Que'est q'il passe en mon pc
soro
-
^^Marie^^ Messages postés 126523 Date d'inscription Statut Membre Dernière intervention -
^^Marie^^ Messages postés 126523 Date d'inscription Statut Membre Dernière intervention -
Bonjour,
j'ai installé hijakthis et vriment je sait pas comment l'utiliser et surtout je pense que mon pc est éspionné.
alors;
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:23:24 ?, on 31/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\commond.com
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\7-Zip\7zFM.exe
C:\DOCUME~1\DALAL\LOCALS~1\Temp\7zO11.tmp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.amrkhaled.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\commond.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D9958A-5E9A-4E43-B673-45C395ABCB22}: NameServer = 41.221.20.4 193.251.169.165
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
j'ai installé hijakthis et vriment je sait pas comment l'utiliser et surtout je pense que mon pc est éspionné.
alors;
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:23:24 ?, on 31/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\commond.com
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\7-Zip\7zFM.exe
C:\DOCUME~1\DALAL\LOCALS~1\Temp\7zO11.tmp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.amrkhaled.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\commond.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D9958A-5E9A-4E43-B673-45C395ABCB22}: NameServer = 41.221.20.4 193.251.169.165
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
A voir également:
- Que'est q'il passe en mon pc
- Mon pc est lent - Guide
- Reinitialiser pc - Guide
- Downloader for pc - Télécharger - Téléchargement & Transfert
- Réinitialiser pc sans mot de passe - Guide
- Plus de son sur mon pc - Guide
27 réponses
Message à soro
Ton seul interlocuteur ici est buginformatik.
Si buginformatik ne te prévient pas qu'il laisse quelqu'un d'autre t'aider, ne fais rien d'autre que ce que buginformatik te dit.
Full stop !
<EDIT>
De toute façon, ne panique pas : tous les autres regardent comment ça se passe et si buginformatik oublie quelque chose, il sera averti par MP (message personnel) !
Ton seul interlocuteur ici est buginformatik.
Si buginformatik ne te prévient pas qu'il laisse quelqu'un d'autre t'aider, ne fais rien d'autre que ce que buginformatik te dit.
Full stop !
<EDIT>
De toute façon, ne panique pas : tous les autres regardent comment ça se passe et si buginformatik oublie quelque chose, il sera averti par MP (message personnel) !
Bonjour à tous ^^
Désolé mais hier soir j'étais un peut fatigué... Je suis parti me coucher après sans vraiment prévenir !
Concernant l'anglais si tu es plus à l'aise moi je veut bien continuer dans cette langue...
Please now, make me a new logfile by Hijackthis like the first one you've made :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:23:24 ?, on 31/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\syste..........
Désolé mais hier soir j'étais un peut fatigué... Je suis parti me coucher après sans vraiment prévenir !
Concernant l'anglais si tu es plus à l'aise moi je veut bien continuer dans cette langue...
Please now, make me a new logfile by Hijackthis like the first one you've made :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:23:24 ?, on 31/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\syste..........
Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié dans C:\.
Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
(le scan doit se faire uniquement en mode sans échec)
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• L'ordinateur redémarre en mode normal...
• Avant d'arriver sur le bureau, une nouvelle fenêtre de SDFix va s'ouvrir. Ceci peut prendre quelques une minutes...
Le rapport SDFix s'ouvre alors :
* Cliquez sur le menu Edition puis Sélectionner tout.
* Cliquez à nouveau sur le menu Edition puis coller.
* Dans votre sujet sur le forum, créez un nouveau message puis clic droit / coller dans le message afin de coller le rapport.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié dans C:\.
Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
(le scan doit se faire uniquement en mode sans échec)
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le scrïpt.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• L'ordinateur redémarre en mode normal...
• Avant d'arriver sur le bureau, une nouvelle fenêtre de SDFix va s'ouvrir. Ceci peut prendre quelques une minutes...
Le rapport SDFix s'ouvre alors :
* Cliquez sur le menu Edition puis Sélectionner tout.
* Cliquez à nouveau sur le menu Edition puis coller.
* Dans votre sujet sur le forum, créez un nouveau message puis clic droit / coller dans le message afin de coller le rapport.
