win 32 trojano

Question

bonjour, je recherche une bonne ame pour me debarasser de win 32 trojano-2758, j ai fait un scan avec highjackthis mais je n y comprends rien!!!!! merci d avance

balltrap34 · Answer

salutou se trouve ton trojandonne sont emplacement stp

aranjuez31 · Answer

bsrau boulot__________http://www.infogiciel.ca/spy.htm

balltrap34 · Answer

fait la manip qu il ta mis pour aranjuez31 pour les r0 je suis pas d accord si c est ca page de demarragetu ne le c est pas il faut pas la virer

goury · Answer

voila la manip est faite !! avec du mal,je vous transmet le scan   .Merci de vous occupé de mon cas qui me desespere!!!!!!!!!!!!!!          Logfile of HijackThis v1.99.1Scan saved at 11:38:58, on 01/12/2005Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\SYSTEM32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeE:\ARNO\avast antivirus\aswUpdSv.exeE:\ARNO\avast antivirus\ashServ.exeC:\WINDOWS\System32\drivers\CDAC11BA.EXEC:\WINDOWS\System32\HPConfig.exeC:\PROGRA~1\Iomega\System32\AppServices.exeC:\WINDOWS
etconf32.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeE:\ARNO\avast antivirus\ashWebSv.exeE:\ARNO\avast antivirus\ashMaiSv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\essspk.exeC:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\PROGRA~1\HPONE-~1\OneTouch.EXEC:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exeC:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeC:\WINDOWS\System32\msnq3insller.exeE:\ARNO\AVASTA~1\ashDisp.exeE:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exeC:\program files\mailskinner\mailskinner.exeC:\WINDOWS\System32\msnq3insller.exeC:\Program Files	oud\cuwe.exeE:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exeC:\WINDOWS\System32\wbem\wmiapsrv.exec:\iexplorer.exec:\sxe4.tmpC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\ARN0\Bureau\HijackThis.exeC:\Documents and Settings\ARN0\Bureau\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.frR3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL (file missing)O1 - Hosts: 200.0.1.1 VERPO1 - Hosts: 200.0.1.2 SRVVIDEOO1 - Hosts: 200.0.1.3 VERM1O1 - Hosts: 200.0.1.4 VERM2O1 - Hosts: 200.0.1.127 VERBO1 - Hosts: 200.0.1.254 GTW_VER_E0O1 - Hosts: 200.0.2.1 FAVPO1 - Hosts: 200.0.2.2 PCVIDEOO1 - Hosts: 200.0.2.3 PRINTERO1 - Hosts: 200.0.2.127 FAVBO1 - Hosts: 200.0.2.254 GTW_FAV_E0O1 - Hosts: 200.0.3.1 CTGPCQO1 - Hosts: 200.0.3.2 CTG1O1 - Hosts: 200.0.3.3 CTG2O1 - Hosts: 200.0.3.4 CTG3O1 - Hosts: 200.0.3.5 CTG4O1 - Hosts: 200.0.3.6 CTG5O1 - Hosts: 200.0.3.7 CTG6O1 - Hosts: 200.0.3.8 CTG7O1 - Hosts: 200.0.3.9 CTG8O1 - Hosts: 200.0.3.10 CTG9O1 - Hosts: 200.0.3.127 CTGBO1 - Hosts: 200.0.3.254 GTW_CTG_E0O1 - Hosts: 200.0.4.127 DZEBO1 - Hosts: 200.0.4.253 DZE1O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\System32\efecb.dll (file missing)O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\ARNO\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - C:\PROGRA~1\iFinger\plugins\IE.ifpO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [EssSpkPhone] essspk.exeO4 - HKLM\..\Run: [Paramètres d'affichage HP] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /sO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [CP4HPOT] C:\PROGRA~1\HPONE-~1\OneTouch.EXEO4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "E:\ARNO\Autolaunch.exe"O4 - HKLM\..\Run: [MS Unix Binary] msnq3insller.exeO4 - HKLM\..\Run: [Services] c:\sxe4.tmpO4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exeO4 - HKLM\..\Run: [avast!] E:\ARNO\AVASTA~1\ashDisp.exeO4 - HKLM\..\Run: [Zone Labs Client] E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeO4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exeO4 - HKLM\..\RunServices: [MS Unix Binary] msnq3insller.exeO4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1068.dll,InstantAccessO4 - HKCU\..\Run: [MailSkinner] c:\program files\mailskinner\mailskinner.exeO4 - HKCU\..\Run: [MS Unix Binary] msnq3insller.exeO4 - HKCU\..\Run: [Heth] "C:\Program Files	oud\cuwe.exe" -vt mtO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\System32\SHDOCVW.DLLO14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.frO16 - DPF: {01BE5BD7-B2DD-48B3-A759-59265A91E787} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1064_XP.cabO16 - DPF: {07C9CFC7-DE33-4A0C-9FFB-CDFBA843B157} - http://akamai.downloadv3.com/binaries/EGDAccess/EGDACCESS_1063_XP.cabO16 - DPF: {11F1D260-129E-4EB7-B37E-57E3D97A3DF1} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1044_FR_XP.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1133390760848O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c11.cabO16 - DPF: {95460ABD-946A-46FF-9F56-268718323EEE} - http://scripts.downloadv3.com/binaries/EGDAccess/EGDACCESS_1068_XP.cabO16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/sysinetsvc32_FR_XP.cabO16 - DPF: {C6760A07-A574-4705-B113-7856315922C3} - http://akamai.downloadv3.com/binaries/IA/sysnetsvc32_FR_XP.cabO20 - Winlogon Notify: efecb - efecb.dll (file missing)O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\ARNO\avast antivirus\aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - E:\ARNO\avast antivirus\ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - E:\ARNO\avast antivirus\ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - E:\ARNO\avast antivirus\ashWebSv.exe" /service (file missing)O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exeO23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXEO23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\System32\HPConfig.exeO23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exeO23 - Service: netconf32 - Unknown owner - C:\WINDOWS
etconf32.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Win 32 trojano

4 réponses

Discussions similaires

Newsletters