scan hijackthis Fermé

Question

bonsoir,comment lire le scan dehijackthis?

Utilisateur anonyme · Answer

CoucouPoste le et je verrais ce que je peux pour toia+

the covenant · Answer

bonjour voila un scan de hijackthisRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AntiVir PersonalEdition Classic\sched.exeC:\Program Files\AntiVir PersonalEdition Classic\avguard.exeC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXEC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\HPZipm12.exeC:\Program Files\Securitoo\Av_Fw\Anti-Virus\fssm32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\UAService7.exeC:\WINDOWS\Explorer.EXEC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\AntiVir PersonalEdition Classic\avgnt.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\PROGRA~1\COMMON~1\PPATCH~1
otepad.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\F?nts\m?dtc.exeC:\Program Files\Securitoo\Av_Fw\Common\FSLAUNCH.EXEC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Propriétaire\Bureau\Thomas\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {375D6281-8A3B-82BD-1FBB-D6BFD981DAB7} - C:\WINDOWS\system32\winlcf.dll (file missing)R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)F2 - REG:system.ini: UserInit=userinit.exeO2 - BHO: (no name) - {375D6281-8A3B-82BD-1FBB-D6BFD981DAB7} - C:\WINDOWS\system32\winlcf.dll (file missing)O2 - BHO: (no name) - {47D66F10-43DB-D496-B859-D6335701CBAB} - C:\WINDOWS\gkszlugr.dll (file missing)O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\Av_Fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\Av_Fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe"O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [WEBUPLOGCHIN] C:\Documents and Settings\All Users\Application Data\FunkErrorWebUpemoteanti.exeO4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exeO4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /minO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [seek surf] C:\DOCUME~1\PROPRI~1\APPLIC~1\COOLBO~1\Rule Byte Chin.exeO4 - HKCU\..\Run: [PECarlin] "C:\Program Files\PECarlin\PECarlin.exe"O4 - HKCU\..\Run: [AXVenore] "C:\Program Files\AXVenore\AXVenore.exe"O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"O4 - HKCU\..\Run: [Itih] "C:\PROGRA~1\COMMON~1\PPATCH~1
otepad.exe" -vt yazbO4 - HKCU\..\Run: [Mpx] C:\Program Files\F?nts\m?dtc.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: MsgPlusLoader.dll,Runner.dll,Runner.dll,kfpmdkeh.dll,SDRunner.dll,Runner.dll,Runner.dll      C:\WINDOWS\system32\iexplore.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exeO23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exeO23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\Av_Fw\backweb\8520111\Program\SERVIC~1.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\backweb\8520111\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXEO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exemerci de bien vouloir le regarder ^^

Regis59 · Answer

Salut,J ai failli loupé ton poste, heureusement que je t ai reconnu par rapport a ton pseudo ;-)1-Fais ce qu il y a sur cette pagehttp://perso.orange.fr/entraide-hijackthis/MessengerPlus3/index.html2-HijackThis -> Open the misc tools sections -> open Uninstall manager -> clique sur "Save list" -> enregistre le fichier -> fais-en un copier/coller ici.A+

