virus[resolu]

voial mon probleme je me suis pris un cheval et j'ai reussi a l effacé et depuis j'ai des fenetre de pub qui s affiche toute les 30S a 1 mn voila le raport

Logfile of HijackThis v1.99.1
Scan saved at 19:43:58, on 24/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Network\ipnetwork.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\antoine\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinUpdate] C:\cmon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [w05d14f3.dll] RUNDLL32.EXE w05d14f3.dll,I2 00079aaf005d14f3
O4 - HKLM\..\Run: [IpNetwork] C:\Program Files\Network\ipnetwork.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [keyboard] C:\WINDOWS\keyboard11.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolb [...] xmk570CUFR
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocac [...] 0.0.15.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} - http://www.errorguard.com/installation/Install.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 4221604421
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: DateTime - C:\WINDOWS\system32\wnasf.dll
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\r2p8lc7u1f.dll (file missing)
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\en42l1ho1.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)

aider moi svp

Répondre

Inscrivez-vous ou connectez-vous pour masquer ceci.

Bonjour,

Tu as une infection de type Look2me
Imprime ces instructions, ou colle les dans un fichier texte.
Regarde bien l'indication en bas, avant de commencer la procédure.
Télécharge Look2Me-Destroyer.exe sur ton Bureau.

http://www.atribune.org/ccount/click.php?id=7

. Ferme toutes les fenêtres actives.
. Lance l'outil Look2Me-Destroyer.exe.
. Coche Run this program as a task
. Un message s'affichera :
"Look2Me-Destroyer will close and re-open in approximately 1 minute"-> OK
. Il se relancera après la minute, puis appuie sur le bouton Scan for L2M.
. Les icônes de ton Bureau vont disparaître.
. Le scan termine, clique sur Remove L2M
. Un nouveau message Done Scanning apparaîtra, clique sur OK.
. Suivi de Done removing infected files! Look2Me-Destroyer will now shutdown your computer -> OK.
. Ton PC va s’éteindre.
. Démarre ton PC normalement.
. Colle le rapport généré, situé ici : C:\Look2Me-Destroyer.txt ,ainsi qu'un rapport HijackThis.

Si Look2Me-Destroyer ne se relance pas automatiquement après la minute, redémarre et essaie à nouveau.

Répondre à Angeldark

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 25/04/2006 16:58:09

Infected! C:\WINDOWS\system32\h42o0ef3eh2.dll
Infected! C:\WINDOWS\system32\r2p8lc7u1f.dll
Infected! C:\WINDOWS\system32\myrd3x40.dll
Infected! C:\WINDOWS\system32\enlsl1371.dll
Infected! C:\WINDOWS\system32\h42o0ef3eh2.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036066.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035854.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035867.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036000.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036011.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036079.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036129.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036133.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037258.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037259.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037293.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037308.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037315.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037320.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037328.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037336.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037344.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037348.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038366.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038371.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038379.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038418.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038457.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038458.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038459.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038460.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038461.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038462.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038463.dll
Infected! C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038476.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\h42o0ef3eh2.dll
C:\WINDOWS\system32\h42o0ef3eh2.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\myrd3x40.dll
C:\WINDOWS\system32\myrd3x40.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\enlsl1371.dll
C:\WINDOWS\system32\enlsl1371.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\h42o0ef3eh2.dll
C:\WINDOWS\system32\h42o0ef3eh2.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036066.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036066.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035854.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035854.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035867.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0035867.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036000.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036000.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036011.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036011.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036079.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP64\A0036079.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036129.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036129.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036133.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0036133.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037258.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037258.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037259.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037259.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037293.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037293.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037308.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037308.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037315.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037315.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037320.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037320.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037328.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037328.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037336.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037336.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037344.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037344.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037348.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0037348.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038366.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038366.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038371.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038371.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038379.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038379.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038418.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038418.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038457.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038457.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038458.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038458.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038459.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038459.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038460.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038460.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038461.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038461.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038462.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038462.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038463.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038463.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038476.dll
C:\System Volume Information\_restore{4704F282-F4E5-433F-8373-2CDB6DC307DB}\RP65\A0038476.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7C816C28-DCA4-4DE1-AABE-42C2D9A5C25C}"
HKCR\Clsid\{7C816C28-DCA4-4DE1-AABE-42C2D9A5C25C}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A0FB3D02-CFAF-4317-8A79-043F758C6C43}"
HKCR\Clsid\{A0FB3D02-CFAF-4317-8A79-043F758C6C43}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D6296B3E-DE67-4430-A7A5-C83F0802FE23}"
HKCR\Clsid\{D6296B3E-DE67-4430-A7A5-C83F0802FE23}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file

Restoring SeDebugPrivilege for Administrateurs - Succeeded

Répondre à ghost91

MERCI BEAUCOUP JE N'AI PLUS RIEN

Répondre à ghost91

Forum Sécurité - Virus : virus[resolu]

Attention