Liens
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:PROGRA~1eoRezoEoAdvEOREZO~1.DLL (file missing)
O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:Program FilesVideo ActiveX Objectisadd.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:program filesgooglegoogletoolbar4.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:Program FilesCanonEasy-WebPrintToolband.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:program filesgooglegoogletoolbar4.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [GhostStartTrayApp] C:Program FilesSymantecNorton Ghost 2003GhostStartTrayApp.exe
O4 - HKLM..Run: [RunDLL] rundll32.exe "C:WINDOWSDownloaded Program Filesbridge.dll",Load
O4 - HKLM..Run: [Microsoft Update] ms.exe
O4 - HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..RunServices: [Microsoft Update] ms.exe
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [Microsoft Update] ms.exe
O4 - HKCU..Run: [H/PC Connection Agent] "C:Program FilesMicrosoft ActiveSyncWCESCOMM.EXE"
O4 - HKCU..Run: [IncrediMail] C:Program FilesIncrediMailbinIncMail.exe /c
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [VoipStunt] "C:program filesvoipstunt.comvoipstuntvoipstunt.exe" -nosplash -minimized
O4 - HKCU..Run: [swg] C:Program FilesGoogleGoogleToolbarNotifier1.2.1128.5462GoogleToolbarNotifier.exe
O4 - HKLM..PoliciesExplorerRun: [user32.dll] C:Program FilesVideo ActiveX Objectisamntr.exe
O4 - HKLM..PoliciesExplorerRun: [rare] C:Program FilesVideo ActiveX Objectpmsnrr.exe
O4 - HKUSS-1-5-19..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUSS-1-5-20..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUSS-1-5-18..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'SYSTEM')
O4 - HKUS.DEFAULT..Run: [CTFMON.EXE] C:WINDOWSSystem32CTFMON.EXE (User 'Default user')
O4 - Global Startup: AVP Monitor.lnk = C:Program FilesAntiViral Toolkit Proavpm.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:Program FilesGetRightgetright.exe
O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:Program FilesZone LabsZoneAlarmzapro.exe
O8 - Extra context menu item: Download with GetRight - C:Program FilesGetRightGRdownload.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel -
res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions -
res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide -
res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer -
res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser -
res://C:Program FilesCanonEasy-WebPrintResource.dll/RC_Preview.html
O8 - Extra context menu item: Open with GetRight Browser - C:Program FilesGetRightGRbrowse.htm
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:WINDOWSSystem32crt32_v2.dll (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: osmim.dll
O10 - Unknown file in Winsock LSP: osmim.dll
O10 - Unknown file in Winsock LSP: osmim.dll
O10 - Unknown file in Winsock LSP: osmim.dll
O10 - Unknown file in Winsock LSP: osmim.dll
O10 - Unknown file in Winsock LSP: osmim.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) -
http://www.ipix.com/viewers/ipixx.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cabO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cabO16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVRX) -
http://www.devalvr.com/instalacion/plugin/devalocx.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
http://www.zebulon.fr/scan8/oscan8.cabO16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) -
http://www.mypixmania.com/tools/activex/fpu.cabO16 - DPF: {73F0FD85-BD47-4A95-86D1-DE38860462C1} (PremiumHTML Class) -
http://213.254.243.5/data/dialercab/IberoDialerHTML.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4347/mcfscan.cabO16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) -
http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cabO18 - Filter hijack: text/html - {351D8D17-B0A3-4581-827D-F2C1FD74D7F4} - C:WINDOWSSystem32bhehegb.dll
O18 - Filter: text/plain - {351D8D17-B0A3-4581-827D-F2C1FD74D7F4} - C:WINDOWSSystem32bhehegb.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:WINDOWSSystem32browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:WINDOWSSystem32browseui.dll
O22 - SharedTaskScheduler: frisbee - {abef791f-947e-4cdf-83c3-e72a240afb67} - C:WINDOWSSystem32ygjun.dll
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:WINDOWSSystem32dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:WINDOWSsystem32services.exe
O23 - Service: GhostStartService - Symantec Corporation - C:Program FilesSymantecNorton Ghost 2003GhostStartService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesFichiers communsInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:WINDOWSSystem32imapi.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:Program FilesFichiers communsMacromedia SharedServiceMacromedia Licensing.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:WINDOWSSystem32mnmsrvc.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:WINDOWSsystem32netdde.exe
O23 - Service: DSDM DDE réseau (NetDDEdsdm) - Unknown owner - C:WINDOWSsystem32netdde.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:WINDOWSsystem32services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:WINDOWSsystem32sessmgr.exe
O23 - Service: Prise en charge des cartes à puces (SCardDrv) - Unknown owner - C:WINDOWSSystem32SCardSvr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:WINDOWSSystem32SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:WINDOWSsystem32smlogsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:WINDOWSsystem32ZONELABSvsmon.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:WINDOWSSystem32vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:WINDOWSSystem32wbemwmiapsrv.exe
O24 - Desktop Component 0: (no name) -
file:///C:/DOCUME~1/pascal/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg--
End of file - 10837 bytes
Jeu 26 Avr - 11:48
