Infecter par trojan vundo

sebydm Messages postés 38 Statut Membre -  
sebydm Messages postés 38 Statut Membre -
voila tout est dans le titre ! j'ai souvent heu recour a votre aide et sa toujours porter fruits ! j'espere que sa va encore m'aider ,, sa fait deja 4 jour que je galere .

voila mon scan hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 18:36:38, on 11/06/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
G:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
G:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
G:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\System32\RUNDLL32.EXE
G:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
G:\WINDOWS\System32\MMTray.exe
G:\WINDOWS\System32\MMTray2k.exe
G:\WINDOWS\System32\MMTrayLSI.exe
G:\WINDOWS\RTHDCPL.EXE
G:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
G:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
G:\WINDOWS\ATKKBService.exe
G:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
G:\Program Files\Norton AntiVirus\navapsvc.exe
G:\Program Files\MSN Messenger\MsnMsgr.Exe
G:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
G:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
G:\WINDOWS\System32\nvsvc32.exe
G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\PROGRA~1\MCROSO~1\tracert.exe
G:\Documents and Settings\Administrateur\Application Data\s?stem\w?wexec.exe
e:\Program Files\CyberLink\Shared files\RichVideo.exe
G:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
G:\WINDOWS\System32\wuauclt.exe
e:\Program Files\Windows Media Player\wmplayer.exe
I:\Program Files\Sony\Vegas 7.0\vegas70.exe
i:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Internet Explorer\iexplore.exe
G:\Documents and Settings\Administrateur\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {8A61098D-612B-4EF2-943D-64E920684061} - G:\WINDOWS\System32\hggfghi.dll
O2 - BHO: (no name) - {9A066D49-D48E-BF55-D10B-FEADD2E073B2} - G:\WINDOWS\System32\uczht.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - g:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - G:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - G:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] G:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [tsnp2std] G:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe
O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "e:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "e:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\System32\NeroCheck.exe
O4 - HKCU\..\Run: [YSearchProtection] G:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "e:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Weue] "e:\PROGRA~1\MCROSO~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [Kjukzct] "G:\Documents and Settings\Administrateur\Application Data\s?stem\w?wexec.exe"
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://e:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - e:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: hggfghi - G:\WINDOWS\SYSTEM32\hggfghi.dll
O20 - Winlogon Notify: winuns32 - G:\WINDOWS\SYSTEM32\winuns32.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - G:\WINDOWS\ATKKBService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - G:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - G:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - e:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SAVScan - Symantec Corporation - G:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - G:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - G:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

merci d'avance
A voir également:

2 réponses

TazDevil Messages postés 993 Statut Membre 370
 
Je n'ai pas pris le temps de lire tout en détail (il commence à ce faire tard ;-) ) mais tu peux déjà "fixer" les lignes :

- O4 - HKLM\..\Run: [tsnp2std] G:\WINDOWS\tsnp2std.exe
- O4 - HKCU\..\Run: [Weue] "e:\PROGRA~1\MCROSO~1\tracert.exe" -vt yazb
- O4 - HKCU\..\Run: [Kjukzct] "G:\Documents and Settings\Administrateur\Application Data\s?stem\w?wexec.exe"
0
sebydm Messages postés 38 Statut Membre 4
 
ah au moin ses deja sa ! jespere que tu aura le temps de lire le reste demain ! je ten remercie deja
0