J'ai besoin d'aide pour mon log hijackthis

Question

Bonjour à tous, j'ai des problèmes, j'ai deux trojan : trojan-proxy.Win32.Sobite et Trojan.Win32.Agent.aq et aussi cydoor qui m'affiche des pages web quand je suis sur le net.J'ai ausii un programme X qui  s'installe sur mon ordinateur et qui revient tout le temps, il n'est pas dans ajouter/supprimer des programes et je ne sait pas si cela a un rapport avec cydoor. Voici mon log hijackthis: Logfile of HijackThis v1.99.1Scan saved at 14:00:58, on 10/07/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.exeC:\WINDOWS\system32\sysinit32z.exeC:\WINDOWS\System32\RunDll32.exeC:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exeC:\Program Files\D-Tools\daemon.exeC:\WINDOWS\system\svchost.exeC:\WINDOWS\System32\paytime.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Valve\Steam\Steam.exeC:\WINDOWS\System32\paytime.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\iexplore.exec:\progra~1\intern~1\iexplore.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\WINDOWS\System32\wuauclt.exeC:\Program Files\WebSiteViewer\17768128temp.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\eMule\emule.exeC:\WINDOWS\System32\dllhost.exeC:\Program Files\CheckFlow\Spy Shooter\FlowStarter.exeC:\Program Files\CheckFlow\Spy Shooter\4.5.0.1\FlowService.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\WebSiteViewer\124840.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32
ewdial1.exeC:\WINDOWS\System32
ewdial1.exeC:\WINDOWS\System32
ewdial1.exeC:\WINDOWS\System32
ewdial1.exeC:\Documents and Settings
ous\Mes documents\Mes fichiers reçus\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.smkxxifjcalv.com/q_iAb_Lncs4ru7LdUTHIdiWI/2B72XRtzrWEDZLUyslS9Em0jg8Dx4pOWDgNFRJl.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.phpR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.phpR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.phpR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensF2 - REG:system.ini: Shell=Explorer.exe sysinit32z.exeO1 - Hosts: 111111111111 222222222222O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: (no name) - {70D576D9-B383-1E55-BD76-997018FFC58D} - C:\DOCUME~1
ous\APPLIC~1\WIPECD~1\Cast trust.exeO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dllO2 - BHO: (no name) - {A0269420-A638-4509-889C-8FC3CC85DA7E} - C:\WINDOWS\drexinit.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgentO4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWndO4 - HKLM\..\Run: [PRONoMgrWired] c:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exeO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fr\msnappau.exe"O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\Bin\4.6.1.0\WeatherOnTray.exeO4 - HKLM\..\Run: [ojcthnlj] C:\WINDOWS\System32\vfsuykxg.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [Windows Xp Service Pack 2] C:\WINDOWS\system\svchost.exeO4 - HKLM\..\Run: [ccregle] C:\DOCUME~1
ous\LOCALS~1\Temp\Project1.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [16 about bat dumb] C:\Documents and Settings\All Users\Application Dataoad axis 16 about\New bias.exeO4 - HKLM\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exeO4 - HKLM\..\Run: [Service Process] C:\WINDOWS\system32\config\service.exeO4 - HKLM\..\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exeO4 - HKCU\..\Run: [Noun mode] C:\DOCUME~1
ous\APPLIC~1\PEAKIN~1\MixRoamSeek.exeO4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silentO4 - HKCU\..\Run: [PayTime] C:\WINDOWS\System32\paytime.exeO4 - HKCU\..\Run: [SNInstall] C:\WINDOWS	ool2.exeO4 - HKCU\..\Run: [Windows installer] C:\winstall.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Startup: PowerReg Scheduler.exeO4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?O4 - Global Startup: Spy Shooter 4.5.lnk = C:\Program Files\CheckFlow\Spy Shooter\FlowStarter.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htmO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO15 - Trusted Zone: *.blazefind.comO15 - Trusted Zone: *.clickspring.netO15 - Trusted Zone: *.flingstone.comO15 - Trusted Zone: *.mt-download.comO15 - Trusted Zone: *.my-internet.infoO15 - Trusted Zone: *.searchbarcash.comO15 - Trusted Zone: *.searchmiracle.comO15 - Trusted Zone: *.skoobidoo.comO15 - Trusted Zone: *.slotch.comO15 - Trusted Zone: *.slotchbar.comO15 - Trusted Zone: *.windupdates.comO15 - Trusted Zone: *.xxxtoolbar.comO15 - Trusted Zone: *.ysbweb.comO15 - Trusted Zone: *.blazefind.com (HKLM)O15 - Trusted Zone: *.clickspring.net (HKLM)O15 - Trusted Zone: *.flingstone.com (HKLM)O15 - Trusted Zone: *.mt-download.com (HKLM)O15 - Trusted Zone: *.my-internet.info (HKLM)O15 - Trusted Zone: *.searchbarcash.com (HKLM)O15 - Trusted Zone: *.searchmiracle.com (HKLM)O15 - Trusted Zone: *.skoobidoo.com (HKLM)O15 - Trusted Zone: *.slotch.com (HKLM)O15 - Trusted Zone: *.slotchbar.com (HKLM)O15 - Trusted Zone: *.windupdates.com (HKLM)O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)O15 - Trusted Zone: *.ysbweb.com (HKLM)O15 - Trusted IP range: 81.222.131.59O15 - Trusted IP range: 81.222.131.59 (HKLM)O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cabO16 - DPF: {1CD49DC9-FD88-41FA-B892-47E037267D45} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1059_XP.cabO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguard.com/installation/Install.cabO16 - DPF: {31DDC1FD-CEA3-4837-A6DC-87E67015ADC9} - http://akamai.downloadv3.com/binaries/IA/svcsysnet32_FR_XP.cabO16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cabO16 - DPF: {BA14D944-0D8C-4F16-A950-6E53EEBB558F} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1040_FR_XP.cabO16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cabO16 - DPF: {C9269872-E3D6-4811-8E5E-835CA8CBD0B3} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1042_FR_XP.cabO16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/cab/14/fr/SysWebTelecomInt.cabO20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dllO23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exeO23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: FlowProtectorService - Unknown owner - C:\Program Files\CheckFlow\Spy Shooter\4.5.0.1\FlowService.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeCe serait très gentil de m'aider, je vous en remercie d'avance a+.

bernie61 · Answer

salut
commence par désinstaller CheckFlow qui est un faux antispyware (listé ROGUE)

lances SpybotS&d, Adaware puis

http://siri.urz.free.fr/Fix/ là Fix de smitfraud
tu copie colle le rapport après l'option 1

ensuite tu relances le Fix et exécute l'option 2

refais un HJ
a+

Utilisateur anonyme · Answer

salut bernie,c est la derniere version du fix?a+

J'ai besoin d'aide pour mon log hijackthis

2 réponses

Discussions similaires

Newsletters