Demande d'analyse d'un log HijackThis
x_fireball_x
Messages postés
3
Date d'inscription
Statut
Membre
-
balltrap34 Messages postés 16241 Statut Contributeur sécurité -
balltrap34 Messages postés 16241 Statut Contributeur sécurité -
bonjour, je me permets de faire ce post car j'ai remarque a plusieurs reprises un comportement etrange de mon pc. D'une part un gros ralentissement ponctuel et aleatoire et d'autre part un simple clique gauche qui se transforme en double clic de temps a autres.... J'ai constate aussi que mon "UC utilisée", quand je fais Ctrl Alt Supp est a 100% quand y'a CTHELPER.EXE. Je kill cette tache et puis zouh, ca retombe a 7-8%! je ne sais pas trop ce qu'il se passe.
J'utilise XP, j'ai 512Mo de ram, un XP 1800+, une sb live!,une Gforce MX 440, un trackball 'crosoft (je ne sais pas si c'est utile, mais je le dis pour le cas ou...). Ah oui, j'ai aussi une conenction adsl avec un modem sagem sur port usb.
Voila, merci de m'aider a comprendre ce qu'il pourrait y avoir (si toutefois y'a kkechose!)
@++
Logfile of HijackThis v1.97.7
Scan saved at 23:34:17, on 06/04/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\software\Pop-Up Stopper\dpps2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\windows\system32\sncntr.exe
D:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
C:\Program Files\Internet Optimizer\optimize.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
H:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
d:\softwares\ADSL Autoconnect\ADSL Autoconnect.exe
D:\softwares\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\FireB@ll\Bureau\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=07442319216801
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=128524
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://tjdo.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=07442319216801
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\bi.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\softwares\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (disabled by BHODemon)
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\gsim.dll
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem217.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - H:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - (no file)
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem214.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - H:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ToUcamVProperty] C:\PROGRA~1\PHILIP~1\VProperty.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] d:\software\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "d:\software\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\Software\ICQ2003\NDetect.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Mscnt] c:\windows\system32\mscnt.exe /noconnect
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "d:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm
O4 - HKLM\..\Run: [AudioHQU] D:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Piolet] H:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [msbb] C:\Program Files\Internet Optimizer\sim\msbb.exe
O4 - HKLM\..\Run: [KVCIS] C:\WINDOWS\KVCIS.exe
O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\RunOnce: [ICQ] D:\Software\ICQ2003\ICQ.exe -trayboot
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: Translator (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
O16 - DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} (AXWebMon Control) - http://nanard1000.free.fr/AXWebMonProj1.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030523/qtinstall.info.apple.com/drakken/fr/win/QuickTimeInstaller.exe
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {53F2ACEF-931C-4869-92A7-B3E3E49F0035} (AxPSFRA Control) - http://www.samsungmobile.com/fra/play/photo/album_fra.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/13e7b33fc66eda658d06/netzip/RdxIE601_fr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003031901/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera1.mairie-brest.fr/activex/AxisCamControl.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37930.5392824074
O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} (Loader Class) - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimizer/080703/UniDistIOcrack.CAB
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/es/SysWebTelecom.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tjdo.com
O17 - HKLM\Software\..\Telephony: DomainName = tjdo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FC18056-EF92-49D5-919E-24BBE6DAD676}: NameServer = 194.117.200.15 194.117.200.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CE1D98F-1E70-4584-B2FC-1577F20044C2}: Domain = tjdo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{7036F58C-8166-4DC0-BF93-93DEDCFE4CC4}: Domain = tjdo.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tjdo.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1FC18056-EF92-49D5-919E-24BBE6DAD676}: NameServer = 194.117.200.15 194.117.200.10
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = tjdo.com
J'utilise XP, j'ai 512Mo de ram, un XP 1800+, une sb live!,une Gforce MX 440, un trackball 'crosoft (je ne sais pas si c'est utile, mais je le dis pour le cas ou...). Ah oui, j'ai aussi une conenction adsl avec un modem sagem sur port usb.
Voila, merci de m'aider a comprendre ce qu'il pourrait y avoir (si toutefois y'a kkechose!)
