Analyse de log Hijackthis SVP Fermé

Question

Bonjour,Je tourne sur W2k Pro. A chaque utilisation d'Avant Browser pour surfer le web, Norton Antivirus détecte plusieurs fois la présence de cochonneries appelées Trojan.BuyeVerify ou Downloader.Trojan ou Bloodhound.Exploit.21 ... Elles ont pour effet de lancer des pages IE (invisibles autrement que par le Gestionnaire des tâches) tout à fait indécentes.Merci d'avance à celui ou celle qui voudra bien analyser le log suivant et me donner des instructions :Logfile of HijackThis v1.99.1Scan saved at 18:16:03, on 28/07/2005Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeD:\Installation\NavNT\defwatch.exeC:\WINNT\System32\svchost.exeD:\Installation\lotus
otes
tmulti.exeD:\Installation\NavNTtvscan.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\System32\WBEM\WinMgmt.exeD:\Installation\RealVNC\WinVNC\WinVNC.exeC:\WINNT\system32\svchost.exeC:\WINNT\Explorer.EXEC:\WINNT\System32\hkcmd.exeD:\Installation\NavNT\vptray.exeC:\WINNT\system32\internat.exeD:\Installation\Astase\UltraBackup\4.0\bin\ubtray.exeD:\Installation\zabkat\xplorer2_lite\xplorer2.exeD:\Installation\lotus
otes\NLNOTES.EXED:\Installation\lotus
otes
taskldr.EXED:\Installation\Symantec\ACT\Act.exeC:\WINNT\explorer.exeD:\Installation\Avant Browser\avant.exeD:\Installation\ZippHO\zippho.exeC:\DOCUME~1\ole\LOCALS~1\Temp\ZHTEMP\hijackthis.exeR1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet ExplorerR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - Default URLSearchHook is missingO2 - BHO: ZToolbar Activator Class - {da7ff3f8-08be-4cac-bc00-94d91c6ae7f4} - C:\WINNT\pumba3.dllO3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)O3 - Toolbar: Search Toolbar - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINNT\pumba3.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exeO4 - HKLM\..\Run: [vptray] D:\Installation\NavNT\vptray.exeO4 - HKLM\..\Run: [WinVNC] "D:\Installation\RealVNC\WinVNC\WinVNC.exe" -servicehelperO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUpO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exeO4 - HKCU\..\Run: [internat.exe] internat.exeO4 - HKCU\..\Run: [Ub4TrayApp] "D:\Installation\Astase\UltraBackup\4.0\bin\ubtray.exe" /startO4 - Global Startup: Microsoft Office.lnk = D:\Installation\Microsoft Office\Office\OSA9.EXEO8 - Extra context menu item: Bloquer ce serveur... - D:\Installation\Avant Browser\AddAllToADBlackList.htmO8 - Extra context menu item: Bloquer cette publicité... - D:\Installation\Avant Browser\AddToADBlackList.htmO8 - Extra context menu item: Ouvrir dans une nouvelle fenêtre d'Avant Browser - D:\Installation\Avant Browser\OpenInNewBrowser.htmO8 - Extra context menu item: Ouvrir tous les liens de la page... - D:\Installation\Avant Browser\OpenAllLinks.htmO8 - Extra context menu item: Rechercher avec Google... - D:\Installation\Avant Browser\Search.htmO8 - Extra context menu item: Rechercher sur le Web... - D:\Installation\Avant Browser\Search.htmO8 - Extra context menu item: Surligner - D:\Installation\Avant Browser\Highlight.htmO9 - Extra button: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - C:\WINNT\system32\iegfxfrw.dllO9 - Extra 'Tools' menuitem: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - C:\WINNT\system32\iegfxfrw.dllO9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Installation\IrfanView\Ebay\Ebay.htmO9 - Extra button: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - C:\WINNT\system32\iegfxfrw.dll (HKCU)O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - C:\WINNT\system32\iegfxfrw.dll (HKCU)O15 - Trusted IP range: 206.161.125.149O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet ZoneO16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cabO16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_new.exeO16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CABO16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.22opt/SpySpotterInstall.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PAR.frO17 - HKLM\System\CCS\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PAR.frO17 - HKLM\System\CS1\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PAR.frO17 - HKLM\System\CS2\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250O23 - Service: DefWatch - Symantec Corporation - D:\Installation\NavNT\defwatch.exeO23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exeO23 - Service: Multi-user Cleanup Service - IBM Corp - D:\Installation\lotus
otes
tmulti.exeO23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Installation\NavNTtvscan.exeO23 - Service: VNC Server (winvnc) - Unknown owner - D:\Installation\RealVNC\WinVNC\WinVNC.exe" -service (file missing)

joelabete · Answer

Slt, telecharge spybot,adaware et microsoft antispyware sur telecharger.com, supprime tous se qu'il te propose, fé une analyse antivirus sur bitdefender et securiser.com.

Rapport ===> Supprime sa en mode sans échec!!

R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html

R3 - Default URLSearchHook is missing

O2 - BHO: ZToolbar Activator Class - {da7ff3f8-08be-4cac-bc00-94d91c6ae7f4} - C:\WINNT\pumba3.dll

O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)

O3 - Toolbar: Search Toolbar - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINNT\pumba3.dll

O15 - Trusted IP range: 206.161.125.149

O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab

O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/france_new.exe

O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab

O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.22opt/SpySpotterInstall.cab

EFFACE SA SI TU CONNAIS PAS CES IP OU SI ELLE N'ONT PAS RAPPORT A TON FAI!!

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PAR.fr O17 - HKLM\System\CCS\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PAR.fr

O17 - HKLM\System\CS1\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PAR.fr

O17 - HKLM\System\CS2\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250

voila efface deja tous sa et reposte un log apres!!

Analyse de log Hijackthis SVP

1 réponse

Discussions similaires