HijackThis

gripette22 · le 23 mai 2010

Bonsoir à tous,

Depuis quelques jours mon pc n'ouvre pas les sessions, message de firefox: adresse invalide, des adresses que j'utilise toujours.

Pour en avoir le coeur net, j'ai passé un scan en ligne plus Spyboot, plus malwarebyte, il y avait bien deux malware que j'ai détruit. Voilà que mon pc n'est pas beaucoup plus en santé, j'ai dont fait un rapport hijackthis, y'a-t-il des pros qui peuvent me l'interpréter SVP car moi je n'y comprends rien ... je remercie à l'avance ceux ou celles qui voudront bien y jeter un coup d'oeil.

------------------------

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:38:03, on 2010-05-23

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programmi\Java\jre6\bin\jusched.exe

C:\Programmi\Avira\AntiVir Desktop\avgnt.exe

C:\PROGRA~1\ALICET~1\SMARTB~2\MotiveSB.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\Messenger\msmsgs.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Programmi\OpenOffice.org 3\program\soffice.exe

C:\Programmi\OpenOffice.org 3\program\soffice.bin

C:\Programmi\Alice ti aiuta\bin\mpbtn.exe

C:\Programmi\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propretario\Documenti\Téléchargements\HiJackThis.exe

C:\Documents and Settings\Propretario\Documenti\Téléchargements\HijackThis(2).exe

C:\WINDOWS\system32\msfeedssync.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~2\MotiveSB.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 3.1.lnk = C:\Programmi\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: Alice ti aiuta.lnk = C:\Programmi\Alice ti aiuta\bin\matcli.exe

O4 - Global Startup: hpoddt01.exe.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{E39154D4-86AA-439F-B9F4-F98B7FEAD3A1}: NameServer = 85.37.17.5 85.38.28.77

O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 5297 bytes

Apollo · le 23 mai 2010

Bonsoir,

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Important :
* Sous Vista : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

* Sous Windows 7 : Il faut mettre le fichier RSIT.exe sur le bureau, faire un clic droit dessus et dans Propriétés, onglet Compatibilité, cocher la case "Exécuter ce programme en mode compatibilité pour" et dans le menu choisir Vista SP2 et la case dans Niveau de privilège.
Valide par Appliquer.
Clique Continue à l'écran Disclaimer.
Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

@++

gripette22 · le 23 mai 2010

Bonsoir et un gros merci pour ton aide,

Voici les rapports demandés, je m'aperçois qu'il y a des commentaires en italien dans le rapport, j'ai pas le choix j'habite en Italie (mais je suis québécoise)... j'espère que cela ne te posera pas de problèmes.

J'espère que j'ai tout fait correct !!!

_______________________

info.txt logfile of random's system information tool 1.06 2010-05-24 01:01:50

======Uninstall list======

-->C:\PROGRA~1\ALICET~1\Uninstall.exe AliceRE

-->MsiExec /X{DEA314C4-0929-4250-BC92-98E4C105F28D}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

Ad-Aware Email Scanner for Outlook-->MsiExec.exe /I{338F08AB-C262-42C7-B000-34DE1A475273}

Ad-Aware-->"C:\Documents and Settings\All Users\Dati applicazioni\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe" REMOVE=TRUE MODIFY=FALSE

Ad-Aware-->C:\Documents and Settings\All Users\Dati applicazioni\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}\Ad-AwareInstaller.exe

Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -maintain activex

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin

Adobe Reader 9.3.2 - Italiano-->MsiExec.exe /I{AC76BA86-7AD7-1040-7B44-A93000000001}

Aggiornamento della protezione per Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

Aggiornamento della protezione per Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"

Aggiornamento per Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"

Aggiornamento per Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"

Alice ti aiuta-->C:\Programmi\Alice ti aiuta\bin\UninstallAlice.exe

Atheros Communications Inc.® AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver-->"C:\Programmi\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\Setup.exe" -runfromtemp -l0x0010 -removeonly

Avira AntiVir Personal - Free Antivirus-->C:\Programmi\Avira\AntiVir Desktop\setup.exe /REMOVE

CCleaner-->"C:\Programmi\CCleaner\uninst.exe"

Disco ricordo HP-->MsiExec.exe /X{B376402D-58EA-45EA-BD50-DD924EB67A70}

Foto e imaging HP 2.0 - All-in-One Drivers-->MsiExec.exe /X{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}

Foto e imaging HP 2.0 - All-in-One-->MsiExec.exe /X{9867A917-5D17-40DE-83BA-BEA5293194B1}

High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"

HijackThis 2.0.2-->"C:\Documents and Settings\Propretario\Documenti\Téléchargements\HijackThis.exe" /uninstall

Installazione Guidata Alice-->RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programmi\InstallShield Installation Information\{AE141553-8A8C-467D-B2E9-A352F1141508}\setup.exe" -l0x10 -uninst

Java 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}

Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Mozilla Firefox (3.5.9)-->C:\Programmi\Mozilla Firefox\uninstall\helper.exe

Nero 6 Ultra Edition-->C:\Programmi\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL

