Se connecter avec
S'enregistrer | Connectez-vous

Win32:Trojan-gen

Dernière réponse : dans Sécurité

Bonjour je sais que ce sujet a déja été posté mais vue que l'on y demande les raports "HijackThis" (et évidement je n'ai pas les meme raport que ces perssonnes).
Donc voila j'ai le virus "Win32:Trojan-gen" et je voudrais avoir une solution pour le réparer (j'ai aussi plein de fenètres pour des antivirus soi-disant gratuits qui s'avèrent payants par la suite qui s'autorise a aparaitre a n'importe quel moment).
Et surtout je n'ai pas envie de formater mon PC.
[:ahm86funky:8] à tous ceux qui pouront m'apporter une solution.

Autres pages sur : win32 trojan gen

Lassé par la pub ? Créez un compte

Mon raport HijackThis:

Logfile of HijackThis v1.99.1
Scan saved at 18:16:56, on 14/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Florent.FAMILLE\Bureau\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\poeutmjx.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: .protected
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.drivecleaner.com/installdrivecleanerstart_fr...
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.ca...
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll MsgPlusLoader.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

Bonjour,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
  • Double-clique VundoFix.exe afin de le lancer
  • Clique sur le bouton Scan for Vundo
  • Lorsque le scan est complété, clique sur le bouton Remove Vundo
  • Une invite te demandera si tu veux supprimer les fichiers, clique YES
  • Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
  • Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
  • Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

    Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

    raport vundo:

    C:\WINDOWS\system32\antvysdu.dll
    C:\WINDOWS\system32\bejwowff.dll
    C:\WINDOWS\system32\booxlgnn.dll
    C:\WINDOWS\system32\cgfenpua.dll
    C:\WINDOWS\system32\dslltaut.exe
    C:\WINDOWS\system32\hchtygoj.dll
    C:\WINDOWS\system32\hggfefg.dll
    C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.bak2
    C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\hgjlm.ini2
    C:\WINDOWS\system32\hxuojjbq.exe
    C:\WINDOWS\system32\iifgfff.dll
    C:\WINDOWS\system32\jfsnnkbt.exe
    C:\WINDOWS\system32\jhcqrnjq.dll
    C:\WINDOWS\system32\jhgvyfyc.exe
    C:\WINDOWS\system32\jyuqwjnc.dll
    C:\WINDOWS\system32\lmuydiga.dll
    C:\WINDOWS\system32\mggcbnqv.dll
    C:\WINDOWS\system32\mhjvlbtg.dll
    C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\mpaarwnl.exe
    C:\WINDOWS\system32\oalswovl.dll
    C:\WINDOWS\system32\olwsnftb.dll
    C:\WINDOWS\system32\oxljijry.exe
    C:\WINDOWS\system32\potjcmch.dll
    C:\WINDOWS\system32\rspiwleh.dll
    C:\WINDOWS\system32\tbxrkypc.exe
    C:\WINDOWS\system32\thukycyb.dll
    C:\WINDOWS\system32\tosifvml.exe
    C:\WINDOWS\system32\uysbllvm.dll
    C:\WINDOWS\system32\winpsa32.dll
    C:\WINDOWS\system32\wivohdav.exe
    C:\WINDOWS\system32\xgpkwejp.dll
    C:\WINDOWS\system32\xidtksuf.exe
    C:\WINDOWS\system32\xxcmrhnt.dll
    C:\WINDOWS\system32\ypstdced.dll
    C:\WINDOWS\system32\ywehgump.exe



    raport hijcakthis:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:09:13, on 14/03/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\savedump.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Documents and Settings\Florent.FAMILLE\Bureau\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - C:\DOCUME~1\Florent2\MESDOC~2\nf\IEBUTT~1.DLL (file missing)
    O2 - BHO: (no name) - {4C4BD312-590A-4B21-A51A-F742959A8819} - C:\WINDOWS\system32\rjwkqpfk.dll
    O2 - BHO: (no name) - {56CF0B3C-3681-7578-CEDD-08344D0D664B} - C:\WINDOWS\system32\mngwlni.dll (file missing)
    O2 - BHO: (no name) - {6CEFB00A-A93D-472F-B6FE-86E4824BADD2} - C:\WINDOWS\system32\kbdblr32.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
    O2 - BHO: (no name) - {A2AD7E81-5B77-4FBC-BCFA-BB648AA9A669} - C:\WINDOWS\system32\d3dim32.dll (file missing)
    O2 - BHO: (no name) - {A7DACF6A-5088-4C6C-A3D8-142DCBB7CB5c} - C:\WINDOWS\system32\rjwkqpfk.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {B07CB267-5E6F-441F-9B3C-324EFE70F897} - C:\WINDOWS\system32\hggfefg.dll (file missing)
    O2 - BHO: (no name) - {B27F4A68-C3E9-4CE8-B8E5-4BA30E7F98ED} - C:\WINDOWS\system32\mljgh.dll (file missing)
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (file missing)
    O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (file missing)
    O2 - BHO: (no name) - {CC32529E-1B49-46DF-8CFE-C8CB25C3A0B8} - C:\WINDOWS\system32\rjwkqpfk.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
    O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\jsxxdvdr.dll",setvm
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: .protected
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.ca...
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll MsgPlusLoader.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

    ho voila je l'ai trouver (il ét dans c: tout cour)
    donc voila le raport vundo:


    VundoFix V6.3.6

    Checking Java version...

