analyse hijack this et rapport ewido

xelfer · le 2 avril 2006

Bonjour,

j'ai suivi pour chaque point le topic de désinfection facile de tasgaz

et j'ai ensuite fait une analyse avec hijack et un scan avec ewido pour savoir si il reste des manipulations a faire (surement ).

voice pour hijack

Logfile of HijackThis v1.99.1

Scan saved at 15:51:43, on 02/04/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msiexec.exe

C:\Documents and Settings\moreau\Bureau\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - AutorunsDisabled - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - Global Startup: Sagem - Utilitaire réseau pour Clé USB Wi-Fi 802.11g.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{34475C94-AB2F-4DF6-A824-CC5DBA0717CC}: NameServer = 80.10.246.2,80.10.126.129

O17 - HKLM\System\CS2\Services\Tcpip\..\{34475C94-AB2F-4DF6-A824-CC5DBA0717CC}: NameServer = 80.10.246.2,80.10.126.129

O17 - HKLM\System\CS3\Services\Tcpip\..\{34475C94-AB2F-4DF6-A824-CC5DBA0717CC}: NameServer = 80.10.246.2,80.10.126.129

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - AppInit_DLLs: MsgPlusLoader.dll

O20 - Winlogon Notify: htproc - htproc32.dll (file missing)

O20 - Winlogon Notify: ldr64 - ldr64.dll (file missing)

O20 - Winlogon Notify: ssldr - ssldr32.dll (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

et voice le rapport de ewido:

:mozilla.37:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder

:mozilla.38:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Adtech : Nettoyer et sauvegarder

:mozilla.169:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Estat : Nettoyer et sauvegarder

:mozilla.376:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder

:mozilla.377:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder

:mozilla.378:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder

:mozilla.408:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder

:mozilla.556:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Onestat : Nettoyer et sauvegarder

:mozilla.557:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Onestat : Nettoyer et sauvegarder

:mozilla.583:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder

:mozilla.724:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder

:mozilla.725:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder

:mozilla.726:C:\Documents and Settings\moreau\Application Data\Mozilla\Firefox\Profiles\oobhculk.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder

voila

chuki · le 2 avril 2006

Salut

Fait un scan avec adaware et spybot et un scan sur http://www.secuser.com/antivirus/index.htm

voila ensuite refait un rapport hijackthis

lien pour telecharger adaware http://www.01net.com/telecharger/windows/I...ches/11643.html

lien pour telecharger spybot

http://www.01net.com/telecharger/windows/I...ches/26157.html

a+

xelfer · le 2 avril 2006

merci de ta répose

voici la nouvelle analyse d'hijack

Logfile of HijackThis v1.99.1

Scan saved at 18:07:36, on 02/04/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe

C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe

C:\Documents and Settings\moreau\Bureau\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - AutorunsDisabled - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background