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
merci de prendre le temps de m'aider.
quand j'ai a l'étape d'ouvert le dossier SDFix ;il n'ouvre pas et je sait pas comment choisis Run this.bat
puisque une message d'erreur dit que"SDFix ne peut ouvrit en safe mode"
est ce q'il y a pb dans l'installation de SDFix ou quoi.
merci
quand j'ai a l'étape d'ouvert le dossier SDFix ;il n'ouvre pas et je sait pas comment choisis Run this.bat
puisque une message d'erreur dit que"SDFix ne peut ouvrit en safe mode"
est ce q'il y a pb dans l'installation de SDFix ou quoi.
merci
Tu es passé en mode sans échec pour faire le nettoyage ? Sachant que l'installation se fait en mode normal biensur
je suis avec toi.
oui;oui;mensieur.
je passe en mode sans echec comme tu me dis
mais maintenant ,j'ai lit "how to use SDFix"
et l'importante note et que je choisi le compte administrateur et mode sans echec,mais mois j'ai choisi mon compte.
maybe c'est ça le pb !ou nom.
oui;oui;mensieur.
je passe en mode sans echec comme tu me dis
mais maintenant ,j'ai lit "how to use SDFix"
et l'importante note et que je choisi le compte administrateur et mode sans echec,mais mois j'ai choisi mon compte.
maybe c'est ça le pb !ou nom.
salut;le rapport
[b]SDFix: Version 1.238 [/b]
Run by DALAL on Fri 10/31/2008 at 07:49 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\autorun.inf - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp6.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp1A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpB.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp28.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp5.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp18.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp7.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp8.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp9.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp53.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpC.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp17.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp31.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp36.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3E.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp43.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp48.tmp - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 20:04:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\ACCWIZ.EXE"="C:\\WINDOWS\\System32\\ACCWIZ.EXE:*:Enabled:Assistant Accessibilit‚"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Tue 12 Feb 2008 15,388 ..SH. --- "C:\3xXx31.exe"
Sun 12 Mar 2006 10,311,680 ..SH. --- "C:\Program Files\AVIConverter\mencoder.exe"
Fri 17 Oct 2008 19,968 ...H. --- "C:\Documents and Settings\DALAL\My Documents\~WRL2316.tmp"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025396.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025532.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025559.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025577.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025612.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025635.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025681.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025701.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025718.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025735.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025751.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025851.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025951.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025967.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025982.exe"
Mon 31 Mar 2008 17,243,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6e0cf36117c7bac06954929597c287c3\BIT21.tmp"
[b]Finished![/b]
[b]SDFix: Version 1.238 [/b]
Run by DALAL on Fri 10/31/2008 at 07:49 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\autorun.inf - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp6.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp1A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpB.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp28.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp5.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp18.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp7.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp8.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp9.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp53.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpC.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp17.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp31.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp36.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3E.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp43.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp48.tmp - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 20:04:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\ACCWIZ.EXE"="C:\\WINDOWS\\System32\\ACCWIZ.EXE:*:Enabled:Assistant Accessibilit‚"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Tue 12 Feb 2008 15,388 ..SH. --- "C:\3xXx31.exe"
Sun 12 Mar 2006 10,311,680 ..SH. --- "C:\Program Files\AVIConverter\mencoder.exe"
Fri 17 Oct 2008 19,968 ...H. --- "C:\Documents and Settings\DALAL\My Documents\~WRL2316.tmp"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025396.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025532.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025559.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025577.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025612.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025635.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025681.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025701.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025718.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025735.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025751.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025851.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025951.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025967.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025982.exe"
Mon 31 Mar 2008 17,243,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6e0cf36117c7bac06954929597c287c3\BIT21.tmp"
[b]Finished![/b]
c'est ça :
[b]SDFix: Version 1.238 [/b]
Run by DALAL on Fri 10/31/2008 at 07:49 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\autorun.inf - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp6.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp1A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpB.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp28.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp5.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp18.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp7.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp8.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp9.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp53.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpC.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp17.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp31.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp36.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3E.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp43.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp48.tmp - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 20:04:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\ACCWIZ.EXE"="C:\\WINDOWS\\System32\\ACCWIZ.EXE:*:Enabled:Assistant Accessibilit‚"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Tue 12 Feb 2008 15,388 ..SH. --- "C:\3xXx31.exe"
Sun 12 Mar 2006 10,311,680 ..SH. --- "C:\Program Files\AVIConverter\mencoder.exe"
Fri 17 Oct 2008 19,968 ...H. --- "C:\Documents and Settings\DALAL\My Documents\~WRL2316.tmp"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025396.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025532.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025559.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025577.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025612.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025635.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025681.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025701.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025718.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025735.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025751.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025851.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025951.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025967.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025982.exe"
Mon 31 Mar 2008 17,243,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6e0cf36117c7bac06954929597c287c3\BIT21.tmp"
[b]Finished![/b]
[b]SDFix: Version 1.238 [/b]
Run by DALAL on Fri 10/31/2008 at 07:49 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
[b]Checking Services [/b]:
Restoring Default Security Values
Restoring Default Hosts File
Restoring Missing Security Center Service
Rebooting
[b]Checking Files [/b]:
Trojan Files Found:
C:\autorun.inf - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp6.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp1A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpB.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp28.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp5.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp18.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp7.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp8.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp9.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp53.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmpC.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp17.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp31.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp36.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3A.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp3E.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp43.tmp - Deleted
C:\DOCUME~1\DALAL\LOCALS~1\Temp\tmp48.tmp - Deleted
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 20:04:02
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\ACCWIZ.EXE"="C:\\WINDOWS\\System32\\ACCWIZ.EXE:*:Enabled:Assistant Accessibilit‚"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Disabled:RealPlayer"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]:
Tue 12 Feb 2008 15,388 ..SH. --- "C:\3xXx31.exe"
Sun 12 Mar 2006 10,311,680 ..SH. --- "C:\Program Files\AVIConverter\mencoder.exe"
Fri 17 Oct 2008 19,968 ...H. --- "C:\Documents and Settings\DALAL\My Documents\~WRL2316.tmp"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025396.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025532.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025559.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025577.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025612.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025635.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025681.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025701.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025718.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025735.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025751.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025851.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025951.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025967.exe"
Tue 12 Feb 2008 15,388 A.SH. --- "C:\System Volume Information\_restore{DF674870-A7A8-48F9-AD1E-4BA774BC984B}\RP67\A0025982.exe"
Mon 31 Mar 2008 17,243,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6e0cf36117c7bac06954929597c287c3\BIT21.tmp"
[b]Finished![/b]
buginformtik est q'il y a des pbs dans le dernier rapport ou non
et merci pour votre interesant a mon pb de le debut.
