win32:trojan-gen.{other} Fermé

Question

Bonjour voilà mon antivirus avast me détecte ce virus :"win32:trojan{other} dans le fichier dload.exe et dans prvdi.exe je le vire avec avast mais il revient, j'ai essaye adaware,spybot mais rien à faire quelqu'un pourrait m'aider ?voilà mon rapport hijackthis:Logfile of HijackThis v1.99.0Scan saved at 17:46:35, on 24/02/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Avast4\aswUpdSv.exeC:\Program Files\Avast4\ashServ.exeC:\WINDOWS\System32\cisvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\System32\Fast.exeC:\PROGRA~1\ZONEAL~1\zlclient.exeC:\Program Files\Fichiers communs\Real\Update_OBealsched.exeC:\Program Files\AnyDVD\AnyDVD.exeC:\WINDOWS\System32mctrl.exeC:\Program Files\Tech\Wheel Mouse\5.0\MOUSE32A.EXEC:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeC:\Program Files\CloneCD\CloneCDTray.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\Winamp\winampa.exeC:\PROGRA~1\Avast4\ashDisp.exeC:\Program Files\Fichiers communs\Real\Update_OBnathchk.exeC:\Program Files\D-Tools\daemon.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeC:\Program Files\GetRight\getright.exeC:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exeC:\Program Files\GetRight\getright.exeC:\Program Files\Avast4\ashMaiSv.exeC:\Program Files\Avast4\ashWebSv.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\mIRC 6.14\mirc.exeC:\Program Files\Internet Explorer\iexplore.exeH:\Mes documents\Ressources\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.free.fr:3128;http=proxy.free.fr:3128R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {1AEA7CE2-CE90-1B26-B238-B63B1FC5D1E6} - (no file)O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONEAL~1\zlclient.exeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osbootO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exeO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [AnyDVD] C:\Program Files\AnyDVD\AnyDVD.exeO4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\System32mctrl.exeO4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Tech\Wheel Mouse\5.0\MOUSE32A.EXEO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exeO4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /sO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exeO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SkwatAutoconnect] C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exeO4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-908\dslmon.exeO4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htmO8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin2.dllO12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin.dllO16 - DPF: Yahoo! Checkers - http://download.games.yahoo.com/games/clients/y/kt3_x.cabO16 - DPF: Yahoo! Fleet - http://download.games.yahoo.com/games/clients/y/fltt3_x.cabO16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cabO16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cabO16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cabO16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cabO16 - DPF: {45E83043-1F6F-4D22-A5E7-0138EA171B49} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fr/filesharingctrl.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cabO16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cabO16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab30149.cabO16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - O17 - HKLM\System\CCS\Services\Tcpip\..\{612C0824-5DE7-43D0-8502-ED4B22AC3387}: NameServer = 212.27.32.176 212.27.39.1O23 - Service: ADSLAutoconnect - Unknown - C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exeO23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Avast4\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown - C:\Program Files\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exeO23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exeO23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exeO23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXEO23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exeO23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exeO23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exeO23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exeO23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exeO23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exeO23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exeO23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exemerci de toute aide possible.

Utilisateur anonyme · Answer

Salut
a fixer imperativement
O2 - BHO: (no name) - {1AEA7CE2-CE90-1B26-B238-B63B1FC5D1E6} - (no file)
O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe
O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\system32\prvdi.exe
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} -

besoin d'aide · Answer

G le meme probleme ke toi si tu trouve une soluce peu tu me contacté stp

Win32:trojan-gen.{other}

2 réponses

Discussions similaires