trojan vraiment chiant Fermé

Question

Bonjour, 
j'ai un souci un fichier hec.sys qui apparait en trojan  par avast et a chaque fois qu'il me le detruit et que je redemarre mon pc ce trojan reviens je sais plus quoi faire....  SOS merci d'avance

Utilisateur anonyme · Answer

Bonsoir,
télécharge HijackThis ici:
https://www.zebulon.fr/telechargements/securite/systeme/hijackthis.html

Clique sur "do a system scan and save logfile"
faire un copier coller du log entier sur le forum

Une démo si c'est compliqué :
http://pageperso.aol.fr/balltrap34/demohijack.htm

kira · Answer

je te remercie je vais essayer

kira · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:50:36, on 18/10/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\csrss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
G:\Program Files\Alwil Software\Avast4\ashServ.exe
G:\WINDOWS\system32\spoolsv.exe
g:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
G:\Program Files\a-squared Free\a2service.exe
G:\WINDOWS\System32\alg.exe
G:\WINDOWS\System32\FTRTSVC.exe
G:\WINDOWS\System32
vsvc32.exe
G:\WINDOWS\System32\HPZipm12.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
G:\WINDOWS\System32\RUNDLL32.EXE
G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
G:\WINDOWS\SOUNDMAN.EXE
G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
G:\WINDOWS\LOGI_MWX.EXE
G:\PROGRA~1\Wanadoo\TaskBarIcon.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\HP\HP Software Update\HPWuSchd2.exe
G:\WINDOWS\System32\LVCOMSX.EXE
G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
G:\WINDOWS\System32\ctfmon.exe
G:\Program Files\BitTorrent\bittorrent.exe
G:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
G:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
G:\PROGRA~1\Wanadoo\ComComp.exe
G:\PROGRA~1\Wanadoo\Toaster.exe
G:\PROGRA~1\Wanadoo\Inactivity.exe
G:\PROGRA~1\Wanadoo\PollingModule.exe
G:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
G:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
G:\PROGRA~1\Wanadoo\Watch.exe
G:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\W32BRG55.EXE
G:\PROGRA~1\MOZILL~1\FIREFOX.EXE
G:\PROGRA~1\Mozilla Firefox\firefox.exe
G:\WINDOWS\System32\wbem\wmiprvse.exe
G:\Documents and Settings\Kira\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - G:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - G:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - G:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - G:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - G:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - G:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] G:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] G:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] G:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SpywareTerminator] "G:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] "G:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [LVCOMSX] G:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] G:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [BitTorrent] "G:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = G:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = G:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: ZDWLan Utility.lnk = G:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: &Windows Live Search - res://G:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://G:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?6855d1ae34294ceaaf23d1f41550360d
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://G:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?6855d1ae34294ceaaf23d1f41550360d
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\webelated.htm
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - G:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O21 - SSODL: Extension Module - {810424B1-3E7A-C8CC-5C44-CE7CCDA82631} - G:\WINDOWS\System32\winjrvwke4.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - G:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - G:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - G:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - G:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - G:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - g:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\System32\HPZipm12.exe

Utilisateur anonyme · Answer

re,
fix checked :
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O21 - SSODL: Extension Module - {810424B1-3E7A-C8CC-5C44-CE7CCDA82631} - G:\WINDOWS\System32\winjrvwke4.dll

redemarre le pc et supprime :
 G:\WINDOWS\System32\winjrvwke4.dll

connecte toi sur :
https://www.eset.com/
Ensuite : Scanner en ligne.
Coche la case et puis clique sur start.
Accepte l'active X
Coche les 2 options du scan et fait un scan complet.

Trojan vraiment chiant

4 réponses

Discussions similaires