Sujet Précédent Sujet Suivant

Sos cheval de trois en tout genre

drylo Messages postés 10 Statut Membre -  
drylo Messages postés 10 Statut Membre -
Bonjour,
je viens vous voir parce que depuis hier , avast me trouve un max de cheval de trois dans tous les sens
d habitude je n ai aucun probleme et la en deux jours il m en a trouvé au moins une cinquantaine
en plus je crois que j ai fais une betise , j ai supprimer tous les virus au lieu de les mettre en quarantaine en sachant qu a chaque fois ce sont des dll qui sont infectés, j ai peur d avoir fais une grosse betise
j ai télécharger highjackthis
voici le rapport , je sais pas si ca peu aider

merci d avance pour votre aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:57:11, on 07/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {3AEC3373-C823-4853-97D4-5B5549833BC3} - C:\WINDOWS\system32\ddccdby.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [vuhhtxklk] c:\windows\system32\vuhhtxklk.exe vuhhtxklk
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [devenv] C:\WINDOWS\system\smvss.exe /w
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - https://www.epson.eu/support/
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: ddccdby - C:\WINDOWS\SYSTEM32\ddccdby.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.6\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.45\bin\mysqld-nt.exe

--

4 réponses

Réponse 1 / 4
drylo Messages postés 10 Statut Membre
 
s il vous plait a l aide
0
Réponse 2 / 4
drylo Messages postés 10 Statut Membre
 
je vous mets eglement la liste des virus trouvés depuis 2 jours

06/01/2008 04:28:45 SYSTEM 1584 Sign of "Win32:Agent-PBD [Trj]" has been found in "C:\Program Files\eMule\Incoming\SimCity Societies nocd patch.zip\SimCity Societies nocd patch.exe" file.
06/01/2008 04:49:51 SYSTEM 1584 Sign of "Win32:Small-IKZ [Trj]" has been found in "C:\Documents and Settings\laurent\Application Data\user32.exe\[UPX]" file.
06/01/2008 04:49:51 SYSTEM 1584 Sign of "Win32:Small-IKZ [Trj]" has been found in "C:\Documents and Settings\laurent\Application Data\user32.exe\[UPX]" file.
06/01/2008 04:49:54 SYSTEM 1584 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\Documents and Settings\laurent\Application Data\wunauclt.exe" file.
06/01/2008 04:51:13 SYSTEM 1584 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\Documents and Settings\laurent\Application Data\wunauclt.exe" file.
06/01/2008 04:52:22 SYSTEM 1584 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\Documents and Settings\laurent\Application Data\wunauclt.exe" file.
06/01/2008 04:53:13 SYSTEM 1584 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\Documents and Settings\laurent\Application Data\wunauclt.exe" file.
06/01/2008 04:54:59 SYSTEM 1584 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ssqpp.dll" file.
06/01/2008 04:54:59 SYSTEM 1584 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ssqpp.dll" file.
06/01/2008 11:32:37 zaza 1568 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ddccc.dll" file.
06/01/2008 13:15:27 zaza 1568 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ddccc.dll" file.
06/01/2008 14:04:08 zaza 1568 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\Documents and Settings\laurent\Application Data\wunauclt.exe" file.
06/01/2008 14:04:26 zaza 1568 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ssqpo.dll" file.
06/01/2008 14:22:43 zaza 2784 Sign of "Win32:Small-IKZ [Trj]" has been found in "C:\Documents and Settings\laurent\Application Data\user32.exe\[UPX]" file.
06/01/2008 15:04:26 zaza 1568 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\awvts.dll" file.
06/01/2008 16:26:47 zaza 2784 Sign of "Win32:Trojan-gen {VC}" has been found in "C:\System Volume Information\_restore{02D98F32-BAF1-4BAE-B6F7-368C58BAB467}\RP304\A0068112.exe" file.
06/01/2008 18:44:14 zaza 2784 Sign of "Win32:Small-IKZ [Trj]" has been found in "C:\System Volume Information\_restore{02D98F32-BAF1-4BAE-B6F7-368C58BAB467}\RP304\A0068116.exe\[UPX]" file.
06/01/2008 18:44:22 zaza 1568 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\vtstt.dll" file.
06/01/2008 18:55:59 zaza 2784 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ssqpp.dll" file.
06/01/2008 20:15:38 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\awvtr.dll" file.
06/01/2008 21:15:39 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\geeby.dll" file.
06/01/2008 22:13:56 laurent 1236 Sign of "Win32:LdPinch-BWZ [Trj]" has been found in "C:\Documents and Settings\zaza\Local Settings\Application Data\Identities\{6853C7B3-E2B9-42F6-8934-09A634A76C8E}\Microsoft\Outlook Express\Boîte de réception.dbx\Un peu d-humour.eml#78596\Etonnant.pps#781978737\Pictures" file.
06/01/2008 22:15:41 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\vtsqq.dll" file.
06/01/2008 22:17:05 laurent 1236 Sign of "Win32:LdPinch-BWZ [Trj]" has been found in "C:\Documents and Settings\zaza\Local Settings\Application Data\Identities\{6853C7B3-E2B9-42F6-8934-09A634A76C8E}\Microsoft\Outlook Express\Boîte de réception.dbx\Un peu d-humour.eml#78596\Etonnant.pps#781978737" file.
06/01/2008 23:15:43 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\awvtq.dll" file.
07/01/2008 00:15:48 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ddayv.dll" file.
07/01/2008 01:15:46 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\mljji.dll" file.
07/01/2008 02:15:43 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\awvvt.dll" file.
07/01/2008 03:15:49 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\pmnnl.dll" file.
07/01/2008 09:48:38 laurent 1560 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\gebyw.dll" file.
07/01/2008 19:38:10 SYSTEM 1556 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ssttt.dll" file.
07/01/2008 20:38:13 SYSTEM 1556 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\ddccy.dll" file.
07/01/2008 21:38:11 SYSTEM 1556 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\awvtq.dll" file.
0
Réponse 3 / 4
drylo Messages postés 10 Statut Membre
 
et un de plus

07/01/2008 21:38:11 SYSTEM 1556 Sign of "Win32:TratBHO [Trj]" has been found in "C:\WINDOWS\system32\mllmk.dll" file.
0
Réponse 4 / 4
drylo Messages postés 10 Statut Membre
 
s il vous plait qqun !!!!!
0

Discussions similaires

exo pix
Xtyller -
Raymond PENTIER -

2 réponses
Combien de combinaison possible avec 3 chiffres
LA MENACE -
Marion_P92 -

14 réponses
Aligner 2 photos côte à côte...
Dri80 -
tkyt -

10 réponses
expressions francaises
bifaka -
lanonyme -

4 réponses
Tableau (croisé dynamique?) à 3 entrées
ClementH3o -
ClementH3o -

10 réponses