Votre question

Analyse Hijackthis et autres rapports

Tags :
  • Hijackthis
  • Sécurité
Dernière réponse : dans Sécurité et virus
5 Août 2010 16:18:08

Bonjour,

mon ordinateur reboot sans cesse, il ne démarre normalement qu'en mode sans échec... probablement un virus...

J'ai procédé à quelques analyses,dont hijackthis.

Ma question est :

et maintenant je fais quoi?

Voici les rapports (OTM, Ad-remover, Hijackthis), merci pour vos réponses:



Rapport OTM

All processes killed
Error: Unable to interpret <:p rocess> in the current context!
========== FILES ==========
File/Folder C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage not found.
File/Folder siszpe32.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Utilisateur^Menu Démarrer^Programmes^Démarrage^siszpe32.exe\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: JenFi
->Temp folder emptied: 885126275 bytes
->Temporary Internet Files folder emptied: 18400360 bytes
->Java cache emptied: 3410263 bytes
->Flash cache emptied: 58924 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 402 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 3548767 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 100767034 bytes
RecycleBin emptied: 169412333 bytes

Total Files Cleaned = 1 126,00 mb


OTM by OldTimer - Version 3.1.15.0 log created on 07272010_140116

Les 2 Rapport AD-REMOVER :



======= RAPPORT D'AD-REMOVER 2.0.0.1,D | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 21/07/10 à 14:00
Contact: AdRemover.contact[AT]gmail.com
Site web: Ad_Remover

C:\Program Files\Ad-Remover\main.exe (SCAN [1]) -> Lancé à 14:15:58 le 27/07/2010, Mode sans echec

Microsoft Windows XP Professionnel (X86)
JenFi@JENFI-SJFC15MNU ( )

============== RECHERCHE ==============



1,Clé trouvée: HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
1,Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
1,Clé trouvée: HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}

0,Valeur trouvée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
0,Valeur trouvée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}


============== SCAN ADDITIONNEL ==============

** Internet Explorer Version [6.0.2600.0000] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\System32\blank.htm
Search bar: hxxp://www.google.com/ie
Search Page: hxxp://www.google.com
Show_ToolBar: yes
Start Page: hxxp://www.google.fr/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...
Default_Search_URL: hxxp://www.google.com/ie
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 0 Fichier(s)

C:\Ad-Report-SCAN[1].txt - 27/07/2010 (444 Octet(s))

Fin à: 14:21:56, 27/07/2010

============== E.O.F ==============






2nd rapport ad-remover (option nettoyer)





======= RAPPORT D'AD-REMOVER 2.0.0.1,D | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 21/07/10 à 14:00
Contact: AdRemover.contact[AT]gmail.com
Site web: Ad_Remover

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 14:24:20 le 27/07/2010, Mode sans echec

Microsoft Windows XP Professionnel (X86)
JenFi@JENFI-SJFC15MNU ( )

============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.


1,Clé supprimée: HKLM\Software\Classes\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
1,Clé supprimée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}
1,Clé supprimée: HKLM\Software\Classes\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}

0,Valeur supprimée: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}
0,Valeur supprimée: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{FE063DB9-4EC0-403E-8DD8-394C54984B2C}


============== SCAN ADDITIONNEL ==============

** Internet Explorer Version [6.0.2600.0000] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnh...
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\System32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no

[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 0 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 27/07/2010 (489 Octet(s))
C:\Ad-Report-SCAN[1].txt - 27/07/2010 (2222 Octet(s))

Fin à: 14:28:40, 27/07/2010

============== E.O.F ==============

Le rapport MBAM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4052

Windows 5.1.2600 (Safe Mode)
Internet Explorer 6.0.2600.0000

28/07/2010 02:06:09
mbam-log-2010-07-28 (02-06-09).txt

Type d'examen: Examen complet (C:\|E:\|)
Elément(s) analysé(s): 232335
Temps écoulé: 1 heure(s), 15 minute(s), 33 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 26

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\ib4.cbrowserhelper (Spyware.Sters) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{da201b5b-5b75-4ecb-b77f-143b49a7a066} (Spyware.Sters) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ntio256 (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe ) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\websvr (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\dlls (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\sessiondata (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\uploadtemp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\myAdmin (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\upload (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\user (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\user\admin (Malware.Trace) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\websvr\map.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\php.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\php4ts.dll (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\dlls\php_sockets.dll (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\addIns\Php\dlls\readme.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\!HDD by HTTP.html (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\phpinfo.php (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\myAdmin\Download phpmyadmin from sourceforge into this dir.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\BACK.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\BLANK.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\COMPRESSED.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\dnserror.htm (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\dnserror_de.htm (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\FILE.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\FOLDER.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\HTML.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\PAGERROR.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\PHP.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\PICTURE.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\REFRESH.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\system\UPFOLDER.gif (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\upload\mscreate.dir (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\user\test.htm (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\websvr\htdocs\user\admin\htaccess.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kr_done1 (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\JenFi\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

Et enfin, le rapport Hijack this


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 02:12:18, on 28/07/2010
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\JenFi\Bureau\Sécurité\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN : Hotmail, Messenger, Bing, Actualité et Sport
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\Program Files\Antivirus\Norton Pro\vptray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\photo\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Documents and Settings\JenFi\Bureau\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Documents and Settings\JenFi\Bureau\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: siszpe32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe (User 'Default user')
O4 - .DEFAULT Startup: siszpe32.exe (User 'Default user')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: siszpe32.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: ~Disabled
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - Orange : téléphones, forfaits mobiles, Internet, actualité, sport, video (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {72D59B9C-1E59-4958-803A-ABDEE2D4CFA6} - http://download.divx...erInstaller.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{140D2711-6825-460F-B364-218C206EDB7C}: NameServer = 80.10.246.2,80.10.246.130
O17 - HKLM\System\CCS\Services\Tcpip\..\{DAA07E1A-D7CC-4BA5-AC22-B00A513EA531}: NameServer = 81.253.149.1 80.10.246.3
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: ADSLAutoconnect - Unknown owner - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Antivirus\Norton Pro\defwatch.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: DDE réseau (NetDDE) - Unknown owner - C:\WINDOWS\system32\netdde.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Antivirus\Norton Pro\rtvscan.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: Prise en charge des cartes à puces (SCardDrv) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

--
End of file - 7680 bytes

Autres pages sur : analyse hijackthis rapports

6 Août 2010 19:16:04

Salut,

On va analyser un peu plus en profondeur :
  • Télécharge OTL (de OldTimer) sur ton Bureau.
  • Double-clique sur OTL pour le lancer.
    (Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)
  • Une fenêtre apparaît. Dans la section Rapport en haut de cette fenêtre, coche Rapport minimal.
  • Dans la section "Analyse des fichiers", "Âge du fichier", met 30 jours
  • Coche également les cases à côté de Recherche Lop et Recherche Purity.
  • Enfin, clique sur le bouton Analyse. Le scan ne prendra pas beaucoup de temps.
  • Une fois l'analyse terminée, deux fenêtres vont s'ouvrir dans le Bloc-notes : OTL.txt et Extras.txt. Ils se trouvent au même endroit que OTL (donc par défaut sur le Bureau).

    Pour me transmettre les rapports :
  • Clique sur ce lien : http://www.cijoint.fr/
  • Clique sur Parcourir... et cherche le fichier du rapport que tu souhaites me transmettre.
  • Clique sur Ouvrir.
  • Clique sur Cliquez ici pour déposer le fichier.
  • Un lien de cette forme, hxxp://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt, est ajouté dans la page.
  • Copie-colle ce lien dans ta réponse.
    Tom's guide dans le monde
    • Allemagne
    • Italie
    • Irlande
    • Royaume Uni
    • Etats Unis
    Suivre Tom's Guide
    Inscrivez-vous à la Newsletter
    • ajouter à twitter
    • ajouter à facebook
    • ajouter un flux RSS