Comprend rien de rienFermé

Question

Je vous met ici ce que m'a sorti hijach: merci de me dire ce qui ne va pas j'y comprend rienStartupList report, 04/10/2004, 13:08:54StartupList version: 1.52.2Started from : C:\Documents and Settings\Nicolas\Bureau\hjt\HijackThis.EXEDetected: Windows 2000 SP4 (WinNT 5.00.2195)Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)* Using default options==================================================Running processes:C:\WINNT\System32\smss.exeC:\WINNT\SYSTEM32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\WINNT\System32\svchost.exeC:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exeC:\WINNT\system32\regsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\stisvc.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\System32\mspmspsv.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\Explorer.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINNT\system32\LVCOMSX.EXEC:\Program Files\Inventel\Gateway\wlancfg.exeC:\Documents and Settings\Nicolas\Application Data\Microsoft\Internet Explorer\Quick Launch\msnmsgr.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Documents and Settings\Nicolas\Bureau\hjt\HijackThis.exe--------------------------------------------------Listing of startup folders:Shell folders Common Startup:[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEEPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXE--------------------------------------------------Checking Windows NT UserInit:[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]UserInit = C:\WINNT\system32\userinit.exe,--------------------------------------------------Autorun entries from Registry:HKLM\Software\Microsoft\Windows\CurrentVersion\RunSynchronization Manager = mobsync.exe /logonLoadQM = loadqm.exeLogitechVideoRepair = C:\Program Files\Logitech\Video\ISStart.exeLogitechVideoTray = C:\Program Files\Logitech\Video\LogiTray.exeNeroCheck = C:\WINNT\system32\NeroCheck.exeLVCOMSX = C:\WINNT\system32\LVCOMSX.EXEmsnappau = "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\fr-ch\msnappau.exe"QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottimewlancfg = C:\Program Files\Inventel\Gateway\wlancfg.exe--------------------------------------------------Autorun entries from Registry:HKCU\Software\Microsoft\Windows\CurrentVersion\Runmsnmsgr = "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Internet Explorer\Quick Launch\msnmsgr.exe" /background--------------------------------------------------Load/Run keys from C:\WINNT\WIN.INI:load=*INI section not found*run=*INI section not found*Load/Run keys from Registry:HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*HKCU\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=PAVWAIT.DLL--------------------------------------------------Shell & screensaver key from C:\WINNT\SYSTEM.INI:Shell=*INI section not found*SCRNSAVE.EXE=*INI section not found*drivers=*INI section not found*Shell & screensaver key from Registry:Shell=Explorer.exeSCRNSAVE.EXE=*Registry value not found*drivers=*Registry value not found*Policies Shell key:HKCU\..\Policies: Shell=*Registry key not found*HKLM\..\Policies: Shell=*Registry value not found*--------------------------------------------------Enumerating Browser Helper Objects:(no name) - (no file) - {000020DD-C72E-4113-AF77-DD56626C6C42}(no name) - (no file) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC}(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(no name) - (no file) - {3FA84C5A-B81C-50B5-8756-64550DA77B1A}(no name) - (no file) - {4B2F5308-2CB0-40E2-8030-59936ED5D22C}(no name) - (no file) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}--------------------------------------------------Enumerating Task Scheduler jobs:{9938E2BB-8A20-4C2A-8B0E-3298743618E7}_NICOLAS-WH1MCR1_Nicolas.job--------------------------------------------------Enumerating Download Program Files:[{1D6711C8-7154-40BB-8380-3DEA45B69CBF}][YInstStarter Class]InProcServer32 = C:\WINNT\Downloaded Program Files\yinsthelper.dllCODEBASE = http://download.yahoo.com/dl/installs/yinst0309.cab[Cult3D ActiveX Player]InProcServer32 = C:\WINNT\system32\Cult3D\IECult.dllCODEBASE = http://www.cult3d.com/download/cult.cab[Office Update Installation Engine]InProcServer32 = C:\WINNT\opuc.dllCODEBASE = http://office.microsoft.com/officeupdate/content/opuc.cab[HouseCall Control]InProcServer32 = C:\WINNT\DOWNLO~1\xscan53.ocxCODEBASE = http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab[Update Class]InProcServer32 = C:\WINNT\System32\iuctl.dllCODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38076.4295833333[Shockwave Flash Object]InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocxCODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab--------------------------------------------------Enumerating ShellServiceObjectDelayLoad items:Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dllWebCheck: C:\WINNT\System32\webcheck.dllSysTray: stobject.dll--------------------------------------------------End of report, 7 121 bytesReport generated in 0,160 secondsCommand line options:   /verbose  - to add additional info on each section   /complete - to include empty sections and unsuspicious data   /full     - to include several rarely-important sections   /force9x  - to include Win9x-only startups even if running on WinNT   /forcent  - to include WinNT-only startups even if running on Win9x   /forceall - to include all Win9x and WinNT startups, regardless of platform   /history  - to list version history only

