Ordi archi buggé!!!

[bruce lee]

Bonjour,

 

Look2me peut en etre la cause, meme si sur ton rapport il semble etre aradiqué, on va tout de meme verifer.

 

Prière d'imprimer ces instructions, ou de les coller dans un fichier texte, pour lecture durant ce fix. Regarde bien la note au bas, avant de débuter.

Télécharge Look2Me-Destroyer.exe (par Atribune) sur ton Bureau.

• Ferme toutes les fenêtres actives avant de passer à l'étape suivante.
  
• Double-clique Look2Me-Destroyer.exe afin de lancer l'outil.
  
• Coche Run this program as a task
  
• Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 1 minute". Clique OK
  
• Il se relancera après la minute, puis clique sur le bouton Scan for L2M; les icônes de ton Bureau vont disparaître : c'est normal.
  
• Lorsque le scan termine, clique sur le bouton Remove L2M
  
• Un message Done Scanning apparaîtra, clique OK.
  
• Un nouveau message s'affichera : Done removing infected files! Look2Me-Destroyer will now shutdown your computer; clique OK.
  
• Ton PC va maintenant s'éteindre.
  
• Démarre ton PC normalement.
  
• Colle le rapport généré (Look2Me-Destroyer.txt), situé sur le Bureau, ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.
  

*Si Look2Me-Destroyer ne se relance pas automatiquement après la minute, redémarre et essaie à nouveau.

[illo]

Voici les rapports:

 

Hijack

Logfile of HijackThis v1.99.1

Scan saved at 12:36:32, on 16/09/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\system32\Rundll32.exe

C:\WINDOWS\system32\keyhook.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\MSMSGS.EXE

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\WINDOWS\system32\sistray.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\FolderSize\FolderSizeSvc.exe

C:\WINDOWS\system32\slserv.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Hijack This\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

F2 - REG:system.ini: UserInit=userinit.exe

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [moio] C:\PROGRA~1\FICHIE~1\moio\moiom.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab

O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

 

 

Look2me

 

Look2Me-Destroyer V1.0.12

 

Scanning for infected files.....

Scan started at 16/09/2006 12:29:04

 

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019830.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019831.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019833.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019834.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019835.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019839.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019840.dll

Infected! C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019843.dll

 

Attempting to delete infected files...

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019830.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019830.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019831.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019831.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019833.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019833.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019834.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019834.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019835.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019835.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019839.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019839.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019840.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019840.dll Deleted successfully!

 

Attempting to delete: C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019843.dll

C:\System Volume Information\_restore{ED4C023F-EC5B-4EFA-BCE3-DC06468C9784}\RP70\A0019843.dll Deleted successfully!

 

Making registry repairs.

 

 

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CA388989-93FC-4BF9-9D60-61356ED458F5}"

HKCR\Clsid\{CA388989-93FC-4BF9-9D60-61356ED458F5}

 

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{EDE78708-72AB-47F9-9898-5CD217DED394}"

HKCR\Clsid\{EDE78708-72AB-47F9-9898-5CD217DED394}

 

Restoring Windows certificates.

 

Replaced hosts file with default windows hosts file

 

 

Restoring SeDebugPrivilege for Administrateurs - Succeeded

[bruce lee]

re,

 

Ok, il restait donc des bestioles. Refais la manip avec blacklight normalement ca devrait marcher.

 

@+

[illo]

Rapport Blacklight

09/16/06 12:45:23 [info]: BlackLight Engine 1.0.46 initialized

09/16/06 12:45:23 [info]: OS: 5.1 build 2600 (Service Pack 2)

09/16/06 12:45:23 [Note]: 7019 4

09/16/06 12:45:23 [Note]: 7005 0

09/16/06 12:45:31 [Note]: 7006 0

09/16/06 12:45:31 [Note]: 7011 1376

09/16/06 12:45:31 [Note]: 7026 0

09/16/06 12:45:31 [Note]: 7026 0

09/16/06 12:45:31 [Note]: 7024 3

09/16/06 12:45:31 [info]: Hidden process: C:\windows\system32\wgjnfmsrd.exe

09/16/06 12:45:31 [Note]: FSRAW library version 1.7.1019

09/16/06 12:45:53 [Note]: 7007 0

 

09/16/06 12:45:58 [info]: BlackLight Engine 1.0.46 initialized

09/16/06 12:45:58 [info]: OS: 5.1 build 2600 (Service Pack 2)

