Bonjour
Une amie a un trojan sur son pc et ne plus acceder à MSN, je lui ai donc fait installer avast, spybot et compagnie, et avec un hijackthis avant :
ça donne ça :
J'ai analysé dans la page dédiée, mais j'suis pas trop sur. Faut-il fixer ce ALCXMNTR.EXE et voyez autre chose à fixer ?
merci
Logfile of HijackThis v1.99.1
Scan saved at 18:34:09, on 23/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:..WINDOWS..System32..smss.exe
C:..WINDOWS..system32..winlogon.exe
C:..WINDOWS..system32..services.exe
C:..WINDOWS..system32..lsass.exe
C:..WINDOWS..system32..Ati2evxx.exe
C:..WINDOWS..system32..svchost.exe
C:..WINDOWS..System32..svchost.exe
c:..Program Files..Fichiers communs..Symantec Shared..ccProxy.exe
c:..Program Files..Fichiers communs..Symantec Shared..ccSetMgr.exe
c:..Program Files..Norton Internet Security..ISSVC.exe
C:..WINDOWS..system32..Ati2evxx.exe
c:..Program Files..Norton Internet Security..Norton AntiVirus..navapsvc.exe
C:..WINDOWS..Explorer.EXE
c:..Program Files..Fichiers communs..Symantec Shared..SNDSrvc.exe
c:..Program Files..Fichiers communs..Symantec Shared..SPBBC..SPBBCSvc.exe
c:..Program Files..Fichiers communs..Symantec Shared..ccEvtMgr.exe
C:..WINDOWS..system32..spoolsv.exe
C:..Program Files..Alwil Software..Avast4..aswUpdSv.exe
C:..Program Files..Alwil Software..Avast4..ashServ.exe
c:..Program Files..Fichiers communs..LightScribe..LSSrvc.exe
C:..Program Files..Symantec..LiveUpdate..ALUSchedulerSvc.exe
C:..WINDOWS..system32..svchost.exe
c:..Program Files..Fichiers communs..Symantec Shared..Security Center..SymWSC.exe
C:..Program Files..Alwil Software..Avast4..ashMaiSv.exe
C:..WINDOWS..AGRSMMSG.exe
C:..WINDOWS..ALCXMNTR.EXE
C:..WINDOWS..system32..lsasss.exe
C:..PROGRA~1..ALWILS~1..Avast4..ashDisp.exe
C:..WINDOWS..system32..ctfmon.exe
C:..Program Files..MSN Messenger..msnmsgr.exe
C:..Program Files..HP..Digital Imaging..bin..hpqtra08.exe
C:..Program Files..Internet Explorer..iexplore.exe
C:..Program Files..Internet Explorer..iexplore.exe
C:..Program Files..WinRAR..WinRAR.exe
C:..DOCUME~1..HP_PRO~1..LOCALS~1..Temp..Rar$EX00.953..HijackThis.exe
R1 - HKCU..Software..Microsoft..Internet Explorer..Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKCU..Software..Microsoft..Internet Explorer..Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKCU..Software..Microsoft..Internet Explorer..Main,Search Page = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R0 - HKCU..Software..Microsoft..Internet Explorer..Main,Start Page = http://www.google.fr/
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Default_Page_URL = http://www.aliceadsl.fr
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Search Bar = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKLM..Software..Microsoft..Internet Explorer..Main,Search Page = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R0 - HKLM..Software..Microsoft..Internet Explorer..Main,Start Page = http://ie.redirect.hp.com/svs/rdr? [...] pf=desktop
R1 - HKCU..Software..Microsoft..Internet Connection Wizard,ShellNext = http://classique.goa.com/wanadoo/fr
R1 - HKCU..Software..Microsoft..Internet Explorer..Main,Window Title = Alice ADSL
R1 - HKCU..Software..Microsoft..Windows..CurrentVersion..Internet Settings,ProxyServer = :80
R0 - HKCU..Software..Microsoft..Internet Explorer..Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:..Program Files..Adobe..Acrobat 6.0..Reader..ActiveX..AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:..Program Files..Norton Internet Security..Norton AntiVirus..NavShExt.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:..Program Files..HP..Digital Imaging..bin..HPDTLK02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:..Program Files..Norton Internet Security..Norton AntiVirus..NavShExt.dll
O4 - HKLM......Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM......Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM......Run: [IMJPMIG8.1] "C:..WINDOWS..IME..imjp8_1..IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM......Run: [MSPY2002] C:..WINDOWS..system32..IME..PINTLGNT..ImScInst.exe /SYNC
O4 - HKLM......Run: [PHIME2002ASync] C:..WINDOWS..system32..IME..TINTLGNT..TINTSETP.EXE /SYNC
O4 - HKLM......Run: [PHIME2002A] C:..WINDOWS..system32..IME..TINTLGNT..TINTSETP.EXE /IMEName
O4 - HKLM......Run: [Lexmark_X79-55] C:..WINDOWS..system32..lsasss.exe
O4 - HKLM......Run: [ccApp] "c:..Program Files..Fichiers communs..Symantec Shared..ccApp.exe"
O4 - HKLM......Run: [avast!] C:..PROGRA~1..ALWILS~1..Avast4..ashDisp.exe
O4 - HKCU......Run: [ctfmon.exe] C:..WINDOWS..system32..ctfmon.exe
O4 - HKCU......Run: [msnmsgr] "C:..Program Files..MSN Messenger..msnmsgr.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:..Program Files..HP..Digital Imaging..bin..hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:..Program Files..Adobe..Acrobat 7.0..Reader..reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:..Program Files..Microsoft Office..Office10..OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:..Program Files..Java..j2re1.4.2_03..bin..npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:..Program Files..Java..j2re1.4.2_03..bin..npjpi142_03.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:..Program Files..Fichiers communs..Microsoft Shared..Encarta Search Bar..ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:..Program Files..Messenger..msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:..Program Files..Messenger..msmsgs.exe (file missing)
O9 - Extra button: Alice ADSL - {CC9F1EDB-74D5-40ED-B05F-EC420DE8B9CA} - http://www.aliceadsl.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.aliceadsl.fr
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:..PROGRA~1..MSNMES~1..MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:..PROGRA~1..MSNMES~1..MSGRAP~1.DLL
O20 - AppInit_DLLs:
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:..Program Files..Alwil Software..Avast4..aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:..WINDOWS..system32..Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:..Program Files..Alwil Software..Avast4..ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:..Program Files..Alwil Software..Avast4..ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:..Program Files..Alwil Software..Avast4..ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:..Program Files..iPod..bin..iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:..Program Files..Norton Internet Security..ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:..Program Files..Fichiers communs..LightScribe..LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:..PROGRA~1..Symantec..LIVEUP~1..LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:..Program Files..Norton Internet Security..Norton AntiVirus..navapsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:..Program Files..Symantec..LiveUpdate..ALUSchedulerSvc.exe
O23 - Service: SAVScan - Symantec Corporation - c:..Program Files..Norton Internet Security..Norton AntiVirus..SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..SPBBC..SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:..Program Files..Fichiers communs..Symantec Shared..Security Center..SymWSC.exe