the covenant · Answer

voici le scan si j'ai bien comprisRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\savedump.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\SOUNDMAN.EXEC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\AntiVir PersonalEdition Classic\avgnt.exeC:\Program Files\ewido anti-spyware 4.0\ewido.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\PROGRA~1\COMMON~1\PPATCH~1
otepad.exeC:\Program Files\F?nts\m?dtc.exec:\progra~1\intern~1\iexplore.exeC:\Program Files\AntiVir PersonalEdition Classic\sched.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\AntiVir PersonalEdition Classic\avguard.exeC:\PROGRA~1\SECURI~1\Av_Fw\backweb\8520111\Program\SERVIC~1.EXEC:\Program Files\ewido anti-spyware 4.0\guard.exeC:\Program Files\Securitoo\Av_Fw\backweb\8520111\Program\fspex.exeC:\Program Files\Securitoo\Av_Fw\backweb\8520111\program\fsbwsys.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\UAService7.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXEC:\Program Files\Securitoo\Av_Fw\Common\FSMB32.EXEC:\Program Files\Securitoo\Av_Fw\Common\FCH32.EXEC:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exeC:\Program Files\Securitoo\Av_Fw\Common\FAMEH32.EXEC:\Program Files\Securitoo\Av_Fw\Anti-Virus\FSGK32.EXEC:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exeC:\Program Files\Securitoo\Av_Fw\Anti-Virus\fssm32.exeC:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsav32.exeC:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXEC:\Program Files\Securitoo\Av_Fw\FSGUI\fsguiexe.exeC:\Documents and Settings\Propriétaire\Bureau\Thomas\HijackThis.exeC:\PROGRA~1\MOZILL~1\FIREFOX.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensR3 - URLSearchHook: (no name) - {375D6281-8A3B-82BD-1FBB-D6BFD981DAB7} - (no file)R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)R3 - URLSearchHook: (no name) - {37506DD1-D93C-8CB4-19BB-D6BFD98182B0} - C:\WINDOWS\system32\krmpbrm.dll (file missing)R3 - URLSearchHook: (no name) - {0853923B-2C81-7204-F2EC-73D58F24E9B8} - C:\WINDOWS\system32\ydch.dllF2 - REG:system.ini: UserInit=userinit.exeO2 - BHO: (no name) - {0853923B-2C81-7204-F2EC-73D58F24E9B8} - C:\WINDOWS\system32\ydch.dllO2 - BHO: (no name) - {37506DD1-D93C-8CB4-19BB-D6BFD98182B0} - C:\WINDOWS\system32\krmpbrm.dll (file missing)O2 - BHO: (no name) - {375D6281-8A3B-82BD-1FBB-D6BFD981DAB7} - (no file)O2 - BHO: (no name) - {47D66F10-43DB-D496-B859-D6335701CBAB} - (no file)O3 - Toolbar: (no name) - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - (no file)O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\Av_Fw\Common\FSM32.EXE" /splashO4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\Av_Fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSWO4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Securitoo\Av_Fw\FSGUI\FSSW.EXE" /rebootO4 - HKLM\..\Run: [News Service] "C:\Program Files\Securitoo\Av_Fw\FSGUI\ispnews.exe"O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /minO4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimizedO4 - HKLM\..\Run: [WEBUPLOGCHIN] C:\Documents and Settings\All Users\Application Data\FunkErrorWebUp\Messgram.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [seek surf] C:\DOCUME~1\PROPRI~1\APPLIC~1\COOLBO~1\Rule Byte Chin.exeO4 - HKCU\..\Run: [PECarlin] "C:\Program Files\PECarlin\PECarlin.exe"O4 - HKCU\..\Run: [AXVenore] "C:\Program Files\AXVenore\AXVenore.exe"O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"O4 - HKCU\..\Run: [Itih] "C:\PROGRA~1\COMMON~1\PPATCH~1
otepad.exe" -vt yazbO4 - HKCU\..\Run: [Mpx] C:\Program Files\F?nts\m?dtc.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\WINDOWS\system32\shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site....O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - AppInit_DLLs: ,runner.dll,runner.dll,kfpmdkeh.dll,sdrunner.dll,runner.dll,runner.dll       c:\windows\system32\iexplore.dll C:\WINDOWS\system32\iexplore.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exeO23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exeO23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\Av_Fw\backweb\8520111\Program\SERVIC~1.EXEO23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exeO23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\Anti-Virus\fsgk32st.exeO23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\Av_Fw\backweb\8520111\program\fsbwsys.exeO23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\FWES\Program\fsdfwd.exeO23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\Av_Fw\Common\FSMA32.EXEO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exesitu peux me dire se que je peux supprimer merci

Regis59 · Answer

SalutTu t es trompé...Tu as la version anglaise comme moi?Si oui, fais comme ceci stp, c est pas le meme rapport:2-HijackThis -> Open the misc tools sections -> open Uninstall manager -> clique sur "Save list" -> enregistre le fichier -> fais-en un copier/coller ici. Et ensuite fais ceci:Télécharge lopxp ici: http://pageperso.aol.fr/balltrap34/lopxp.zip (Merci Moe31 et Balltrap34)2) dezippe le (clic droit dessus > extraire tout) et lance lopxp.bat le bloc note va s'ouvrir, copie et colle le contenu iciA+

Scan hijackthis

5 réponses

Discussions similaires