rapport Hijackthis et Look2me

le_chat_sauvage · le 6 juillet 2006

bonjour a tous,

j'ai été infesté par le malware adware.look2me, je m'en suis rendu compte il y a deux jours et apres de multiple essais d'antispyware qui me supprimait des spy mais pas look2me. Je pense avoir trouvé une solution digne du nom... et sur ce forum...

voici donc la méthode que j'ai appliqué, aprés installation de look2me-destroyer;

* Ferme toutes les fenêtres actives avant de passer à l'étape suivante.

* Double-clique Look2Me-Destroyer.exe afin de lancer l'outil.

* Coche Run this program as a task

* Un message s'affichera, te disant ceci : "Look2Me-Destroyer will close and re-open in approximately 1 minute". Clique OK

* Il se relancera après la minute, puis clique sur le bouton Scan for L2M; les icônes de ton Bureau vont disparaître : c'est normal.

* Lorsque le scan termine, clique sur le bouton Remove L2M

* Un message Done Scanning apparaîtra, clique OK.

* Un nouveau message s'affichera : Done removing infected files! Look2Me-Destroyer will now shutdown your computer; clique OK.

* Ton PC va maintenant s'éteindre.

* Démarre ton PC normalement.

* Colle le rapport généré (Look2Me-Destroyer.txt), situé sur le Bureau, ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

apparament ca a marché etant donné que ewido ne detect plus adware.look2me mais comme il été ecrit dans le post d'où provient la solution une infection n'arrive pas toute seule... je me permet de poster mon rapport look2me-destroyer et hijackthis...

merci à l'ame généreuse qui pourra m'aider...

ps: si l'on peut m'expliquer en quoi consiste Hijackthis, comment cela marche et quel est l'intéret ainsi que comment analyser le code, ca serait merveilleux...

rapport look2me-destroyer:

--------------------------------------------

Look2Me-Destroyer V1.0.12

Scanning for infected files.....

Scan started at 06/07/2006 15:56:07

Infected! C:\WINDOWS\system32\jt0407dqe.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055177.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055219.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055285.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055297.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055300.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055301.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055302.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055313.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055321.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055333.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055666.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055698.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055699.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055701.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055702.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055707.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055733.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055734.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055745.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055746.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055777.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055784.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055790.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055791.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055810.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055811.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055813.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055814.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055826.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055840.dll

Infected! C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055855.dll

Infected! C:\WINDOWS\system32\fpr0039me.dll

Infected! C:\WINDOWS\system32\jt0407dqe.dll

Infected! C:\WINDOWS\system32\sipblb.dll

Infected! C:\WINDOWS\system32\wdweb.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\jt0407dqe.dll

C:\WINDOWS\system32\jt0407dqe.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055177.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055177.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055219.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055219.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055285.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055285.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055297.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055297.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055300.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055300.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055301.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055301.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055302.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055302.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055313.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055313.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055321.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055321.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055333.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055333.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055666.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP166\A0055666.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055698.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055698.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055699.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055699.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055701.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055701.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055702.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055702.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055707.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055707.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055733.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055733.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055734.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055734.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055745.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055745.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055746.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055746.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055777.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055777.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055784.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055784.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055790.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055790.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055791.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055791.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055810.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055810.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055811.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055811.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055813.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055813.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055814.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055814.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055826.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055826.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055840.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055840.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055855.dll

C:\System Volume Information\_restore{A5740467-EE62-4655-B9D9-14B2812FC30B}\RP167\A0055855.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\fpr0039me.dll

C:\WINDOWS\system32\fpr0039me.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\jt0407dqe.dll

C:\WINDOWS\system32\jt0407dqe.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\sipblb.dll

C:\WINDOWS\system32\sipblb.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\wdweb.dll

C:\WINDOWS\system32\wdweb.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Dynamic Directory

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{6A0FA43E-3D87-4329-B02F-472B1D160601}"

HKCR\Clsid\{6A0FA43E-3D87-4329-B02F-472B1D160601}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{9F95A952-B857-4C80-BB3E-E949640B1316}"

HKCR\Clsid\{9F95A952-B857-4C80-BB3E-E949640B1316}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{67A9B345-2BD5-490C-9221-F104C203960D}"

HKCR\Clsid\{67A9B345-2BD5-490C-9221-F104C203960D}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrateurs - Succeeded

rapport Hijackthis:

--------------------------------------------------------------------------

Logfile of HijackThis v1.99.1

Scan saved at 16:25:13, on 06/07/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

