[Résolu] Ordi infecté : comment interpréter le rapport ?

thetennisman · le 6 juin 2005

salut a tous :-P

je vais pas etre original mais est ce que vous pourriez m'aidez a decripter ce log. :-(

Logfile of HijackThis v1.99.1

Scan saved at 14:58:03, on 06/06/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2

(6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers

communs\EPSON\EBAPI\eEBSVC.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\dllhost.exe

C:\Program Files\Fichiers

communs\EPSON\EBAPI\SAgent2.exe

C:\WINDOWS\system32\oodag.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_

S10IC2.EXE

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program

Files\Thrustmaster\Thrustmapper\TMTMTSR.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Fichiers

communs\Real\Update_OB\realsched.exe

C:\Program

Files\Logitech\MouseWare\system\em_exec.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\outils\cacheman\Cacheman\Cacheman

.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\outils\memturbo\memturbo.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\WINDOWS\system32\cidaemon.exe

C:\DOCUME~1\laurence\LOCALS~1\Temp\Rar$EX00.6

56\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Bar =

http://mhiamfeyvyq.com/VO3nSjuy1bkIPve3diArhR

3FkRNNqAM3YPJLS9YkD_yQNS4jUhwLcd3bcEAWuUa5.ht

ml

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Yahoo! Companion BHO -

{02478D38-C3F9-4efb-9B51-7695ECA05670} -

C:\Program

Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_

18_0.dll

O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

c:\program files\outils\adoble

acrobat\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Yahoo! Compagnon -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} -

C:\Program

Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_

18_0.dll

O3 - Toolbar: &Google -

{2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [ATIPTA] C:\Program

Files\ATI Technologies\ATI Control

Panel\atiptaxx.exe

O4 - HKLM\..\Run: [NeroCheck]

C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [Logitech Utility]

Logi_MwX.Exe

O4 - HKLM\..\Run: [Microsoft Windows Update]

wupdate.exe

O4 - HKLM\..\Run: [QuickTime Task]

"C:\program

files\outils\quicktime\qttask.exe"

-atboottime

O4 - HKLM\..\Run: [KernelFaultCheck]

%systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [EPSON Stylus CX3200]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_

S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6

"USB001" /M "Stylus CX3200"

O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe

stmctrl.dll,TaskBar

O4 - HKLM\..\Run: [AVG7_CC]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

/STARTUP

O4 - HKLM\..\Run: [ThrustTSR] C:\Program

Files\Thrustmaster\Thrustmapper\TMTMTSR.exe

O4 - HKLM\..\Run: [LVCOMSX]

C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair]

C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray]

C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program

Files\Fichiers

communs\Real\Update_OB\realsched.exe"

-osboot

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\RunServices: [Microsoft Windows

Update] wupdate.exe

O4 - HKCU\..\Run: [CTFMON.EXE]

C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Microsoft Windows Update]

wupdate.exe

O4 - HKCU\..\Run: [Cacheman]

C:\PROGRA~1\outils\cacheman\Cacheman\Cacheman

.exe

O4 - HKCU\..\Run: [LDM] \Program\

O4 - HKCU\..\Run: [LogitechSoftwareUpdate]

"C:\Program

Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [msnmsgr] "C:\Program

Files\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: MemTurbo.lnk = C:\Program

Files\outils\memturbo\memturbo.exe

O4 - Global Startup: Logitech Desktop

Messenger.lnk = C:\Program

Files\Logitech\Desktop

Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: MemTurbo.lnk =

C:\Program Files\outils\memturbo\memturbo.exe

O8 - Extra context menu item: &Google Search

- res://c:\program

files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: E&xporter vers

Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE

/3000

O8 - Extra context menu item: Pages liées -

res://c:\program

files\google\GoogleToolbar1.dll/cmbacklinks.h

tml

O8 - Extra context menu item: Pages

similaires - res://c:\program

files\google\GoogleToolbar1.dll/cmsimilar.htm

l

O8 - Extra context menu item: Version de la

page actuelle disponible dans le cache Google

- res://c:\program

files\google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program

Files\Java\j2re1.4.2\bin\npjpi142.dll

O9 - Extra 'Tools' menuitem: Console Java

(Sun) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program

Files\Java\j2re1.4.2\bin\npjpi142.dll

O9 - Extra button: Recherche -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O12 - Plugin for .spop: C:\Program

Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: RaptisoftGameLoader -

http://www.miniclip.com/hamsterball/raptisoft

gameloader.cab

O16 - DPF:

{00B71CFB-6864-4346-A978-C0A14556272C}

(Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr

.cab31267.cab

O16 - DPF:

{14B87622-7E19-4EA8-93B3-97215F77A6BC}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Messenge

rStatsPAClient.cab31267.cab

O16 - DPF:

{288C5F13-7E52-4ADA-A32E-F5BF9D125F98}

(CR64Loader Object) -

http://www.miniclip.com/bestfriends/miniclipG

ameLoader.dll

O16 - DPF:

{2917297F-F02B-4B9D-81DF-494B6333150B}

(Minesweeper Flags Class) -

http://messenger.zone.msn.com/binary/MineSwee

per.cab31267.cab

O16 - DPF:

{3AE9ED90-4B59-47A0-873B-7B71554B3C3E}

(JoystickCtl Class) -

http://www.neodelight.com/_games//supersoccer

/joystick.cab

O16 - DPF:

{3FE16C08-D6A7-4133-84FC-D5BFB4F7D886}

(WebGameLoader Class) -

http://www.miniclip.com/ricochet/ReflexiveWeb

GameLoader.cab

O16 - DPF:

{402EE96E-2CE8-482D-ADA5-CECEEA07E16D}

(TurnTool Scene) -

http://www.turntool.com/ViewerInstall.exe

O16 - DPF:

{4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN

Photo Upload Tool) -

http://spaces.msn.com//PhotoUpload/MsnPUpld.c

ab

O16 - DPF:

{62475759-9E84-458E-A1AB-5D2C442ADFDE} -

http://a1540.g.akamai.net/7/1540/52/20040428/

qtinstall.info.apple.com/saba/fr/win/QuickTim

eInstaller.exe

O16 - DPF:

{86EEF11E-FF16-48CE-B1A2-474B663041A9} -

http://kit.carpediem.fr/12955/CD/LeDortoir.ex

e

O16 - DPF:

{8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

(MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Messenge

rStatsClient.cab31267.cab

O16 - DPF:

{B38870E4-7ECB-40DA-8C6A-595F0A5519FF}

(MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/msnmessenge

rsetupdownloader.cab

O16 - DPF:

{B8BE5E93-A60C-4D26-A2DC-220313175592}

(ZoneIntro Class) -

http://messenger.zone.msn.com/binary/ZIntro.c

ab32846.cab

O16 - DPF:

{C5E28B9D-0A68-4B50-94E9-E8F6B4697519}

(NsvPlayX Control) -

http://www.nullsoft.com/nsv/embed/nsvplayx_vp

6_aac.cab

O16 - DPF:

{D719897A-B07A-4C0C-AEA9-9B663A28DFCB}

(iTunesDetector Class) -

http://ax.phobos.apple.com.edgesuite.net/dete

ction/ITDetector.cab

O16 - DPF:

{F6BF0D00-0B2A-4A75-BF7B-F385591623AF}

(Solitaire Showdown Class) -

http://messenger.zone.msn.com/binary/Solitair

eShowdown.cab31267.cab

O16 - DPF:

{FA3662C3-B8E8-11D6-A667-0010B556D978}

(IWinAmpActiveX Class) -

http://cdn.digitalcity.com/_media/dalaillama/

ampx.cab

O17 -

HKLM\System\CCS\Services\Tcpip\..\{46949591-0

88D-4819-BC58-601665F9E354}: NameServer =

212.27.54.252 213.228.0.212

O18 - Protocol: bw+0 -

{06E34D78-BFE2-4F47-9B90-A2273018DAE5} -