Hijackthis (pour regis58)

Résolu
jadareem -  
Merci regis pour tous ces conseils!!! c super gentil!!!
Voila j'ai suivis ta procedure et voici le contenu du fichier report.txt

SDFix: Version 1.81

Run by Julie Cahn - 03/05/2007 - 0:24:26,96

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
av4tlcmr8h

ImagePath:
C:\WINDOWS\system32\dior4f47479281.exe /service

av4tlcmr8h - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\KLJSSE.EXE - Deleted
C:\WINDOWS\SYSTEM32\CDXDIZ.EXE - Deleted
C:\WINDOWS\SYSTEM32\AJDDBA.EXE - Deleted
C:\WINDOWS\SYSTEM32\QDBKAH.EXE - Deleted
C:\WINDOWS\SYSTEM32\UKXINZ.EXE - Deleted
C:\WINDOWS\SYSTEM32\KQIDSV.EXE - Deleted
C:\WINDOWS\SYSTEM32\QPUBMN.EXE - Deleted
C:\WINDOWS\SYSTEM32\JDHPXO.EXE - Deleted
C:\WINDOWS\SYSTEM32\FGOZKX.EXE - Deleted
C:\WINDOWS\SYSTEM32\IZRYUU.EXE - Deleted
C:\WINDOWS\SYSTEM32\PHQGHU.EXE - Deleted
C:\WINDOWS\SYSTEM32\HMDIPO.EXE - Deleted
C:\WINDOWS\SYSTEM32\ZSPGRM.EXE - Deleted
C:\WINDOWS\SYSTEM32\FUXOVY.EXE - Deleted
C:\WINDOWS\SYSTEM32\NQDUXW.EXE - Deleted
C:\WINDOWS\SYSTEM32\NAHMPO.EXE - Deleted
C:\WINDOWS\SYSTEM32\XCEMBM.EXE - Deleted
C:\WINDOWS\SYSTEM32\SCXGGB.EXE - Deleted
C:\WINDOWS\SYSTEM32\NCBQPM.EXE - Deleted
C:\WINDOWS\SYSTEM32\IRKTVU.EXE - Deleted
C:\WINDOWS\SYSTEM32\VBXAPJ.EXE - Deleted
C:\WINDOWS\SYSTEM32\HMDELU.EXE - Deleted
C:\WINDOWS\SYSTEM32\ABCXAD.EXE - Deleted
C:\WINDOWS\SYSTEM32\KTXKWZ.EXE - Deleted
C:\WINDOWS\SYSTEM32\VYLCHU.EXE - Deleted
C:\WINDOWS\SYSTEM32\XMZCBK.EXE - Deleted
C:\WINDOWS\SYSTEM32\REPGGX.EXE - Deleted
C:\WINDOWS\SYSTEM32\EHCZYH.EXE - Deleted
C:\WINDOWS\SYSTEM32\GGXRPN.EXE - Deleted
C:\WINDOWS\SYSTEM32\RUTYXO.EXE - Deleted
C:\WINDOWS\SYSTEM32\CJCZWC.EXE - Deleted
C:\WINDOWS\SYSTEM32\BCVPHC.EXE - Deleted
C:\WINDOWS\SYSTEM32\GXWBGD.EXE - Deleted
C:\WINDOWS\SYSTEM32\RMJKDS.EXE - Deleted
C:\WINDOWS\SYSTEM32\XKBSXU.EXE - Deleted
C:\WINDOWS\SYSTEM32\FBRDQC.EXE - Deleted
C:\WINDOWS\SYSTEM32\NCJAHK.EXE - Deleted
C:\WINDOWS\SYSTEM32\QSDEMO.EXE - Deleted
C:\WINDOWS\SYSTEM32\FYZMPC.EXE - Deleted
C:\WINDOWS\SYSTEM32\KZUXSZ.EXE - Deleted
C:\WINDOWS\SYSTEM32\RWDGZW.EXE - Deleted
C:\WINDOWS\SYSTEM32\RPNRVY.EXE - Deleted
C:\WINDOWS\SYSTEM32\IBOHCH.EXE - Deleted
C:\WINDOWS\SYSTEM32\KKASVW.EXE - Deleted
C:\WINDOWS\SYSTEM32\GJOJAT.EXE - Deleted
C:\WINDOWS\SYSTEM32\QXAJOR.EXE - Deleted
C:\WINDOWS\SYSTEM32\SCTWVO.EXE - Deleted
C:\WINDOWS\SYSTEM32\FSVKPI.EXE - Deleted
C:\WINDOWS\SYSTEM32\XULKLN.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFKRMH.EXE - Deleted
C:\WINDOWS\SYSTEM32\KPWBUP.EXE - Deleted
C:\WINDOWS\SYSTEM32\WTIBEJ.EXE - Deleted
C:\WINDOWS\SYSTEM32\XOLRRH.EXE - Deleted
C:\WINDOWS\SYSTEM32\DJWJMA.EXE - Deleted
C:\WINDOWS\SYSTEM32\ZHLVDT.EXE - Deleted
C:\WINDOWS\SYSTEM32\XOAIVJ.EXE - Deleted
C:\WINDOWS\SYSTEM32\28818_~1.EXE - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7BC.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7BD.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7BA.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7A4.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7A5.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7A0.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7AE.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7AF.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7AC.tmp - Deleted
C:\WINDOWS\Temp\cjnr4r4BFD4A7AD.tmp - Deleted
C:\WINDOWS\Temp\sklrr7y8823908.tmp - Deleted
C:\WINDOWS\odbc.INI - Deleted

Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\System32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Disabled:LimeWire swarmed installer"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"="C:\\Program Files\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\Pmc.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\Pmc.exe:LocalSubNet:Enabled:Pmc.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PSST.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PSST.exe:LocalSubNet:Enabled:PSST.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PMSInstallInit.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.Tvtv.Wizard.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.Tvtv.Wizard.exe:LocalSubNet:Enabled:PMC.Tvtv.Wizard.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Disabled:LimeWire"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\WINDOWS\system32\8F176C33B7.sys
C:\Documents and Settings\All Users\Documents\1ere Ann‚e EIM\compta gestion et financiere\~WRL3520.tmp
C:\Documents and Settings\All Users\Documents\1ere Ann‚e EIM\compta gestion et financiere\~WRL3805.tmp
C:\Documents and Settings\All Users\Documents\1ere Ann‚e EIM\introduction au droit\~WRL1979.tmp
C:\Documents and Settings\All Users\Documents\1ere Ann‚e EIM\histoire des religions\~WRL3063.tmp
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp
C:\Documents and Settings\Julie Cahn\Mes documents\~WRL2525.tmp
C:\Documents and Settings\Julie Cahn\Mes documents\Mes fichiers re‡us\~WRL2385.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0009.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0006.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1634.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0133.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3224.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3093.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3787.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2433.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0738.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1310.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0025.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3197.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3849.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2801.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL4065.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3493.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2717.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1782.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2439.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0007.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1340.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3809.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0534.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3527.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0829.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1760.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0671.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3844.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1222.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1159.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2645.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL1423.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2100.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2446.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL2743.tmp
C:\Documents and Settings\Julie Cahn\Application Data\Microsoft\Word\~WRL3399.tmp

Finished
Configuration: Windows XP
Internet Explorer 7.0

5 réponses

  1.  Regis59 Contributeur sécurité
    Hello

    Tu peux rester sur le poste ou on etait?

    A+
    0
    1. jadareem Auteur
      coucou,

      Je susi toujours sur le meme poste (enfin si pour toi le poste ca ve dire le meme ordi? je n'ai pas change?!)

      bis
      Julie
      0
      1. Regis59 Contributeur sécurité
        Coucou Julie,

        Pour moi le meme poste, c'est au meme endroit ou je t avais demandé de faire cela ;)

        A+
        0
        1. jadareem Auteur
          Coucou Regis,

          Ben en fait je suis toujours restee sur le meme poste, et jai suivit toutes tes indications....
          alors pe etre ke je nai toujours pas bien compris ce ke tu ve dire....:(

          Bisous

          Julie
          0
      2. jadareem Auteur
        c bon g comprissss j'ai tout remis sur le poste initial!!!
        :)
        0
        2. Regis59 Contributeur sécurité
          OK lol

          :)
          0

          Discussions similaires

          Analyse des logs hijackthis
          philnoug

          35 réponses
          Hijackthis
          brioche95

          2 réponses
          Hijackthis
          The Dj

          4 réponses
          Log HIJACKTHIS
          Thi83

          13 réponses
          rapport Hijackthis
          kawito33

          87 réponses