C:\Program Files\Apoint\Apoint.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe

C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe

C:\Program Files\Sony\VAIO Launcher\Launcher.exe

C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearchIndexer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\antoine\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://v4.windowsupdate.microsoft.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.club-vaio.com/fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache-etu.univ-lille1.fr:3128

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [sonyPowerCfg] C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

O4 - HKLM\..\Run: [iSBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe

O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary

O4 - HKLM\..\Run: [PDService.exe] C:\Program Files\Utimaco\SafeGuard PrivateDisk\pdservice.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [defender] C:\\dfndrb_3.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdb_3.exe

O4 - HKLM\..\Run: [newname] C:\\nwnmb_3.exe

O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - Startup: VAIO Launcher.lnk = C:\Program Files\Sony\VAIO Launcher\Launcher.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\fr-fr\bin\WindowsSearch.exe

O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fr-fr\msntb.dll/search.htm

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/229?cf5a5048451c4a2dbcfb96de5ef3632a

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fr-fr\msntabres.dll/230?cf5a5048451c4a2dbcfb96de5ef3632a

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Transfert par Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/

O15 - Trusted Zone: *.sony-europe.com

O15 - Trusted Zone: *.sonystyle-europe.com

O15 - Trusted Zone: *.vaio-link.com

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe

O23 - Service: VAIO Entertainment Task Scheduler - Sony Corporation - C:\Program Files\Sony\VAIO Entertainment\VzTaskScheduler.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe

O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)

O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe

O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)

O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe

O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

le 6 juillet 2006

Bonjour le_chat_sauvage

Ce log révèle la présence de quelques fichiers malicieux.

si personne ne prend le sujet d'ici une trentaine de minutes (le temps pour moi de déjeuner) j'analyserais ce log plus en détail

le 6 juillet 2006

De retour,

Dans un premier temps et avant tout autre chose place Hijackthis dans un dossier qui lui est dédié (c:\hijackthis ou si tu preferes l'avoir sur le bureau C:\Documents and Settings\antoine\Bureau\hijackthis\HijackThis.exe

Tout dabord cette ligne m'intrigue quelque peu

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = cache-etu.univ-lille1.fr:3128

As tu installé ou configurer ce proxy ? si ce n'est pas le cas inclu cette ligne dans la liste de celle a fixer

Un autre point non négligeable consiste dans le fait qu'aucun par feu ne parait être présent ce qui dans un souci de sécurité n'eszt pas très recommendé.

Pour les quelques fichiers présents nous allons faire au plus simple en utilisant un petit utilitaire de

Malekal_morte

Pour ce

télécharge clean.zip http://www.malekal.com/download/clean.zip

Décompresse le sur ton bureau.

Redémarre en mode sanse échec !!! important !!!

Relance Hijackthis scanner seulement ou do a system scan only

coche les cases devant ces lignes

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [defender] C:\\dfndrb_3.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdb_3.exe

O4 - HKLM\..\Run: [newname] C:\\nwnmb_3.exe

Clique sur le bouton Fixer objet ou fix checked

Dans le dossier precedement décompressé lance Clean.cmd

Une fenêtre msdos s'ouvrira attend juste qu'elle se referme.

Redémarre en mode normal

Post dans ta prochaine réponse

- le rapport clean : Il est contenu dans le fichier C:\rapport_clean.txt (ouvre le et fais un copier coller de son contenu)

- Un nouveau log hijackthis afin de contrôler

Si tu as une question, remarque ou le moindre doute n'hézites surtout pas à demander.

Pour ce qui concerne la seconde partie de ta demande à savoir l'analyse de log hijackthis et son apprentissage j'essaierais de te donner des infos une fois le nettoyage terminé afin d'éviter d'entrecroiser des questions de divers sujets dans une seule et même réponse ce qui ne serait pédagogiquement parlant pas très clair.

Modifié le 6 juillet 2006 par Laurent_62

le_chat_sauvage · le 6 juillet 2006

ok laurent,

pour la ligne R1... cach-etu.univ-lille1.fr:3128 c'est un proxy que j'ai configurer pour le reseau de mon université, mais je n'en ai plus besoin pdt un ans donc si ca pose un probleme je peux le fixer aussi...

pour le pare feu, en as tu un as me conseiller???(ou comment je fait pour l'activer?)

sinon j'ai suivi tes instructions et voici les rapports de clean et d'Hijackthis:

rapport_clean: