hijack pas de probleme?

[furious51]

J ai pas mal de pb de spy qui revienne je poste mon hijack:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:22:26, on 27/10/2007

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16546)

Boot mode: Normal

 

Running processes:

V:\Windows\system32\Dwm.exe

V:\Windows\Explorer.EXE

V:\Windows\system32\taskeng.exe

V:\Program Files\Alwil Software\Avast4\ashDisp.exe

V:\Windows\RtHDVCpl.exe

V:\Acer\Empowering Technology\SysMonitor.exe

V:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

V:\Windows\Vm_sti.exe

V:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

V:\Program Files\MagicRotation\MagicPvt.exe

V:\Windows\System32\oodtray.exe

V:\Windows\System32\rundll32.exe

V:\Program Files\Windows Sidebar\sidebar.exe

V:\Windows\ehome\ehtray.exe

V:\Program Files\Wallpaper\Wallpaper.exe

V:\Program Files\Windows Media Player\wmpnscfg.exe

V:\Program Files\MagicTune Premium\GammaTray.exe

V:\Windows\System32\mobsync.exe

V:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

V:\Windows\ehome\ehmsas.exe

V:\Windows\System32\rundll32.exe

V:\Program Files\Logitech\SetPoint\SetPoint.exe

V:\Program Files\SEC\Natural Color\NaturalColorLoad.exe

V:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE

V:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

V:\Program Files\Internet Explorer\iexplore.exe

V:\Windows\system32\conime.exe

V:\Program Files\Internet Explorer\iexplore.exe

V:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

V:\Program Files\Trend Micro\HijackThis\HijackThis.exe

V:\PROGRA~1\MOZILL~1\FIREFOX.EXE

V:\Windows\system32\DllHost.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - V:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - V:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - V:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - V:\Windows\system32\ActiveToolBand.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - V:\Windows\system32\eDStoolbar.dll

O4 - HKLM\..\Run: [avast!] V:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] V:\Acer\Empowering Technology\SysMonitor.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] V:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

O4 - HKLM\..\Run: [bigDogPath] V:\Windows\VM_STI.EXE VIMICRO USB PC Camera

O4 - HKLM\..\Run: [NeroFilterCheck] V:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "V:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [MagicRotation] V:\Program Files\MagicRotation\MagicPvt.exe

O4 - HKLM\..\Run: [OODefragTray] V:\Windows\system32\oodtray.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE V:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE V:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE V:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [sidebar] V:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [ehTray.exe] V:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Wallpaper] "V:\Program Files\Wallpaper\Wallpaper.exe" Starter

O4 - HKCU\..\Run: [WMPNSCFG] V:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [AlcoholAutomount] "V:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Global Startup: Empowering Technology Launcher.lnk = V:\Acer\Empowering Technology\eAPLauncher.exe

O4 - Global Startup: GammaTray.lnk = ?

O4 - Global Startup: Logitech Desktop Messenger.lnk = V:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: NaturalColorLoad.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://V:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - V:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - V:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - V:\Windows\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - V:\Windows\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - V:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab

O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - V:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "V:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)

O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - V:\Windows\System32\DreamScene.dll

O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - V:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DesktopControlPanel.dll

O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - V:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll

O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - V:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - V:\Program Files\a-squared Free\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - V:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - V:\Acer\Empowering Technology\ePerformance\MemCheck.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - V:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - V:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - V:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - V:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: CCSNKECERJGQ - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\CCSNKECERJGQ.exe (file missing)

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - V:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - V:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe

O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - V:\Acer\Empowering Technology\eDataSecurity\eDSService.exe

O23 - Service: HDDlife HDD Access service - BinarySense, Ltd. - V:\Program Files\BinarySense\HDDlife 3\hldasvc.exe

O23 - Service: IBPZFGVPYMRX - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\IBPZFGVPYMRX.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - V:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - V:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: O&O Defrag - O&O Software GmbH - V:\Windows\system32\oodag.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - V:\Program Files\WinPcap\rpcapd.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - V:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: WGQ - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\WGQ.exe (file missing)

 

--

End of file - 9908 bytes

[Invité JoK]

Bonjour.

 

Désinstalleer => Logitech Desktop Messenger. Rien d'autre de chez Logitech.

 

Ensuite vous allez créer un nouvel utilisateur, que vous laisserez administrateur. Quitter votre session, puis identifiez vous sous le nouvel utilisateur créé.

Basculez votre compte normal, en compte utilisateur standard.

 

http://forum.zebulon.fr/index.php?showtopic=128930

 

Vous trouverez sur ce sujet, pas mal d'infos et explications.

 

Bonne lecture.

 

Vous pouvez "fixer" ces lignes.

 

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O23 - Service: CCSNKECERJGQ - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\CCSNKECERJGQ.exe (file missing)

O23 - Service: IBPZFGVPYMRX - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\IBPZFGVPYMRX.exe (file missing)

O23 - Service: WGQ - Unknown owner - V:\Users\BILLVI~1\AppData\Local\Temp\WGQ.exe (file missing)

Modifié le 27 octobre 2007 par JoK