Question d'ordre UGRENT[Aide Svp] Fermé

Question

Bonjour, 
j'ai une question. j'ai tappé CMD dans Exectuer et voila ce que j'ai reçu.


http://img401.imageshack.us/img401/8262/escebs6.jpg 
regarder l'image:)

j'aimrais savoir,quesceque cela signifie?,c'est un hacker qui ma eu ou bien??

kris6943 · Answer

un hacker... je ne pense pas mais un virus ...oui c'est parfaitement possible

met moi un log hijackthis pour vérifier

senad · Answer

un log hijackthis??

comment je fais cela?

kris6943 · Answer

http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

tu l'installes
tu le lances
il va se créé un rapport qui s'ouvrira dans le presse papier

fais en un copier coller dans ton prochain message

senad · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:34:13, on 2007-11-10
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard
hksrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Classic PhoneTools\CapFax.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nplefctvkknfcfnurefjq.uk/SiXHw7ZZUo0FRil3NdreZwHE84jyZNZ3BQcHr73bZihx7cxWqQTq22GD1oLv/L93.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.broadcom.com/support/security-center
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_18_0.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_18_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ListPileMp3Camp] C:\Documents and Settings\All Users\Application Data\Mode Dvd List Pileef axis.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe \RESET
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [The locks settings ante] C:\Documents and Settings\All Users\Application Data\Cool Eggs The Locks\Fast 16.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\RunServices: [Remote Update Verification] C:\WINDOWS\system32\DBDllServ.exe
O4 - HKLM\..\RunServices: [XP Manager Socket] C:\WINDOWS\system32\OSAVCfg.exe
O4 - HKLM\..\RunServices: [NT Application Server] C:\WINDOWS\system32\MSAVCfg.exe
O4 - HKLM\..\RunServices: [Current Service Validation] C:\WINDOWS\system32\SysDllServ.exe
O4 - HKLM\..\RunServices: [Secure Server Device] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [Windows Validation Client] C:\WINDOWS\system32\DBExecCom.exe
O4 - HKLM\..\RunServices: [Driver Device Update] C:\WINDOWS\system32\SysExec.exe
O4 - HKLM\..\RunServices: [Antivirus 32 Manager] C:\WINDOWS\system32\WinOCX.exe
O4 - HKLM\..\RunServices: [System Verification Manager] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKLM\..\RunServices: [Registry Client Manager] C:\WINDOWS\system32\MSExecCfg.exe
O4 - HKLM\..\RunServices: [Firewall Socket Device] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [MS Manager Socket] C:\WINDOWS\system32\OSAV32.exe
O4 - HKLM\..\RunServices: [Admin Manager Update] C:\WINDOWS\system32\SysExecServ.exe
O4 - HKLM\..\RunServices: [Win Verification Application] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKLM\..\RunServices: [System Client Manager] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKLM\..\RunServices: [Current Manager Validation] C:\WINDOWS\system32\SysDllServ.exe
O4 - HKLM\..\RunServices: [Secure Server 32] C:\WINDOWS\system32\OSOCX32.exe
O4 - HKLM\..\RunServices: [Microsoft Device Service] C:\WINDOWS\system32\WinExec.exe
O4 - HKLM\..\RunServices: [Win Validation Application] C:\WINDOWS\system32\DBExecCom.exe
O4 - HKLM\..\RunServices: [XP Application Socket] C:\WINDOWS\system32\OSAVCfg.exe
O4 - HKLM\..\RunServices: [Root Update Verification] C:\WINDOWS\system32\DBDllServ.exe
O4 - HKLM\..\RunServices: [Microsoft 32 Manager] C:\WINDOWS\system32\WinExec.exe
O4 - HKLM\..\RunServices: [Win Validation Client] C:\WINDOWS\system32\DBExecCom.exe
O4 - HKLM\..\RunServices: [Windows Update Client] C:\WINDOWS\system32\DBDllCom.exe
O4 - HKLM\..\RunServices: [Registry Client Server] C:\WINDOWS\system32\MSAVCfg.exe
O4 - HKLM\..\RunServices: [Antivirus Socket Device] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [Driver Device Service] C:\WINDOWS\system32\SysExec.exe
O4 - HKLM\..\RunServices: [Remote Update Client] C:\WINDOWS\system32\DBDllCom.exe
O4 - HKLM\..\RunServices: [Antivirus Socket Manager] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [System Verification Application] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKLM\..\RunServices: [Current Manager Update] C:\WINDOWS\system32\SysDllServ.exe
O4 - HKLM\..\RunServices: [NT Client Server] C:\WINDOWS\system32\MSAVCfg.exe
O4 - HKLM\..\RunServices: [Root Service Validation] C:\WINDOWS\system32\DBDllServ.exe
O4 - HKLM\..\RunServices: [MS Server 32] C:\WINDOWS\system32\OSOCX32.exe
O4 - HKLM\..\RunServices: [XP Application Server] C:\WINDOWS\system32\OSAVCfg.exe
O4 - HKLM\..\RunServices: [MS Manager 32] C:\WINDOWS\system32\OSOCX32.exe
O4 - HKLM\..\RunServices: [Root Service Verification] C:\WINDOWS\system32\DBDllServ.exe
O4 - HKLM\..\RunServices: [Admin Device Update] C:\WINDOWS\system32\SysExec.exe
O4 - HKLM\..\RunServices: [Microsoft 32 Service] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [Firewall Server Device] C:\WINDOWS\system32\WinOCX32.exe
O4 - HKLM\..\RunServices: [Root Update Validation] C:\WINDOWS\system32\DBDllServ.exe
O4 - HKLM\..\RunServices: [System Client Update] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKLM\..\RunServices: [Win Update Verification] C:\WINDOWS\system32\MSExecCom.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Each Eggs] C:\DOCUME~1\SENAD~1.MIH\APPLIC~1\BOOKFR~1\cdromblue.exe
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'AMINA')
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'AMINA')
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'AMINA')
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'AMINA')
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [Each Eggs] C:\DOCUME~1\AMINA\APPLIC~1\BOOKFR~1\cdromblue.exe (User 'AMINA')
O4 - HKUS\S-1-5-21-861567501-113007714-682003330-1008\..\Run: [The locks settings ante] C:\Documents and Settings\All Users\Application Data\Cool Eggs The Locks\Load move.exe (User 'AMINA')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\SenaD\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://south-protection.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/17875d3b4ea52a8e9c15/netzip/RdxIE601_fr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - https://www.disney.com/
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard
hksrv.exe
O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tuser.exe (file missing)
O23 - Service: NTLOAD - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)
O23 - Service: NTSVCMGR - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER
tsrv.exe (file missing)