09/16/06 12:45:58 [Note]: 7019 4

09/16/06 12:45:58 [Note]: 7005 0

09/16/06 12:46:00 [Note]: 7006 0

09/16/06 12:46:00 [Note]: 7011 1376

09/16/06 12:46:00 [Note]: 7026 0

09/16/06 12:46:00 [Note]: 7026 0

09/16/06 12:46:00 [Note]: 7024 3

09/16/06 12:46:00 [info]: Hidden process: C:\windows\system32\wgjnfmsrd.exe

09/16/06 12:46:00 [Note]: FSRAW library version 1.7.1019

09/16/06 12:49:13 [info]: Hidden file: c:\WINDOWS\system32\wgjnfmsrd_nav.dat

09/16/06 12:49:13 [Note]: 10002 1

09/16/06 12:49:13 [info]: Hidden file: c:\WINDOWS\system32\wgjnfmsrd.dat

09/16/06 12:49:13 [Note]: 10002 1

09/16/06 12:49:13 [info]: Hidden file: C:\windows\system32\wgjnfmsrd.exe

09/16/06 12:49:13 [Note]: 10002 1

09/16/06 12:49:14 [info]: Hidden file: c:\WINDOWS\system32\wgjnfmsrd_navps.dat

09/16/06 12:49:14 [Note]: 10002 1

09/16/06 13:02:29 [Note]: 7007 0

 

 

Rapport Ewido

 

---------------------------------------------------------

ewido anti-spyware - Scan Report

---------------------------------------------------------

 

+ Created at: 23:07:29 14/09/2006

 

+ Scan result:

 

 

 

C:\WINDOWS\system32\dr.exe -> Downloader.Adload.ds : Cleaned with backup (quarantined).

C:\WINDOWS\system32\xqbf8d61.dll -> Downloader.Small : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\ordiminou@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Local Settings\Temp\Cookies\[email protected][3].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\ordiminou@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Local Settings\Temp\Cookies\ordiminou@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\ordiminou@estat[1].txt -> TrackingCookie.Estat : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\[email protected][2].txt -> TrackingCookie.Falkag : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\[email protected][1].txt -> TrackingCookie.Pointroll : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Local Settings\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Reliablestats : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\[email protected][2].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\ordiminou@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Cookies\ordiminou@weborama[1].txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

C:\Documents and Settings\Ordiminou\Local Settings\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

C:\WINDOWS\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).

 

 

::Report end

 

 

 

 

Merci pour ton aide Bruce Lee

[bruce lee]

re,

 

as tu fais le scan chez JOTTI? Si oui poste le rapport. Si tu ne l'a pas fait, fais le.

 

@+

[illo]

re,

 

as tu fais le scan chez JOTTI? Si oui poste le rapport. Si tu ne l'a pas fait, fais le.

 

@+

 

Je n'ai pas de fichier moim.exe!

J'ai:

moioa.lck

moioh

moiol.lck

moiom.lck

[illo]

Je refais monter mon post pour que quelqu'un puisse m'aider...

 

L'ordi est toujours aussi buggé, Firefox doit fermer soudainement, idem pour Internet Explorer!

Je sais vraiment pas quoi faire !!!!

 

Merci à vous...

Modifié le 17 septembre 2006 par illo

[bruce lee]

bonjour,

 

patiente un peu, je ne suis pas toujours sur mon PC.

 

fais scanner chez jotti un des quatres fichiers, et poste le rapport.

 

@+

Modifié le 17 septembre 2006 par bruce lee

[illo]

Désolé Bruce Lee et merci encore pour ton aide, j'ai peur d'empirer le sort de mon ordi en éradiquant pas rapidement les virus...

 

Voici le rapport Jotti:

 

File: moioh

Status: OK

MD5 8b7038d7b2bc9a59864e417188619c26

Packers detected: -

 

AntiVir Found nothing

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

UNA Found nothing

VirusBuster Found nothing

VBA32 Found nothing

 

Last file scanned at least one scanner reported something about: strcodec.556.exe, detected by:

 

Scanner Malware name

AntiVir Dropper/Zlob.Gen dropper

ArcaVir X

Avast X

AVG Antivirus X

BitDefender X

ClamAV X

Dr.Web X

F-Prot Antivirus Possibly a new variant of W32/Adware-Dropper.MCodec-DC-behavior!Maximus

Fortinet X

Kaspersky Anti-Virus X

NOD32 X

Norman Virus Control X

UNA X

VirusBuster Trojan.DL.Zlob.YK.Gen

VBA32 X

 

 

Voilà, merci pour ton aide...

[bruce lee]

re,

 

-Télécharge la dernière version de Killbox ici=>

 

http://www.killbox.net/downloads/KillBox.exe

 

-Redémarre en mode sans échec pour ne pas être gêné par un résident.

 

-Lance Pocketkillbox,choisis l'option Delete on reboot

 

fais un clique gauche sur all files

 

Copie le chemin de fichier entier, en gras ci-bas, et colle le dans la boîte Full Path of File to Delete :

 

C:\windows\system32\wgjnfmsrd.exe

c:\WINDOWS\system32\wgjnfmsrd_nav.dat

c:\WINDOWS\system32\wgjnfmsrd.dat

c:\WINDOWS\system32\wgjnfmsrd_navps.dat

 

-Cliquer sur la croix blanche sur fond rouge:

 

« File will be Deleted on Next Reboot » répondre OUI

« File will be Removed on Reboot, Do you want to reboot now ? » répondre OUI

 

 

 

supprimer ensuite ce dossier C:\ !KillBox

 

 

Reposte ensuite un nouveau rapport hijackthis.

 

@+

Modifié le 17 septembre 2006 par bruce lee