Utilisateur anonyme · Answer

Hello! :-)tu n'aurais pas fait un petit mélange entre l'hijack et la startup liste? parceque perso. non plus je comprends rien... :-}}}}HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=PAVWAIT.DLL<--suspect! Browser Helper Objects : tu as quelques no name/no filerefait un hijack (seul)http://telechargement.zebulon.fr/138-HijackThis.html@+*Devise : Je m'intéresse à l'avenir parceque  c'est là que je vais passer le reste de ma vie*

chat_teigne · Answer

Salut ! Je re-poste le message d'Avidix car il contenait des infos personnelles qu'il souhaitait ne pas laisser publiques.Voila donc son texte, allégé des infos inopportunes :)"Ajouté par avidivx  - 82.126.110.xxxLe 04/10/2004 à 22:05tu avais raison y'avait un mélange... voici le hijack seulLogfile of HijackThis v1.98.2Scan saved at 21:59:03, on 04/10/2004Platform: Windows 2000 SP4 (WinNT 5.00.2195)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\SYSTEM32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\system32\spoolsv.exeC:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exeC:\WINNT\System32\svchost.exeC:\Program Files\Fichiers communs\Panda Software\PavShld\pavprsrv.exeC:\WINNT\system32egsvc.exeC:\WINNT\system32\MSTask.exeC:\WINNT\system32\stisvc.exeC:\WINNT\System32\WBEM\WinMgmt.exeC:\WINNT\System32\mspmspsv.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\Explorer.EXEC:\Program Files\Logitech\Video\LogiTray.exeC:\WINNT\system32\LVCOMSX.EXEC:\Program Files\Inventel\Gateway\wlancfg.exeC:\Documents and Settings\Nicolas\Application Data\Microsoft\Internet Explorer\Quick Launch\msnmsgr.exeC:\Program Files\Logitech\Video\FxSvr2.exeC:\Documents and Settings\Nicolas\Bureau\hjt\HijackThis.exeC:\WINNT\system32
otepad.exeC:\Program Files\Internet Explorer\IEXPLORE.EXER0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.wanadoo.frR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxO4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [LoadQM] loadqm.exeO4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exeO4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exeO4 - HKLM\..\Run: [LVCOMSX] C:\WINNT\system32\LVCOMSX.EXEO4 - HKLM\..\Run: [wlancfg] C:\Program Files\Inventel\Gateway\wlancfg.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Documents and Settings\Nicolas\Application Data\Microsoft\Internet Explorer\Quick Launch\msnmsgr.exe" /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Ouvrir le cadre dans une nouvelle fenêtre - file://C:\WINNT\web
vcadre.htmlO16 - DPF: teleir_cert -"`·.¸¸.·´`·.¸¸.´`·¸¸.· · . . · · . . ·

alexlink · Answer

Euh je vois rien, je suis pas très bon en décryptage de hijack mais ....... une question me vient à l'esprit : Pourquoi un hijack, tu suspectes d'être infecté ? Parce que d'habitude on montre l'hijack avec une explication, 'pourquoi' on met l'hijack.Moi je veux bien chercher des solution, mais si il n'y a pas de problèmes ....;-).Le language SMS n'est ni simple à lire, ni amusant.

Utilisateur anonyme · Answer

re-bonjour ;-)*Je vous met ici ce que m'a sorti hijach: merci de me dire ce qui ne va pas*  <--et si tu nous disais toi, ce qui ne va pas plutôt? (l'hijack ne revèle rien de suspect)^_^ @+*Devise : Je m'intéresse à l'avenir parceque  c'est là que je vais passer le reste de ma vie*

Comprend rien de rien

4 réponses

Newsletters