@++
Logfile of HijackThis v1.97.7
Scan saved at 23:34:17, on 06/04/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
D:\software\Pop-Up Stopper\dpps2.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\windows\system32\sncntr.exe
D:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
C:\Program Files\Internet Optimizer\optimize.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
H:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
d:\softwares\ADSL Autoconnect\ADSL Autoconnect.exe
D:\softwares\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\FireB@ll\Bureau\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=07442319216801
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=128524
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://tjdo.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://if.searchcentrix.com/sidecat.jsp?p=98567&appid=21&id=07442319216801
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer avec Club-Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\bi.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\softwares\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (disabled by BHODemon)
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D} - C:\WINDOWS\gsim.dll
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem217.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - H:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - (no file)
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem214.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - H:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ToUcamVProperty] C:\PROGRA~1\PHILIP~1\VProperty.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] d:\software\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "d:\software\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [Mirabilis ICQ] D:\Software\ICQ2003\NDetect.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Mscnt] c:\windows\system32\mscnt.exe /noconnect
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "d:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm
O4 - HKLM\..\Run: [AudioHQU] D:\Program Files\Creative\SBLive\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Piolet] H:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [msbb] C:\Program Files\Internet Optimizer\sim\msbb.exe
O4 - HKLM\..\Run: [KVCIS] C:\WINDOWS\KVCIS.exe
O4 - HKLM\..\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\RunOnce: [ICQ] D:\Software\ICQ2003\ICQ.exe -trayboot
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Translate (HKLM)
O9 - Extra 'Tools' menuitem: Translator (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v3.0/0006.cab
O16 - DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} (AXWebMon Control) - http://nanard1000.free.fr/AXWebMonProj1.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_FR_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030523/qtinstall.info.apple.com/drakken/fr/win/QuickTimeInstaller.exe
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {53F2ACEF-931C-4869-92A7-B3E3E49F0035} (AxPSFRA Control) - http://www.samsungmobile.com/fra/play/photo/album_fra.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/13e7b33fc66eda658d06/netzip/RdxIE601_fr.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003031901/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {86A88967-7A20-11D2-8EDA-00600818EDB1} (ParallelGraphics Cortona Control) - http://www.parallelgraphics.com/bin/cortvrml.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://camera1.mairie-brest.fr/activex/AxisCamControl.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37930.5392824074
O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} (Loader Class) - http://dialup.carpediem.fr/CABS/cd/1,0,3,8/fr/AccesMembre.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimizer/080703/UniDistIOcrack.CAB
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} (SysWebTelecomInt Class) - http://www.sponsoradulto.com/es/SysWebTelecom.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) - http://216.65.38.226/crack.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tjdo.com
O17 - HKLM\Software\..\Telephony: DomainName = tjdo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FC18056-EF92-49D5-919E-24BBE6DAD676}: NameServer = 194.117.200.15 194.117.200.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{2CE1D98F-1E70-4584-B2FC-1577F20044C2}: Domain = tjdo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{7036F58C-8166-4DC0-BF93-93DEDCFE4CC4}: Domain = tjdo.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tjdo.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{1FC18056-EF92-49D5-919E-24BBE6DAD676}: NameServer = 194.117.200.15 194.117.200.10
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = tjdo.com
5 réponses
-
salut
je ne connait pas trop HijackThis
mais celle la tu la coche et tu peut la fix
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
Faite scan en ligne et coller le rapport ici sur le post
utiliser l'antivirus en ligne suivant :
http://www.ravantivirus.com/scan/
Cliquer sur "To continue without subscribing click here" et attendre quelques minutes.
Lorsque "Ready" est affiché dans "status", cocher la case "Autoclean" puis cliquer sur "Scan my PC"
A la fin de l'analyse, copier/coller le rapport ici. -
Bonsoir! Merci d'avoir repondu. J'ai fait comme t'as dit, enfin si j'ai bie ntout compris ;)
En revanche comme je ne sais pas ce qu'il fallait copier, j'ai mis les deux trucs: le rapport de scan puis le 'report'.
Toutedois, meme si j'ai coche 'autoclean' je sais pas si ca a bien regle le pb....
