Se connecter / S'enregistrer
Votre question

C:\WINDOWS\extel.exe\[UPX]

Tags :
  • Internet Explorer
  • Sécurité
Dernière réponse : dans Sécurité et virus
19 Juillet 2005 08:15:06

Voila, avast me trouve ce virus mais il me dit :

0fichier infécté et il n'est pas dans "C:\WINDOWS\" !

voici mon log hijhackthis :

Citation :
Logfile of HijackThis v1.99.1
Scan saved at 08:09:38, on 19/07/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Avast\ashDisp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\Program Files\Avast\aswUpdSv.exe
C:\Program Files\Avast\ashServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Avast\ashWebSv.exe
C:\Program Files\Avast\ashMaiSv.exe
C:\Program Files\Avast\ashSimpl.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Program Files\Avast\ashSimpl.exe
C:\Documents and Settings\Syn\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 216.138.184.21 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 216.138.184.21 www3.aibgbonline.co.uk
O1 - Hosts: 216.138.184.21 www.bank.alliance-leicester.co.uk
O1 - Hosts: 216.138.184.21 login.iblogin.com
O1 - Hosts: 216.138.184.21 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 216.138.184.21 inet.barclays.co.uk
O1 - Hosts: 216.138.184.21 iibank.barclays.co.uk
O1 - Hosts: 216.138.184.21 iibank.cahoot.com
O1 - Hosts: 216.138.184.21 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 216.138.184.21 ww.hsbc.co.uk
O1 - Hosts: 216.138.184.21 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 216.138.184.21 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 216.138.184.21 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 216.138.184.21 ww3.online.lloydstsb.co.uk
O1 - Hosts: 216.138.184.21 ww3.online.lloydstsb.co.uk
O1 - Hosts: 216.138.184.21 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 216.138.184.21 ob2.nationet.com
O1 - Hosts: 216.138.184.21 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 216.138.184.21 ww1.nwolb.com
O1 - Hosts: 216.138.184.21 ww1.onlinebanking.iombank.com
O1 - Hosts: 216.138.184.21 ww1.www.rbsdigital.com
O1 - Hosts: 216.138.184.21 welcome.smile.co.uk
O1 - Hosts: 216.138.184.21 login.365online.com
O1 - Hosts: 216.138.184.21 wvw.citizensbankonline.com
O1 - Hosts: 216.138.184.21 esecure.regionsnet.com
O1 - Hosts: 216.138.184.21 rollb.associatedbank.com
O1 - Hosts: 216.138.184.21 upb.unionplanters.com
O1 - Hosts: 216.138.184.21 www.onlinebanking.huntington.com
O1 - Hosts: 216.138.184.21 inet.southtrustonlinebanking.com
O1 - Hosts: 216.138.184.21 logon.personal.wamu.com
O1 - Hosts: 216.138.184.21 login.compassweb.com
O1 - Hosts: 216.138.184.21 logon.firstmeritib.com
O1 - Hosts: 216.138.184.21 login.ccfcuonline.org
O1 - Hosts: 216.138.184.21 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 216.138.184.21 ww2.onlinebanking.lasallebank.com
O1 - Hosts: 216.138.184.21 wvw.totallyfreebanking.com
O1 - Hosts: 216.138.184.21 www.online.wellsfargo.com
O1 - Hosts: 216.138.184.21 www.onlinebanking.bankofoklahoma.com
O1 - Hosts: 216.138.184.21 accounts4.keybank.com
O1 - Hosts: 216.138.184.21 logon.bankone.com
O1 - Hosts: 216.138.184.21 www.secure.tdbanknorth.com
O1 - Hosts: 216.138.184.21 www.secure.mvnt4.com
O1 - Hosts: 216.138.184.21 ww.mynfbonline.com
O1 - Hosts: 216.138.184.21 login.forumcuonline.com
O1 - Hosts: 216.138.184.21 www.eds.usersonlnet.com
O1 - Hosts: 216.138.184.21 www.onlineid.bankofamerica.com
O1 - Hosts: 216.138.184.21 wvw.e-gold.com
O1 - Hosts: 216.138.184.21 pcbs.peoples.com
