msnmsgr.exe ???

Question

bonjour en examinant l'hijack de mon pc la commande : C:\WINNT\system32\msnmsgr.exe apparaît plusieurs fois.Quelle est son utilité ??merciLogfile of HijackThis v1.99.0Scan saved at 15:36:11, on 16/01/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeC:\WINNT\System32\svchost.exeC:\WINNT\system32\hidserv.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeC:\WINNT\System32
vsvc32.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\Program Files\Photodex\ProShowGold\ScsiAccess.exeC:\WINNT\system32\stisvc.exeC:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\system32\svchost.exeC:\WINNT\Mixer.exeC:\Program Files\WinFast\WFTVFM\WFSCH.exeC:\WINNT\system32\WF2K.EXEC:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeC:\Program Files\Logitech\iTouch\iTouch.exeC:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEC:\Program Files\QuickTime\qttask.exeC:\Program Files\Fichiers communs\Roxio Shared\Project Selector\projselector.exeC:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exeC:\WINNT\system32\cqcags.exeC:\WINNT\system32\java2.exeC:\WINNT\SYSTEM32\fannbe.exeC:\WINNT\system32undll32.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\cls.exeC:\WINNT\system32\cqcags.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exeC:\WINNT\system32\internat.exeC:\WINNT\system32undll32.exeC:\Program Files\Microsoft Money\System\Money Express.exeC:\WINNT\system32\RUNDLL32.EXEC:\WINNT\system32\cqcags.exeC:\WINNT\dpvsetup.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\cls.exeC:\WINNT\system32\cqcags.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\securenet.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\cls.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\Program Files\Jasc Software Inc\Paint Shop Pro 8\Paint Shop Pro.exeC:\WINNT\SYSTEM32\xaviant.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\explorer.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\WINNT\system32\msnmsgr.exeC:\Documents and Settings\Administrateur\Bureau\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.free.frR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhostR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exeO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dllO2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO2 - BHO: CHungryBHO Object - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\WINNT
eti.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocxO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startupO4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"O4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFSCH.exeO4 - HKLM\..\Run: [WinFast_2K] C:\WINNT\system32\WF2K.EXEO4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exeO4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXEO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initializeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exeO4 - HKLM\..\Run: [projselector] "C:\Program Files\Fichiers communs\Roxio Shared\Project Selector\projselector.exe" -rO4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"O4 - HKLM\..\Run: [HP Desktop] ccappms.exeO4 - HKLM\..\Run: [Microsoft Windows Internet Security] SYMLVC.exeO4 - HKLM\..\Run: [Microsoft  Windows  Update] msnmessenger.exeO4 - HKLM\..\Run: [DSC Scanner] cqcags.exeO4 - HKLM\..\Run: [Jufualt] java2.exeO4 - HKLM\..\Run: [WXcmeinst] C:\WINNT\SYSTEM32\fannbe.exeO4 - HKLM\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",runO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [Microsoft   Windows   Update] msnmsgr.exeO4 - HKLM\..\Run: [clock Loader] cls.exeO4 - HKLM\..\Run: [My Computer] cqcags.exeO4 - HKLM\..\Run: [Microsoft Information] securenet.exeO4 - HKLM\..\RunServices: [HP Desktop] ccappms.exeO4 - HKLM\..\RunServices: [Microsoft Windows Internet Security] SYMLVC.exeO4 - HKLM\..\RunServices: [UltraEdit] uledit.exeO4 - HKLM\..\RunServices: [Microsoft  Windows  Update] msnmessenger.exeO4 - HKLM\..\RunServices: [DSC Scanner] cqcags.exeO4 - HKLM\..\RunServices: [Microsoft   Windows   Update] msnmsgr.exeO4 - HKLM\..\RunServices: [clock Loader] cls.exeO4 - HKLM\..\RunServices: [My Computer] cqcags.exeO4 - HKLM\..\RunServices: [Microsoft Information] securenet.exeO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInitO4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"O4 - HKCU\..\Run: [HP Desktop] ccappms.exeO4 - HKCU\..\Run: [Microsoft Windows Internet Security] SYMLVC.exeO4 - HKCU\..\Run: [UltraEdit] uledit.exeO4 - HKCU\..\Run: [DSC Scanner] cqcags.exeO4 - HKCU\..\Run: [Clock] C:\WINNT\csrss.exeO4 - HKCU\..\Run: [WebSpecials] rundll32 "C:\Program Files\WebSpecials\webspec.dll",runO4 - HKCU\..\Run: [Microsoft   Windows   Update] msnmsgr.exeO4 - HKCU\..\Run: [Jufualt] java2.exeO4 - HKCU\..\Run: [clock Loader] cls.exeO4 - HKCU\..