Dload/trojan-- rapport hijakthis

Question

j'ai un trojan depuis un moment maintenant que Sophos detecte m

hulkamille · Answer

Je recommence... j'ai un trojan depuis un moment maintenant que Sophos detecte mais les antivirus en ligne ne le voient pas. Il revient sans cesse. Je mets mon log de Hijackthis et si quelqu'un peut me dire s'il y a qqchose de suspect merci d'avance.

hulkamille · Answer

Logfile of HijackThis v1.99.1
Scan saved at 11:14:48, on 08/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SWEEPSRV.SYS
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
c:\windows\system32\twlgof.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
E:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail-etudiant.grenoble-em.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [cfweqvg] c:\windows\system32\twlgof.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B8BEA7D-4CF8-4963-87DE-3B78AA1985DB} (D11313.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/D11313.CAB
O16 - DPF: {0BCBDFAC-5711-4E20-9F90-3BF9DBEB718B} (D31317.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31317.CAB
O16 - DPF: {0F7E45E9-DDBF-427E-BF4F-6D16B39DD984} (D31315.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31315.CAB
O16 - DPF: {111080FC-A9B6-4FCC-A93E-97107464CFD3} (D41316.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41316.CAB
O16 - DPF: {16F3737C-E323-46C0-8441-70D3D88AE930} (Inet3.CInet3) - http://elearning.grenoble-em.com/mediaplus/Download/inet3.cab
O16 - DPF: {248AB1C0-50DB-4D82-A15D-2E694F30B4E4} (Inet4.CInet4) - http://elearning.grenoble-em.com/mediaplus/Download/inet4.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3B5AD116-7561-4983-AEA8-F18C86FBE51C} (D41317.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41317.CAB
O16 - DPF: {4086CE64-0D3A-44AC-B81F-9F7475286967} (D41318.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41318.CAB
O16 - DPF: {43CFCF71-BADC-47D7-AE8B-0DA1FA630A3A} (D31318.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31318.CAB
O16 - DPF: {4E042DE6-8B87-11D3-AE7F-004033D24DBD} (HtmlHelpViewer.CViewerHtml) - http://elearning.grenoble-em.com/mediaplus/Download/HtmlHelpViewer.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {550C6929-C77A-42D6-A9DF-FA00123C836A} (D41313.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41313.CAB
O16 - DPF: {58704D08-CAAC-4105-9DFB-7E6FF3F94CC0} (D41312.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41312.CAB
O16 - DPF: {642F50E7-244A-11D5-956E-0040339BF4B0} (Inet1.CInet1) - http://elearning.grenoble-em.com/mediaplus/Download/Inet1.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74615031-BE13-4364-A7A7-0CD1412AE189} (D21312.Module) - http://elearning.grenoble-em.com/mediaplus/Download/213F/D21312.CAB
O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://elearning.grenoble-em.com/mediaplus/Download/tsccinst.cab
O16 - DPF: {7C07CCD1-7260-4B46-9786-70AC0873DC10} (D41311.Question0122) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41311.CAB
O16 - DPF: {8CA6DFCD-5172-42D7-BE83-BB9BF924C9AA} (D31316.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31316.CAB
O16 - DPF: {957FABBC-B071-4CBD-83B8-99FB236AE1D2} (D41314.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41314.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9D23DDAA-D04A-4384-8C51-7B226626A14C} (IBarre0.CManag) - http://elearning.grenoble-em.com/mediaplus/Download/ENIBP.CAB
O16 - DPF: {9F22160C-99E5-4D37-8D86-22E413A96181} (D11315.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/d11315.cab
O16 - DPF: {A0A6C91F-5D86-4755-8237-759312735F05} (D11311.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/D11311.CAB
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {AB907F38-6725-471A-843D-D8F7D0F9D715} (D31313.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31313.CAB
O16 - DPF: {BAEE50CA-109B-4280-8AAA-8A316C902F0E} (D31311.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31311.CAB
O16 - DPF: {BD417B41-24BF-478C-A4C1-5968B01C82CF} (Inet8.CInet8) - http://elearning.grenoble-em.com/mediaplus/Download/inet8.cab
O16 - DPF: {D163ED65-9880-49B3-B83A-E120D542C6C1} (D31312.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31312.CAB
O16 - DPF: {D34D6048-E232-4889-B08C-AF4AFE87A6F6} (ENIInetTools.clsManager) - http://elearning.grenoble-em.com/mediaplus/Download/ENIInetTools.CAB
O16 - DPF: {E330EF64-7E61-4E0C-BB7F-2CC0F986D2B1} (D11314.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/d11314.cab
O16 - DPF: {E3D5B5B1-B0B1-488C-92BB-7B8E47B0C70A} (D11316.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/d11316.cab
O16 - DPF: {E5AAE8F3-9FCF-400E-A7CE-407C95F91B7D} (D11312.Module) - http://elearning.grenoble-em.com/mediaplus/Download/113F/d11312.cab
O16 - DPF: {E7E826BF-9635-4CB7-A6F5-20A6C5E7DEBB} (D31314.Module) - http://elearning.grenoble-em.com/mediaplus/Download/313F/D31314.CAB
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4474/mcfscan.cab
O16 - DPF: {FA0C386E-1A08-4629-A267-B40C1624E94A} (Inet6.CInet6) - http://elearning.grenoble-em.com/mediaplus/Download/inet6.cab
O16 - DPF: {FFDF6E35-1CA0-4C82-96A9-5D37C0692ACE} (D41315.Module) - http://elearning.grenoble-em.com/mediaplus/Download/413F/D41315.CAB
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O23 - Service: Sophos AutoUpdate Service (ActiveLinkClient) - Unknown owner - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SWEEPSRV.SYS
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

Dload/trojan--> rapport hijakthis

2 réponses

Votre réponse

Discussions similaires

Newsletters