|
|
|
|
Configuration: Windows 2000 Internet Explorer 6.0
J'ai effectué un scan avec HiJackThis et voilà le log si une personne peut m'expliquer ce qu'il faut faire.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:30:42, on 24/10/2007 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINNT\system32\svchost.exe C:\Program Files\Reverso\Reverso Translation Server\LogoMedia TranslateDotNet Server.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\UStorSrv.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\SCardSvr.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINNT\system32\dla\tfswctrl.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\WINNT\system32\RunDLL32.exe C:\WINNT\system32\internat.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\system32\wuauclt.exe C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe C:\WINNT\TEMP\ZV5E28.EXE C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe C:\Program Files\Trend Micro\OfficeScan Client\PCCNTMON.EXE C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\alfred.mats\Bureau\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/index.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O1 - Hosts: 185.2.7.160 jb1hi048 O1 - Hosts: 185.2.7.160 jtt.dns O1 - Hosts: 185.2.112.23 jb1ib056 O1 - Hosts: 185.2.112.152 jb1hi029 O1 - Hosts: 131.14.1.4 ntfile14 O1 - Hosts: 170.71.13.10 jb1xe042 O1 - Hosts: 170.71.201.7 ntfile13 O1 - Hosts: 170.80.201.48 ntfile06 O1 - Hosts: 185.2.1.5 jb1ib145 O1 - Hosts: 185.2.1.49 jb1ib172 O1 - Hosts: 185.2.7.14 jb1hp262 O1 - Hosts: 185.2.7.26 do-ma O1 - Hosts: 185.2.7.38 jb1hp283 O1 - Hosts: 185.2.7.42 ntfile12 O1 - Hosts: 185.2.7.64 jb1hp263 O1 - Hosts: 185.2.7.70 jb1co081 O1 - Hosts: 185.2.7.72 jb1hp327 O1 - Hosts: 185.2.7.162 jb1ib188 O1 - Hosts: 185.2.25.5 jb1ib177 O1 - Hosts: 185.2.25.6 ntfile09 O1 - Hosts: 185.2.70.3 jb1na001 O1 - Hosts: 185.2.70.7 jb1xe005 O1 - Hosts: 185.2.70.8 jb1hp074 O1 - Hosts: 185.2.70.10 jb1hk002 O1 - Hosts: 185.2.70.14 jb1un005 O1 - Hosts: 185.2.70.19 jb1hp098 O1 - Hosts: 185.2.70.23 jb1hk001 O1 - Hosts: 185.2.70.78 jb1to020 O1 - Hosts: 185.2.70.153 jb1hp203 O1 - Hosts: 185.2.70.181 jb1hp182 O1 - Hosts: 185.2.80.11 ntfile08 O1 - Hosts: 185.2.80.11 ntfile11 O1 - Hosts: 185.2.80.15 ntfile07 O1 - Hosts: 185.2.96.3 jb1ib178 O1 - Hosts: 185.2.96.30 dmnas01 O1 - Hosts: 185.2.96.37 m27srv1 O1 - Hosts: 185.2.109.20 jb1ib149 O1 - Hosts: 185.2.109.21 jb1hi027 O1 - Hosts: 185.2.110.2 jb1ai001 O1 - Hosts: 185.2.112.13 jb1hp184 O1 - Hosts: 185.2.112.24 e-space O1 - Hosts: 185.2.112.26 jb1ib100 O1 - Hosts: 185.2.112.34 jb1ib053 O1 - Hosts: 185.2.112.41 jb1hp323 O1 - Hosts: 185.2.112.42 jb1hp324 O1 - Hosts: 185.2.112.43 jb1hp325 O1 - Hosts: 185.2.112.175 jb1hp259 O1 - Hosts: 185.2.113.6 jb1hi021 O1 - Hosts: 185.2.113.101 jb1ib101 O1 - Hosts: 185.2.113.102 jb1ib102 O1 - Hosts: 185.2.113.150 jb1co077 O1 - Hosts: 185.2.145.15 jb1hi033 O1 - Hosts: 185.2.155.15 jb1hi032 O1 - Hosts: 185.2.165.15 jb1hi034 O1 - Hosts: 185.2.174.2 ntfile15 O1 - Hosts: 185.2.177.30 dmcsrvms01 O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINNT\system32\dla\tfswshx.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Reverso Translator - {995B2B9A-FCC5-4BE8-B98F-E9CD53C514FE} - C:\PROGRA~1\Reverso\REVERS~3\REVERS~1.DLL O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O15 - Trusted Zone: http://*.e-space2 O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} (F5 Networks CacheCleaner) - https://gateboy.jatco.co.jp/vdesk/cachecleaner.cab O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} (F5 Networks VPN Manager) - https://gateboy.jatco.co.jp/vdesk/terminal/urxvpn.cab#version=5520,0,61018,0435 O16 - DPF: {57C76689-F052-487B-A19F-855AFDDF28EE} (F5 Networks Policy Agent Host Class) - https://gateboy.jatco.co.jp/vdesk/terminal/f5InspectionHost.cab O16 - DPF: {6C275925-A1ED-4DD2-9CEE-9823F5FDAA10} (F5 Networks SSLTunnel) - https://gateboy.jatco.co.jp/vdesk/terminal/urTermProxy.cab#version=5520,0,61018,0422 O16 - DPF: {8A62063C-BD9B-47F9-9460-C0669513359F} (client.Execute) - http://e-space2/imageserver/plumtree/portal/private/tagnav/jatco/client.CAB O16 - DPF: {BF3CD111-6278-11D2-9EA3-00A0C9251384} (O2C-Player Version 1.x) - http://www.o2c.de/download/O2CPlayer.CAB O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} (F5 Networks SuperHost Class) - https://gateboy.jatco.co.jp/vdesk/terminal/urxshost.cab O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} (F5 Networks Host Control) - https://gateboy.jatco.co.jp/vdesk/terminal/urxhost.cab#version=5520,0,61018,0420 O16 - DPF: {E615C9EA-AD69-4AE9-83C9-9D906A0ACA6D} (F5 Networks OS Policy Agent) - http://gateboy.jatco.co.jp/... O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = jatcofr.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = jatcofr.local O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = jatcofr.local O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Reverso\Reverso Translation Server\LogoMedia TranslateDotNet Server.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe O23 - Service: UStorage Server Service - OTi - C:\WINNT\system32\UStorSrv.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe End of file - 13375 bytes Merci d'avance |
| 05/09 12h06 | MSIMN a causé une défaillance de page ds le module Kernel32.DLL | Microsoft Outlook |
| 15/03 09h48 | Décrypter une erreur STOP (0x0000...) | Windows |
| 18/03 11h54 | Kernel32.dll manquant | 5 |
| 21/02 12h39 | Pb demarrage windows kernel32.dll | 2 |
| 17/09 15h48 | Au secours ! infection etc/host & Kernel32 | 29 |
| 29/04 09h11 | Pb avec Kernel32.dll - point entrée introuv. | 4 |
| 15/03 15h45 | Virus shell32.dll et kernel32.dll | 20 |