NVIDIA Display Control Panel-->C:\Programmi\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel

NVIDIA Drivers-->C:\Programmi\NVIDIA Corporation\Uninstall\nvuninst.exe UninstallGUI

NVIDIA nView Desktop Manager-->C:\Programmi\NVIDIA Corporation\nView\nViewSetup.exe -uninstall

NVIDIA PhysX-->MsiExec.exe /X{DEA314C4-0929-4250-BC92-98E4C105F28D}

OpenOffice.org 3.1-->MsiExec.exe /I{43A650AA-D1DC-4C52-8819-D7848B3A08DA}

Picasa 3-->"C:\Programmi\Google\Picasa3\Uninstall.exe"

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FILECO~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programmi\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x10 -removeonly

Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}

Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""

VLC media player 1.0.5-->C:\Programmi\VideoLAN\VLC\uninstall.exe

Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray-->"C:\WINDOWS\$NtUninstallKB952011$\spuninst\spuninst.exe"

Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"

Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"

WinRAR gestione archivi-->C:\Programmi\WinRAR\uninstall.exe

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: UTENTE

Event Code: 3260

Message: Il computer è stato aggiunto a workgroup 'WORKGROUP'.

Record Number: 5

Source Name: Workstation

Time Written: 20100514101753.000000+120

Event Type: Informazione

User:

Computer Name: UTENTE

Event Code: 6011

Message: Il nome NetBIOS e il nome host DNS del computer sono stati modificati da MACHINENAME in UTENTE.

Record Number: 4

Source Name: EventLog

Time Written: 20100514101711.000000+120

Event Type: Informazione

User:

Computer Name: MACHINENAME

Event Code: 2

Message: Nel controllo che \Device\Serial0 fosse effettivamente una porta seriale è stata rilevata una coda fifo (first in, first out). Questa verrà utilizzata.

Record Number: 3

Source Name: Serial

Time Written: 20100514121243.000000+120

Event Type: Informazione

User:

Computer Name: MACHINENAME

Event Code: 6005

Message: Il servizio Registro eventi è stato avviato.

Record Number: 2

Source Name: EventLog

Time Written: 20100514121221.000000+120

Event Type: Informazione

User:

Computer Name: MACHINENAME

Event Code: 6009

Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1

Source Name: EventLog

Time Written: 20100514121221.000000+120

Event Type: Informazione

User:

=====Application event log=====

Computer Name: UTENTE

Event Code: 1000

Message: I contatori delle prestazioni per il servizio MSDTC (MSDTC) sono stati caricati.

I Dati del record contengono nuovi valori di indice assegnati

al servizio.

Record Number: 5

Source Name: LoadPerf

Time Written: 20100514101903.000000+120

Event Type: Informazione

User:

Computer Name: UTENTE

Event Code: 1000

Message: I contatori delle prestazioni per il servizio TermService (Servizi terminal) sono stati caricati.

I Dati del record contengono nuovi valori di indice assegnati

al servizio.

Record Number: 4

Source Name: LoadPerf

Time Written: 20100514101900.000000+120

Event Type: Informazione

User:

Computer Name: UTENTE

Event Code: 1000

Message: I contatori delle prestazioni per il servizio RemoteAccess (Routing e Accesso remoto) sono stati caricati.

I Dati del record contengono nuovi valori di indice assegnati

al servizio.

Record Number: 3

Source Name: LoadPerf

Time Written: 20100514101743.000000+120

Event Type: Informazione

User:

Computer Name: UTENTE

Event Code: 1000

Message: I contatori delle prestazioni per il servizio PSched (PSched) sono stati caricati.

I Dati del record contengono nuovi valori di indice assegnati

al servizio.

Record Number: 2

Source Name: LoadPerf

Time Written: 20100514101720.000000+120

Event Type: Informazione

User:

Computer Name: UTENTE

Event Code: 1000

Message: I contatori delle prestazioni per il servizio RSVP (QoS RSVP) sono stati caricati.

I Dati del record contengono nuovi valori di indice assegnati

al servizio.

Record Number: 1

Source Name: LoadPerf

Time Written: 20100514101719.000000+120

Event Type: Informazione

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=c:\Programmi\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel

"PROCESSOR_REVISION"=0f0b

"NUMBER_OF_PROCESSORS"=4

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Logfile of random's system information tool 1.07 (written by random/random)

Run by Propretario at 2010-05-24 01:01:45

Microsoft Windows XP Professional Service Pack 2

System drive C: has 464 GB (97%) free of 477 GB

Total RAM: 3327 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 01:01:49, on 2010-05-24

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programmi\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programmi\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programmi\Java\jre6\bin\jusched.exe

C:\Programmi\Avira\AntiVir Desktop\avgnt.exe

C:\PROGRA~1\ALICET~1\SMARTB~2\MotiveSB.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programmi\Messenger\msmsgs.exe

C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Programmi\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\Programmi\Lavasoft\Ad-Aware\AAWTray.exe

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Propretario\Documenti\Téléchargements\RSIT(2).exe

C:\Programmi\trend micro\Propretario.exe