Bonjour,
je suis infecté par trojan.w.32.looksky et j'ai cru comprendre que chaque cas est différent.
ce truc m'ouvre des tas de pages safewebnavigate.com. j'ai une croix rouge que me regarde d'un air méchant dans la barre des taches
je vous poste le rapport hijackthis et espère une aide de votre part.
merci d'avance
oliv
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:37:38, on 30/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
H:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
H:\Program Files\RocketDock\RocketDock.exe
H:\Program Files\Reflex Vision\ReflexVision.exe
H:\Program Files\Winsos\WINSOS.EXE
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\system32\acs.exe
H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
H:\Program Files\ewido anti-malware\ewidoctrl.exe
H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\WINDOWS\system32\wscntfy.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\WINDOWS\system32\cmd.exe
H:\Program Files\navilog1\fsblc.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Outlook Express\msimn.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Documents and Settings\cris oliv\Bureau\test\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MSVPS System - {ECBD04D1-1133-4480-8A8C-BC9FDD54D6C1} - H:\WINDOWS\div32.dll
O4 - HKLM\..\Run: [ATICCC] "H:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Sunkist2k] H:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AVP] "H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [RocketDock] "H:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Reflex Vision] "H:\Program Files\Reflex Vision\ReflexVision.exe" Start:Silent
O4 - HKCU\..\Run: [Entbloess 2] H:\Program Files\Reflex Vision\ReflexVision.exe Start:Silent
O4 - HKCU\..\Run: [WINSOS VERIFY] "H:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = H:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-3fe71d8c9e2ef1a1.spaces.live.com/PhotoUpload/MsnPUpld.cab
O21 - SSODL: mssql - {7AE013B7-681B-41FA-8294-5F1B3212DD6C} - H:\WINDOWS\mssql.dll
O21 - SSODL: syscore - {E1A1D3ED-FDCA-4137-8E4E-86CE719BDD91} - H:\WINDOWS\syscore.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - H:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - H:\WINDOWS\system32\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - H:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: ewido security suite control - ewido networks - H:\Program Files\ewido anti-malware\ewidoctrl.exe