@++
PS: j'ai vire le CTHELPER.exe et ca va nettement mieux du cote de mon % d'uc utilisee! MERCI!
Scan started at 07/04/2004 17:26:12
Scanning memory...
Scanning boot sectors...
Scanning files...
C:\Program Files\ISTsvc\istsvc.exe - TrojanDownloader:Win32/IstBar.AH -> Infected
C:\WINDOWS\tinybar.exe - TrojanDownloader:Win32/IstBar.CG -> Infected
C:\WINDOWS\biprep.exe - TrojanSpy/Win32.BiSpy.A -> Infected
C:\WINDOWS\Belt.exe - TrojanDownloader:Win32/Stubby.A -> Infected
C:\WINDOWS\system32\sncntr.exe - TrojanDownloader:Win32/Dluca.A -> Infected
C:\WINDOWS\Downloaded Program Files\TEST.OCX - TrojanDownloader:Win32/Dia -> Infected
C:\WINDOWS\Downloaded Program Files\UniDist.ocx - TrojanDownloader:Win32/Dyfuca.C -> Infected
C:\Documents and Settings\All Users\Documents\Tony\Mes Documents\STRANGE.EXE - Joke:Win/Aloap (exact) -> Infected
C:\Documents and Settings\FireB@ll\Application Data\ssshssthckfreast.exe - TrojanDownloader:Win32/Swizzor.C -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0140:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0141:CAIP2D45.pif) - Win32/Klez.H@mm -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0157:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0158:null.pif) - Win32/Klez.H@mm -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part1826:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part1827:pierro.doc.pif) - Win32/Bugbear.B@mm -> Infected
C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part2464:)->(part0000:)->(Invalid#1*) - MIME/Invalid#1 -> Suspicious
C:\System Volume Information\_restore{E2D899CC-5CC5-4DC3-B899-1E9FBF5F242F}\RP446\A0071267.exe - TrojanDownloader:Win32/Dyfica.AC -> Infected
C:\System Volume Information\_restore{E2D899CC-5CC5-4DC3-B899-1E9FBF5F242F}\RP446\A0071268.EXE - TrojanDownloader:Win32/Dyfica.AC -> Infected
D:\Software\Netscape\Users\fireball\Mail\Trash->(part0017:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
D:\Software\Netscape\Users\fireball\Mail\Trash->(part0018:CAIP2D45.pif) - Win32/Klez.H@mm -> Infected
D:\Software\Netscape\Users\fireball\Mail\Trash->(part0019:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
D:\Software\Netscape\Users\fireball\Mail\Trash->(part0020:null.pif) - Win32/Klez.H@mm -> Infected
D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0140:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0141:CAIP2D45.pif) - Win32/Klez.H@mm -> Infected
D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0157:)->(IFRAME0000) - HTML/IFrame_Exploit* -> Infected
D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0158:null.pif) - Win32/Klez.H@mm -> Infected
D:\Software\Winamp3\Wacs\wt\wtvis\valentinesdancer\jvminstall.htm->(OBJECT0000) - HTML/CodeBaseExec* -> Infected
D:\Software\Winamp3\Wacs\wt\wtvis\Water Girl\jvminstall.htm->(OBJECT0000) - HTML/CodeBaseExec* -> Infected
Scanned
============================
Objects: 50589
Directories: 5210
Archives: 1020
Size(Kb): 1620104
Infected files: 27
Found
============================
Viruses found: 16
Suspicious files: 1
Disinfected files: 0
Mail files: 4057
Statistics
Scanned files: 50589
Scanned directories: 5210
Scanned archives: 1020
Size of the scanned files: 1658986371
Packed files: 2031
Known viruses found: 27
Virus bodies: 16
Suspicious files: 1
Disinfected files: 0
Deleted files: 0
Renamed files: 0
Copied files: 0
I/O errors: 0
Warnings: 0
Corrupted files: 0
New files: 162985
Mail files: 4057
Found viruses
File: C:\Program Files\ISTsvc\istsvc.exe
Virus: TrojanDownloader:Win32/IstBar.AH Status: Infected
File: C:\WINDOWS\tinybar.exe
Virus: TrojanDownloader:Win32/IstBar.CG Status: Infected
File: C:\WINDOWS\biprep.exe
Virus: TrojanSpy/Win32.BiSpy.A Status: Infected
File: C:\WINDOWS\Belt.exe
