Analyse Log Hijackthis

Question

Salut à tous...........eske qqu'un pourrait analyser mon log ou bien me dire où l'envoyer pour analyse.............Merci d'avance, Tchuss.

Utilisateur anonyme · Answer

......;colles le ici.....

Buenos · Answer

Merci d'avance wael#........tcho.StartupList report, 25/10/2004, 16:28:37StartupList version: 1.52.2Started from : C:\unzipped\hijackthis\HijackThis.EXEDetected: Windows XP SP2 (WinNT 5.01.2600)Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)* Using default options==================================================Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exec:\Program Files\Norton AntiVirus
avapsvc.exec:\Program Files\Norton Personal Firewall\NISUM.EXEc:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\HHVcdV5Sys\VC5SecS.exec:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exec:\Program Files\Norton Personal Firewall\ccPxySvc.exeC:\windows\system\hpsysdrv.exeC:\WINDOWS\System32\hphmon05.exeC:\HP\KBD\KBD.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\PROGRA~1\Wanadoo\TaskbarIcon.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exeC:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exeC:\Program Files\HHVcdV5Sys\VC5Play.exeC:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeC:\Program Files\carasexe\carasexe.exeC:\Program Files\Virtual CD v5\System\VC5Tray.exeC:\Program Files\MSN\MSNCoreFiles\msn6.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Wanadoo\EspaceWanadoo.exeC:\Program Files\Wanadoo\ComComp.exeC:\Program Files\Wanadoo\Watch.exeC:\Program Files\Internet Explorer\iexplore.exeC:\unzipped\hijackthis\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Startup:[C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage]carasexe.lnk = C:\Program Files\carasexe\carasexe.exeShell folders Common Startup:[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]Adobe Gamma Loader.lnk = ?DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeMicrosoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINDOWS\system32\userinit.exe,--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\Runhpsysdrv = c:\windows\system\hpsysdrv.exeHotKeysCmds = C:\WINDOWS\System32\hkcmd.exeHPHUPD05 = c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exeHPHmon05 = C:\WINDOWS\System32\hphmon05.exeKBD = C:\HP\KBD\KBD.EXERecguard = C:\WINDOWS\SMINST\RECGUARD.EXENvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupnwiz = nwiz.exe /installquiet /keeploaded /nodetectVTTimer = VTTimer.exePS2 = C:\WINDOWS\system32\ps2.execcApp = "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"NAV CfgWiz = c:\Program Files\Fichiers communs\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"ATIModeChange = Ati2mdxx.exeATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeWooCnxMon = C:\PROGRA~1\Wanadoo\CnxMon.exeWOOWATCH = C:\PROGRA~1\Wanadoo\Watch.exeWOOTASKBARICON = C:\PROGRA~1\Wanadoo\TaskbarIcon.execcRegVfy = "c:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"Microsoft Works Update Detection = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exePinnacleDriverCheck = C:\WINDOWS\System32\PSDrvCheck.exe -CheckRegUpdateManager = "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /rTkBellExe = "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osbootQuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottimeNeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exeCamMonitor = c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exemsnappau = "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exeMMTray = C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exemmtask = C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exeVC5Player = C:\Program Files\HHVcdV5Sys\VC5Play.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\RunNVIEW = rundll32.exe nview.dll,nViewLoadHookAcme.PCHButton = C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exeMsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /backgroundBackupNotify = c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe--------------------------------------------------Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=Explorer.exeSCRNSAVE.EXE=C:\WINDOWS\System32\sspipes.scrdrivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Enumerating Browser Helper Objects:(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}(no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}(no name) - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}(no name) - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fr\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}(no name) - c:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}--------------------------------------------------Enumerating Task Scheduler jobs:Connexion Facile à Internet.jobSymantec NetDetect.job--------------------------------------------------Enumerating Download Program Files:[Office Update Installation Engine]InProcServer32 = C:\WINDOWS\opuc.dllCODEBASE = http://office.microsoft.com/officeupdate/content/opuc.cab[RdxIE Class]InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dllCODEBASE = http://software-dl.real.com/1945674c578d009c6005/netzip/RdxIE601_fr.cab[Symantec RuFSI Utility Class]InProcServer32 = C:\WINDOWS\Downloaded Program Filesufsi.dllCODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab[HouseCall Control]InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocxCODEBASE = http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab[WWWInstall Class]InProcServer32 = C:\WINDOWS\DOWNLO~1\WEBINS~1.DLLCODEBASE = http://www.edipole.fr/kits/WebInstall.dll[CRAVOnline Object]InProcServer32 = C:\WINDOWS\Downloaded Program Filesavonline.dllCODEBASE = http://www.ravantivirus.com/scan/ravonline.cab[GDIChk Object]InProcServer32 = C:\WINDOWS\Downloaded Program Files\GDIChk.dllCODEBASE = http://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB[Symantec RuFSI Registry Information Class]InProcServer32 = C:\WINDOWS\Downloaded Program Filesufsi.dllCODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab[Shockwave Flash Object]InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocxCODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab--------------------------------------------------Enumerating Windows NT logon/logoff scripts:*No scripts set to run*Windows NT checkdisk command:BootExecute = autocheck autochk *Windows NT 'Wininit.ini':PendingFileRenameOperations: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\~f1d055.tmp--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:PostBootReminder: C:\WINDOWS\system32\SHELL32.dllCDBurn: C:\WINDOWS\system32\SHELL32.dllWebCheck: C:\WINDOWS\System32\webcheck.dllSysTray: C:\WINDOWS\System32\stobject.dll--------------------------------------------------End of report, 9 805 bytesReport generated in 0,094 secondsCommand line options:   /verbose  - to add additional info on each section   /complete - to include empty sections and unsuspicious data   /full     - to include several rarely-important sections   /force9x  - to include Win9x-only startups even if running on WinNT   /forcent  - to include WinNT-only startups even if running on Win9x   /forceall - to include all Win9x and WinNT startups, regardless of platform   /history  - to list version history only

Utilisateur anonyme · Answer

a moins que tu y tiennes cela peut deja etre desinstallé C:\Program Files\carasexe\carasexe.exe
ensuite coches et fixes (no name) - (no file) - {549B5CA7-4A86-11D7-A4DF-000874180BB3}
(no name) - (no file) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}
[WWWInstall Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\WEBINS~1.DLL
CODEBASE = http://www.edipole.fr/kits/WebInstall.dll
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

a premiere vue ..........

Buenos · Answer

Gracias per todo amigo..........tchuss.

Analyse Log Hijackthis

4 réponses

Votre réponse

Discussions similaires

Newsletters