Demande analyse HIJACK THIS

[Thurzaz]

Slt, qq'un prend possesion de mon adresse mail et je me demandais si ce n'étais pas à cause d'un spyware, si qq'un pouvait me faire l'analyse du rapport de HIJACK ce serait sympa.

Merci

 

 

Logfile of HijackThis v1.99.1

Scan saved at 16:15:08, on 30/06/2007

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16386)

 

Running processes:

D:\Windows\System32\smss.exe

D:\Windows\system32\csrss.exe

D:\Windows\system32\wininit.exe

D:\Windows\system32\csrss.exe

D:\Windows\system32\winlogon.exe

D:\Windows\system32\services.exe

D:\Windows\system32\lsass.exe

D:\Windows\system32\lsm.exe

D:\Windows\system32\svchost.exe

D:\Windows\system32\svchost.exe

D:\Windows\System32\svchost.exe

D:\Windows\System32\svchost.exe

D:\Windows\System32\svchost.exe

D:\Windows\system32\SLsvc.exe

D:\Windows\system32\svchost.exe

D:\Windows\system32\svchost.exe

D:\Windows\system32\Dwm.exe

D:\Windows\Explorer.EXE

D:\Program Files\Windows Defender\MSASCui.exe

D:\Program Files\ESET\nod32kui.exe

D:\Program Files\Spyware Terminator\Spywareterminatorshield.Exe

D:\Program Files\a-squared Free\a2service.exe

D:\Windows\system32\svchost.exe

D:\Program Files\Spyware Terminator\sp_rsser.exe

D:\Windows\system32\svchost.exe

D:\Windows\System32\svchost.exe

D:\Windows\system32\SearchIndexer.exe

D:\Program Files\iPod\bin\iPodService.exe

D:\Windows\system32\wbem\unsecapp.exe

D:\Windows\system32\Taskmgr.exe

D:\Windows\system32\conime.exe

D:\Program Files\Windows Sidebar\sidebar.exe

D:\Program Files\MSN Messenger\usnsvc.exe

D:\Windows\system32\svchost.exe

D:\Program Files\Eset\nod32krn.exe

D:\Windows\system32\svchost.exe

D:\Windows\System32\spoolsv.exe

D:\Windows\system32\taskeng.exe

D:\Windows\system32\taskeng.exe

D:\Program Files\Internet Explorer\iexplore.exe

D:\Program Files\WinRAR\WinRAR.exe

D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

D:\Program Files\Spyware Doctor\swdsvc.exe

D:\Program Files\Spyware Doctor\SDTrayApp.exe

D:\Program Files\Spyware Doctor\svcntaux.exe

D:\Program Files\MSN Messenger\msnmsgr.exe

D:\Users\Louis\Downloads\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [spywareTerminator] "D:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [00PCTFW] "D:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s

O4 - HKLM\..\Run: [sDTray] "D:\Program Files\Spyware Doctor\SDTrayApp.exe"

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - D:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)

O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - D:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)

O10 - Unknown file in Winsock LSP: d:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: d:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-BE/a-UNO1/GAME_UNO1.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock...ash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Bonjour Service - Unknown owner - D:\Program Files\Bonjour\mDNSResponder.exe (file missing)

O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe

O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - D:\Program Files\PC Tools Firewall Plus\FWService.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - D:\Program Files\Spyware Terminator\sp_rsser.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

[WawaSeb]

Bonjour Thurzaz,

 

*** Bienvenue sur le forum sécurité de Zebulon ! ***

 

A priori, tu n'es pas infecté... mais je vois que tu es sous Windows Vista !

 

 

qq'un prend possesion de mon adresse mail et je me demandais si ce n'étais pas à cause d'un spyware

--> Comment sais-tu qu'il prend possession de ton adresse e-mail ?

 

 

1) Télécharge Blacklight (de F-Secure)

 

et sauvegarde-le sur ton Bureau.

 

Double-clique blfsbl.exe et accepte la licence ; laisse [X]scan through Windows Explorer activé ; clique Scan puis Next

 

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres).

 

Copie / colle le contenu de ce rapport dans ta prochaine réponse

 

 

# Rencontres-tu d'autres problèmes particuliers sur ton PC ?

 

@ très bientôt !

[Thurzaz]

Un tt grand merci, je ferai ce que tu me dit de faire qd je rentrerais, parce que je ne vais pas avoir accès à internet pdt qqs temps.

Merci des conseils

A+