\Run: [My Computer] cqcags.exeO4 - Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO4 - Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.htmlO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINNT\system32\shdocvw.dll (HKCU)O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - C:\WINNT\system32\shdocvw.dll (HKCU)O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CABO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {AABB591F-CEB3-404A-A979-AA30B16CB914} (IPLabs Image Uploader 2.5) - http://asp01.photoprintit.de/microsite/1156/defaults/activex/ImageUploader2.cabO16 - DPF: {BEF9DA9B-002E-4901-AEFD-53043E9F3963} (Djingle InstallAx Control) - http://www.declicsvip.com/player/install/soft/installax_cinesol_lmdvd.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{2B01EA70-14C7-49E7-801A-7BD7E822B028}: NameServer = 209.47.15.118,64.157.143.38,O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Avertissement - Unknown - C:\WINNT\System32\services.exeO23 - Service: Gestion d'applications - Unknown - C:\WINNT\system32\services.exeO23 - Service: Explorateur d'ordinateur - Unknown - C:\WINNT\System32\services.exeO23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeO23 - Service: Client DHCP - Unknown - C:\WINNT\System32\services.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINNT\System32\dmadmin.exeO23 - Service: Gestionnaire de disque logique - Unknown - C:\WINNT\System32\services.exeO23 - Service: Client DNS - Unknown - C:\WINNT\System32\services.exeO23 - Service: Journal des événements - Unknown - C:\WINNT\system32\services.exeO23 - Service: Service de télécopie - Unknown - C:\WINNT\system32\faxsvc.exeO23 - Service: Serveur - Unknown - C:\WINNT\System32\services.exeO23 - Service: Station de travail - Unknown - C:\WINNT\System32\services.exeO23 - Service: Service d'application d'assistance TCP/IP NetBIOS - Unknown - C:\WINNT\System32\services.exeO23 - Service: Affichage des messages - Unknown - C:\WINNT\System32\services.exeO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINNT\System32\mnmsrvc.exeO23 - Service: DDE réseau - Unknown - C:\WINNT\system32
etdde.exeO23 - Service: DSDM DDE réseau - Unknown - C:\WINNT\system32
etdde.exeO23 - Service: Ouverture de session réseau - Unknown - C:\WINNT\System32\lsass.exeO23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeO23 - Service: Fournisseur de la prise en charge de sécurité LM NT - Unknown - C:\WINNT\System32\lsass.exeO23 - Service: Leadtek Driver Helper Service - NVIDIA Corporation - C:\WINNT\System32
vsvc32.exeO23 - Service: Service client pour NetWare - Unknown - C:\WINNT\System32\services.exeO23 - Service: Plug-and-Play - Unknown - C:\WINNT\system32\services.exeO23 - Service: Agent de stratégie IPSEC - Unknown - C:\WINNT\System32\lsass.exeO23 - Service: Emplacement protégé - Unknown - C:\WINNT\system32\services.exeO23 - Service: Gestionnaire de comptes de sécurité - Unknown - C:\WINNT\system32\lsass.exeO23 - Service: Prise en charge des cartes à puces - Unknown - C:\WINNT\System32\SCardSvr.exeO23 - Service: Carte à puce - Unknown - C:\WINNT\System32\SCardSvr.exeO23 - Service: Planificateur de tâches - Unknown - C:\WINNT\system32\MSTask.exeO23 - Service: ScsiAccess - Unknown - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exeO23 - Service: Service d'exécution par délégation - Unknown - C:\WINNT\system32\services.exeO23 - Service: Still Image Service - Unknown - C:\WINNT\system32\stisvc.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINNT\system32\smlogsvc.exeO23 - Service: Telnet - Unknown - C:\WINNT\system32	lntsvr.exeO23 - Service: Client de suivi de lien distribué - Unknown - C:\WINNT\system32\services.exeO23 - Service: Ulead Burning Helper - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exeO23 - Service: Gestionnaire d'utilitaires - Unknown - C:\WINNT\System32\UtilMan.exeO23 - Service: Horloge Windows - Unknown - C:\WINNT\System32\services.exeO23 - Service: Infrastructure de gestion Windows - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exeO23 - Service: Extensions du pilote WMI - Unknown - C:\WINNT\system32\Services.exe

Teddy-Bear · Answer

Re

Le processus msnmsgr.exe (msnmsgr signifiant Microsoft Network Messenger) est un processus correspondant au client de messagerie instantanée MSN Messenger.

_____________________________
Un Bon Troyen Est Un Troyen M O R T

richard.r · Answer

Pour quelle raison il se charge plusieurs fois Je ne me sert pas de MSN MessengerPuis-je enlever ce fichier, j'ai l'impression que c'est lui qui bloque mon systeme.richard

no1 · Answer

i find that you have "cqcags.exe" & "fannbe.exe" both troyans!!!erase them as files & registry keys!!!

no1 · Answer

...and "xaviant.exe"...

S!Ri · Answer

Salut,Msnmsgr.exe n'est pas forcément la messagerie MSN Messenger:http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_RBOT.KX&VSect=T

Msnmsgr.exe ???

5 réponses

Votre réponse

Discussions similaires

Newsletters