demande d'analyse hisjack this

Question

bonjour par làj'ai analyser mon pc avec hisjackthis ( 'fin le truc là ) j'aimerai bien avoir un avis sur les programmes qui squattent mon systeme et comment les enlever si possible

musher · Answer

peut etre qu'avec le detail de l'analyse ça sera plus facile =)voili voulouLogfile of HijackThis v1.98.2Scan saved at 13:03:48, on 23/11/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:D:\WINDOWS\System32\smss.exeD:\WINDOWS\system32\winlogon.exeD:\WINDOWS\system32\services.exeD:\WINDOWS\system32\lsass.exeD:\WINDOWS\system32\svchost.exeD:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\logonui.exeD:\WINDOWS\system32\spoolsv.exeD:\WINDOWS\Explorer.EXED:\WINDOWS\System32\svchost.exeD:\WINDOWS\system32\ZONELABS\vsmon.exeD:\PROGRA~1\WANADOO\CnxMon.exeD:\PROGRA~1\WANADOO\TaskbarIcon.exeD:\Program Files\Winamp\Winampa.exeD:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exeD:\WINDOWS\System32undll32.exeD:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeD:\Program Files\MSN Messenger\msnmsgr.exeD:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeD:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exeD:\Program Files\Fichiers communs\WinTools\WSup.exeD:\PROGRA~1\WANADOO\EspaceWanadoo.exeD:\PROGRA~1\WANADOO\ComComp.exeD:\PROGRA~1\WANADOO\Watch.exeF:\SnowXtreM\mirc.exeD:\Program Files\Mozilla Firefox\firefox.exeD:\PROGRA~1\Toolbar\TBPS.exeD:\PROGRA~1\Toolbar\PIB.exeD:\DOCUMENTS AND SETTINGS\MUSHER1\BUREAU\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50193R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar	oolbar.dll/saR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://D:\PROGRA~1\Toolbar	oolbar.dll/saR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = WanadooR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar	oolbar.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - D:\Program Files\NewDotNet
ewdotnet6_38.dllO2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - D:\PROGRA~1\FICHIE~1\WinTools\WToolsB.dllO2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar	oolbar.dllO2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - D:\Program Files\webHancer\programs\whiehlpr.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar	oolbar.dllO4 - HKLM\..\Run: [WooCnxMon] D:\PROGRA~1\WANADOO\CnxMon.exeO4 - HKLM\..\Run: [WOOWATCH] D:\PROGRA~1\WANADOO\Watch.exeO4 - HKLM\..\Run: [WOOTASKBARICON] D:\PROGRA~1\WANADOO\TaskbarIcon.exeO4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"O4 - HKLM\..\Run: [New.net Startup] rundll32 D:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -sO4 - HKLM\..\Run: [Zone Labs Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"O4 - HKLM\..\Run: [BDMCon] D:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exeO4 - HKLM\..\Run: [BDNewsAgent] D:\Program Files\Softwin\BitDefender Free Edition\bdnagent.exeO4 - HKLM\..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exeO4 - HKLM\..\Run: [WinTools] D:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exeO4 - HKLM\..\Run: [MSConfig] D:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\webelated.htmO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXEO9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)O10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by WebHancerO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by New.NetO10 - Hijacked Internet access by WebHancerO16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{5CF14CF0-BEA8-495D-9DED-2EBA0A28FF22}: NameServer = 80.10.246.1 80.10.246.132O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - D:\PROGRA~1\Toolbar	oolbar.dll

Utilisateur anonyme · Answer

Salutcoches et fixes R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50193 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://D:\PROGRA~1\Toolbar	oolbar.dll/sa R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://D:\PROGRA~1\Toolbar	oolbar.dll/sa R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar	oolbar.dll O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - D:\Program Files\NewDotNet
ewdotnet6_38.dll O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - D:\PROGRA~1\FICHIE~1\WinTools\WToolsB.dll O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - D:\PROGRA~1\Toolbar	oolbar.dll O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - D:\Program Files\webHancer\programs\whiehlpr.dll O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - D:\PROGRA~1\Toolbar	oolbar.dll O4 - HKLM\..\Run: [TBPS] D:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\Run: [WinTools] D:\PROGRA~1\FICHIE~1\WinTools\WToolsA.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\webelated.htm O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by WebHancer O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by WebHancer

Demande d'analyse hisjack this

2 réponses

Votre réponse

Discussions similaires

Newsletters