Virus: TrojanDownloader:Win32/Stubby.A Status: Infected
File: C:\WINDOWS\system32\sncntr.exe
Virus: TrojanDownloader:Win32/Dluca.A Status: Infected
File: C:\WINDOWS\Downloaded Program Files\TEST.OCX
Virus: TrojanDownloader:Win32/Dia Status: Infected
File: C:\WINDOWS\Downloaded Program Files\UniDist.ocx
Virus: TrojanDownloader:Win32/Dyfuca.C Status: Infected
File: C:\Documents and Settings\All Users\Documents\Tony\Mes Documents\STRANGE.EXE
Virus: Joke:Win/Aloap (exact) Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\ssshssthckfreast.exe
Virus: TrojanDownloader:Win32/Swizzor.C Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0140:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0141:CAIP2D45.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0157:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part0158:null.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part1826:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part1827:pierro.doc.pif)
Virus: Win32/Bugbear.B@mm Status: Infected
File: C:\Documents and Settings\FireB@ll\Application Data\Mozilla\Profiles\FireBall\fo2r00hu.slt\Mail\mail.club-internet.fr\Inbox->(part2464:)->(part0000:)->(Invalid#1*)
Virus: MIME/Invalid#1 Status: Suspicious
File: C:\System Volume Information\_restore{E2D899CC-5CC5-4DC3-B899-1E9FBF5F242F}\RP446\A0071267.exe
Virus: TrojanDownloader:Win32/Dyfica.AC Status: Infected
File: C:\System Volume Information\_restore{E2D899CC-5CC5-4DC3-B899-1E9FBF5F242F}\RP446\A0071268.EXE
Virus: TrojanDownloader:Win32/Dyfica.AC Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Trash->(part0017:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Trash->(part0018:CAIP2D45.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Trash->(part0019:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Trash->(part0020:null.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0140:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0141:CAIP2D45.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0157:)->(IFRAME0000)
Virus: HTML/IFrame_Exploit* Status: Infected
File: D:\Software\Netscape\Users\fireball\Mail\Inbox->(part0158:null.pif)
Virus: Win32/Klez.H@mm Status: Infected
File: D:\Software\Winamp3\Wacs\wt\wtvis\valentinesdancer\jvminstall.htm->(OBJECT0000)
Virus: HTML/CodeBaseExec* Status: Infected
File: D:\Software\Winamp3\Wacs\wt\wtvis\Water Girl\jvminstall.htm->(OBJECT0000)
Virus: HTML/CodeBaseExec* Status: Infected -
tu en a une collection tu na pas d anti virus a jour
bon on vas commencer
utilise ceci mais avant desactive te raestauration systeme
pour cela click droit poste de travail propriete
onglet restauration tu coche desactiver la restauration
http://www.zdnet.fr/telecharger/windows/fiche/0,39021313,39067762s,00.htm
pour les trojans ceci pense a le mettre a jour avant de scanner ton pc
Anti Trojan
http://www.emsisoft.net/fr/
il faut que tu fasse cette mise a jourwindows
http://www.microsoft.com/technet/security/bulletin/MS01-027.asp
jette un coup d qeil sur ceci je n ai pas trop le temp maintenant je dois m absenter de retour vers 1h 30 du mat
http://www.sophos.fr/support/disinfection/klezh.html#sav32clixp
verifie dans ton pare feu il doit y avoir une sorte de fichier quarantaine ou quelque chose de resemblent et vire se que tu y trouve qui se rapporterais a tes viru
a+ -
pourtant si, j'ai Norton Anti Virus et meme que j'ai paye pour m'abonner aux maj !!!! et ca ne voit pas ca?? je ne saisis pas, vraiment. Ca sert a quoi alors un anti-virus si c'est une passoire?
@+ je teste ce que tu m'as ecris et je te tiens au courant, merci encore. -
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
norton c est norton
commence a faire ce que je t ai dit et on verras pour la suite on vas y arrive