O1 - Hosts: 216.138.184.21 www.global1.onlinebank.com
O1 - Hosts: 216.138.184.21 ww2.mybranch.lafcu.com
O1 - Hosts: 216.138.184.21 login.webbanking.comerica.com
O1 - Hosts: 216.138.184.21 web.banking.firsttennessee.com
O1 - Hosts: 216.138.184.21 logon.members1st.org
O1 - Hosts: 216.138.184.21 www.cib.ibanking-services.com
O1 - Hosts: 216.138.184.21 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 216.138.184.21 wvw.paypal.com
O1 - Hosts: 216.138.184.21 www.signin.ebay.com
O1 - Hosts: 216.138.184.21 wvw.etrade.com
O1 - Hosts: 216.138.184.21 ww4.fleethomelink.fleet.com
O1 - Hosts: 216.138.184.21 ww3.connect.skyfi.com
O1 - Hosts: 216.138.184.21 www6.usbank.com
O1 - Hosts: 216.138.184.21 www.bvi.bancodevalencia.es
O1 - Hosts: 216.138.184.21 extrant.banesto.es
O1 - Hosts: 216.138.184.21 banesnt.banesto.es
O1 - Hosts: 216.138.184.21 activia.caixagalicia.es
O1 - Hosts: 216.138.184.21 www.bancae.caixapenedes.com
O1 - Hosts: 216.138.184.21 login.caixasabadell.net
O1 - Hosts: 216.138.184.21 oii.cajamadrid.es
O1 - Hosts: 216.138.184.21 login.cajamar.es
O1 - Hosts: 216.138.184.21 login.ccm.es
O1 - Hosts: 216.138.184.21 ww.unicaja.es
O1 - Hosts: 216.138.184.21 www5.bancopopular.es
O1 - Hosts: 216.138.184.21 ww3.bbvanet.com
O1 - Hosts: 216.138.184.21 ww.bayernlb.de
O1 - Hosts: 216.138.184.21 ww2.berliner-volksbank.de
O1 - Hosts: 216.138.184.21 ww7.homebanking-berlin.de
O1 - Hosts: 216.138.184.21 portal09.commerzbanking.de
O1 - Hosts: 216.138.184.21 www.meine.deutsche-bank.de
O1 - Hosts: 216.138.184.21 ww2.dresdner-privat.de
O1 - Hosts: 216.138.184.21 ww.e-banking.helaba.de
O1 - Hosts: 216.138.184.21 ww.hsh-nordbank.de
O1 - Hosts: 216.138.184.21 www.my.hypovereinsbank.de
O1 - Hosts: 216.138.184.21 ww3.homebanking-berlin.de
O1 - Hosts: 216.138.184.21 ww3.homebanking-berlin.de
O1 - Hosts: 216.138.184.21 www.banking.lbbw.de
O1 - Hosts: 216.138.184.21 lrp.sparkasse-banking.de
O1 - Hosts: 216.138.184.21 ww3.homebanking-niedersachsen.de
O1 - Hosts: 216.138.184.21 www.onlinebanking.norisbank.de
O1 - Hosts: 216.138.184.21 www.banking.postbank.de
O1 - Hosts: 216.138.184.21 wvw.internetbanking.gad.de
O1 - Hosts: 216.138.184.21 ww1.portal.izb.de
O1 - Hosts: 216.138.184.21 wvw.kunden-service.lbs.de
O1 - Hosts: 216.138.184.21 ibanking.seb.de
O1 - Hosts: 216.138.184.21 bw7.sparkasse-banking.de
O1 - Hosts: 216.138.184.21 ww2.homebanking-sparkasse.de
O1 - Hosts: 216.138.184.21 ww2.vr-networld-ebanking.de
O1 - Hosts: 216.138.184.21 ww.bics.fr
O1 - Hosts: 216.138.184.21 www.co.caixabank.fr
O1 - Hosts: 216.138.184.21 ww.creditmutuel.fr
O1 - Hosts: 216.138.184.21 internetbank.intesabci.it
O1 - Hosts: 216.138.184.21 ww.extensive.bancalombarda.it
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Msxml32DOMDocument Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\WINDOWS\System32\dllcache\msxml32.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.170.82/e9xr2.chm::/file.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Autres pages sur : windows extel exe upx

19 Juillet 2005 08:44:26

Quand tu a regarder dans windows, a tu cocher la case dans affichage pour voir les fichier cacher :idea:
19 Juillet 2005 08:50:30

oui, il n'y est pas et meme sous dos, avec un

c:\>cd windows
c:\WINDOWS>dir

meme la il n'y est pas !
19 Juillet 2005 09:21:09

Essaye un scan en ligne ICI
Tom's guide dans le monde
  • Allemagne
  • Italie
  • Irlande
  • Royaume Uni
  • Etats Unis
Suivre Tom's Guide
Inscrivez-vous à la Newsletter
  • ajouter à twitter
  • ajouter à facebook
  • ajouter un flux RSS