Hijackthis http://realsearcher.com/?aid=194

Question

http://realsearcher.com/?aid=194 en page de démarrage... :-( qq'un peu m'aiderLogfile of HijackThis v1.99.0Scan saved at 19:31:07, on 28/12/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32undll32.exeC:\Program Files\Alwil Software\Avast4\ashDisp.exeC:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exeC:\Program Files\Java\j2re1.4.2_01\bin\jusched.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\WINDOWS\System32\dslagent.exeC:\WINDOWS\system32\winmm64.exeC:\Program Files\FinePixViewer\QuickDCF.exeC:\Program Files\E-Color\True Internet Color\TICIcon.exeC:\Program Files\Alwil Software\Avast4\aswUpdSv.exeC:\Program Files\Alwil Software\Avast4\ashserv.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\System32\CTSvcCDA.exeC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\WINDOWS\System32
vsvc32.exeC:\Program Files\Kerio\Personal Firewall\persfw.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\eMule\emule.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Soulseek\slsk.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\WinRAR\WinRAR.exeC:\Program Files\Internet Explorer\iexplore.exeC:\DOCUME~1\Pierre\LOCALS~1\Temp\Rar$EX55.465\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hcR1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hcR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=hcR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=hcR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s-redirect.com/?b=hcR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=hcR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=hcR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=hcR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=hcR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hcR1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hcO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exeO4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLLO4 - HKLM\..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exeO4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [GSICONEXE] gsicon.exeO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINDOWS\system32\winmm64.exeO4 - HKCU\..\Run: [32sy] C:\WINDOWS\system32\32sy.exeO4 - HKCU\..\Run: [hhSPmsorPE] C:\WINDOWS\system32\hhSPmsorPE.exeO4 - HKCU\..\Run: [32mshh] C:\WINDOWS\32mshh.exeO4 - HKCU\..\Run: [orPE] C:\WINDOWS\system32\orPE.exeO4 - HKCU\..\Run: [msmsnt] C:\WINDOWS\system32\msmsnt.exeO4 - HKCU\..\Run: [32hhmsPE] C:\WINDOWS\system32\32hhmsPE.exeO4 - HKCU\..\Run: [SPnt32s-SP] C:\WINDOWS\system32\SPnt32s-SP.exeO4 - HKCU\..\Run: [64hh] C:\WINDOWS\system32\64hh.exeO4 - HKCU\..\Run: [sy323232PE] C:\WINDOWS\sy323232PE.exeO4 - HKCU\..\Run: [orhhor] C:\WINDOWS\orhhor.exeO4 - HKCU\..\Run: [s-PEnts-] C:\WINDOWS\system32\s-PEnts-.exeO4 - HKCU\..\Run: [s-nt64PE] C:\WINDOWS\s-nt64PE.exeO4 - HKCU\..\Run: [hhntSPsy] C:\WINDOWS\hhntSPsy.exeO4 - HKCU\..\Run: [SP64PE] C:\WINDOWS\SP64PE.exeO4 - HKCU\..\Run: [3264sysy] C:\WINDOWS\system32\3264sysy.exeO4 - HKCU\..\Run: [64PE] C:\WINDOWS\system32\64PE.exeO4 - HKCU\..\Run: [ntntmsms] C:\WINDOWS\system32
tntmsms.exeO4 - HKCU\..\Run: [syor64] C:\WINDOWS\system32\syor64.exeO4 - HKCU\..\Run: [s-ms] C:\WINDOWS\system32\s-ms.exeO4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exeO4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Photo Express SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exeO4 - Global Startup: True Internet Color Icon.lnk = C:\Program Files\E-Color\True Internet Color\TICIcon.exeO8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dllO12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dllO12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dllO12 - Plugin for ¸æs: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dllO16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\djlmotsx.exeO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20030625/qtinstall.info.apple.com/abarth/fr/win/QuickTimeInstaller.exeO16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://player.virtools.com/downloads/player/Install2.5/Installer.exeO23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashserv.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exeO23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: DDE réseau - Unknown - C:\WINDOWS\system32
etdde.exeO23 - Service: DSDM DDE réseau - Unknown - C:\WINDOWS\system32
etdde.exeO23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Kerio Personal Firewall - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: Prise en charge des cartes à puces - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Sony SPTI Service - Unknown - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe (file missing)O23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINDOWS\System32	lntsvr.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

Richard1 · Answer

Bonjour,

Commence par supprimer ces programmes dangereux:

Coche-les dans ton scan de Hijackthis que tu as démarrer à partir de son répertoire:
Ensuite tu clic sur Fix checked.

C:\WINDOWS\system32\winmm64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=hc

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=hc

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s-redirect.com/?b=hc

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=hc

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=hc

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=hc

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=hc

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc

R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc

O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINDOWS\system32\winmm64.exe

O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\djlmotsx.exe

Redémarre ton ordi ensuite.

Si ce n'est toujours pas ok reviens ici car il y a plusieurs autres programmes inconnus dont on va se départir.

Bien amicalement

Richard1 (Montréal, Canada)

Richard1 · Answer

Bien sûr, tu reviens avec un autre scan.Bien amicalementRichard1

Hijackthis http://realsearcher.com/?aid=194

2 réponses

Votre réponse

Discussions similaires

Newsletters