et merci pour votre interesant a mon pb de le debut.
Slt,
Buginformatik jai lu ton message sur le bureau CCMistes, lol ne pete pas un cable tu vas y arriver je suis de tout coeur avec toi =D; tu t'en sors de cette(ces) infection(s) ?
Buginformatik jai lu ton message sur le bureau CCMistes, lol ne pete pas un cable tu vas y arriver je suis de tout coeur avec toi =D; tu t'en sors de cette(ces) infection(s) ?
Hi soro,
since your computer is infected, did you plug some USB devices ?
If yes, they are infected too.
You need them to desinfect them too.
since your computer is infected, did you plug some USB devices ?
If yes, they are infected too.
You need them to desinfect them too.
bonjour a tout
c'est bien,on continu en français.
le rapport par hijakthis estLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:13 ?, on 01/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\commond.com
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\7-Zip\7zFM.exe
C:\DOCUME~1\DALAL\LOCALS~1\Temp\7zO1.tmp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.amrkhaled.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\commond.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D9958A-5E9A-4E43-B673-45C395ABCB22}: NameServer = 41.221.20.4 193.251.169.165
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
c'est bien,on continu en français.
le rapport par hijakthis estLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:27:13 ?, on 01/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\commond.com
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\7-Zip\7zFM.exe
C:\DOCUME~1\DALAL\LOCALS~1\Temp\7zO1.tmp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.amrkhaled.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.yahoo.com/?p=us
R3 - URLSearchHook: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\commond.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! ¤u¨?¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D9958A-5E9A-4E43-B673-45C395ABCB22}: NameServer = 41.221.20.4 193.251.169.165
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
Bien
Tu vas télécharger la dernière version de Malwarebytes anti malware 1.30 : https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Voilà un site qui va t'aider pour bien l'installer ==> https://forums.cnetfrance.fr
A la fin de l'installation, Ne coche pas "exécuter Malwarebytes' anti malware", mais juste "mettre à jour Malwarebytes' anti malware"
Une fois la mise à jour d'effectuée, redémarre ton ordinateur en mode sans échec, et lance le logiciel malware byte.
tu devra Exécuter un examen complet de C:
Le scan est parfois assez long...
Une fois terminé, vous recevez un message disant que celui-ci a réussi. Cliquez sur OK, pour Afficher le résultat.
Afin de supprimer les infections, choisissez l'option Supprimer la sélection. (s'assurer que les infections sont au préalable cochées)
Tu peut maintenant redémarrer ton Pc en mode normal, et me poster le rapport de Malware Bytes, présent dans L'onglet "Rapports" sous forme de document .txt
Tu vas télécharger la dernière version de Malwarebytes anti malware 1.30 : https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Voilà un site qui va t'aider pour bien l'installer ==> https://forums.cnetfrance.fr
A la fin de l'installation, Ne coche pas "exécuter Malwarebytes' anti malware", mais juste "mettre à jour Malwarebytes' anti malware"
Une fois la mise à jour d'effectuée, redémarre ton ordinateur en mode sans échec, et lance le logiciel malware byte.
tu devra Exécuter un examen complet de C:
Le scan est parfois assez long...
Une fois terminé, vous recevez un message disant que celui-ci a réussi. Cliquez sur OK, pour Afficher le résultat.
Afin de supprimer les infections, choisissez l'option Supprimer la sélection. (s'assurer que les infections sont au préalable cochées)
Tu peut maintenant redémarrer ton Pc en mode normal, et me poster le rapport de Malware Bytes, présent dans L'onglet "Rapports" sous forme de document .txt
L'internaute n'aura aucun soucis avec Lyonnais92 s'il intervient.