kris6943 · Answer

Tu es d'une inconscience rare...

Pas d'antivirus, pas de pare-feu... 
Tu es gravement infecté mais tu l'as bien cherché.

Avant de faire quoi que ce soit sur ton PC, tu vas commencer par installer un antivirus. Je te recommande Avira (le meilleur des gratuits mais en anglais)     http://www.commentcamarche.net/telecharger/telecharger 55 antivir 
ou Avast (un peu en dessous mais en français) http://www.commentcamarche.net/telecharger/telecharger 151 avast

Quand tu en as installé un (et un seul... sinon ça va déconner), tu le mets à jour et tu lances une analyse complète de ton disque dur. Puis tu ramènes le rapport dans ta réponse.

kris6943 · Answer

pendant le deroulement de ton analyse antivirus, tu peux en profiter pour :

-      mettre à jour java
https://java.com/fr/download/uninstalltool.jsp

-     installer un pare-feu 
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-     faire une analyse antispyware avec ad-aware  ou Spybot qui sont déjà installés sur ton PC.
(pense à les mettre à jour avant de scanner)

senad · Answer

ok merci!! j'vai tout faire sa ce soir et je vous redonne de nouvelles demin matin!

Merci!

Question d'ordre UGRENT[Aide Svp]

7 réponses

Discussions similaires