    Java version is 1.5.0.6

    Java version is 1.5.0.9

    Scan started at 17:44:00 18/02/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\mljgh.dll

    VundoFix V6.3.16

    Checking Java version...

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Scan started at 18:53:46 14/03/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\antvysdu.dll
    C:\WINDOWS\system32\bejwowff.dll
    C:\WINDOWS\system32\booxlgnn.dll
    C:\WINDOWS\system32\cgfenpua.dll
    C:\WINDOWS\system32\dslltaut.exe
    C:\WINDOWS\system32\hchtygoj.dll
    C:\WINDOWS\system32\hggfefg.dll
    C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.bak2
    C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\hgjlm.ini2
    C:\WINDOWS\system32\hxuojjbq.exe
    C:\WINDOWS\system32\iifgfff.dll
    C:\WINDOWS\system32\jfsnnkbt.exe
    C:\WINDOWS\system32\jhcqrnjq.dll
    C:\WINDOWS\system32\jhgvyfyc.exe
    C:\WINDOWS\system32\jyuqwjnc.dll
    C:\WINDOWS\system32\lmuydiga.dll
    C:\WINDOWS\system32\mggcbnqv.dll
    C:\WINDOWS\system32\mhjvlbtg.dll
    C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\mpaarwnl.exe
    C:\WINDOWS\system32\oalswovl.dll
    C:\WINDOWS\system32\olwsnftb.dll
    C:\WINDOWS\system32\oxljijry.exe
    C:\WINDOWS\system32\potjcmch.dll
    C:\WINDOWS\system32\rspiwleh.dll
    C:\WINDOWS\system32\tbxrkypc.exe
    C:\WINDOWS\system32\thukycyb.dll
    C:\WINDOWS\system32\tosifvml.exe
    C:\WINDOWS\system32\uysbllvm.dll
    C:\WINDOWS\system32\winpsa32.dll
    C:\WINDOWS\system32\wivohdav.exe
    C:\WINDOWS\system32\xgpkwejp.dll
    C:\WINDOWS\system32\xidtksuf.exe
    C:\WINDOWS\system32\xxcmrhnt.dll
    C:\WINDOWS\system32\ypstdced.dll
    C:\WINDOWS\system32\ywehgump.exe

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\antvysdu.dll
    C:\WINDOWS\system32\antvysdu.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\bejwowff.dll
    C:\WINDOWS\system32\bejwowff.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\booxlgnn.dll
    C:\WINDOWS\system32\booxlgnn.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\cgfenpua.dll
    C:\WINDOWS\system32\cgfenpua.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\dslltaut.exe
    C:\WINDOWS\system32\dslltaut.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hchtygoj.dll
    C:\WINDOWS\system32\hchtygoj.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hggfefg.dll
    C:\WINDOWS\system32\hggfefg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hgjlm.bak2
    C:\WINDOWS\system32\hgjlm.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\hgjlm.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hgjlm.ini2
    C:\WINDOWS\system32\hgjlm.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\hxuojjbq.exe
    C:\WINDOWS\system32\hxuojjbq.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jfsnnkbt.exe
    C:\WINDOWS\system32\jfsnnkbt.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jhcqrnjq.dll
    C:\WINDOWS\system32\jhcqrnjq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jhgvyfyc.exe
    C:\WINDOWS\system32\jhgvyfyc.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jyuqwjnc.dll
    C:\WINDOWS\system32\jyuqwjnc.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\lmuydiga.dll
    C:\WINDOWS\system32\lmuydiga.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mggcbnqv.dll
    C:\WINDOWS\system32\mggcbnqv.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mhjvlbtg.dll
    C:\WINDOWS\system32\mhjvlbtg.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\mljgh.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mpaarwnl.exe
    C:\WINDOWS\system32\mpaarwnl.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\oalswovl.dll
    C:\WINDOWS\system32\oalswovl.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\olwsnftb.dll
    C:\WINDOWS\system32\olwsnftb.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\oxljijry.exe
    C:\WINDOWS\system32\oxljijry.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\potjcmch.dll
    C:\WINDOWS\system32\potjcmch.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\rspiwleh.dll
    C:\WINDOWS\system32\rspiwleh.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\tbxrkypc.exe
    C:\WINDOWS\system32\tbxrkypc.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\tosifvml.exe
    C:\WINDOWS\system32\tosifvml.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\uysbllvm.dll
    C:\WINDOWS\system32\uysbllvm.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\winpsa32.dll
    C:\WINDOWS\system32\winpsa32.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\wivohdav.exe
    C:\WINDOWS\system32\wivohdav.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xgpkwejp.dll
    C:\WINDOWS\system32\xgpkwejp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xidtksuf.exe
    C:\WINDOWS\system32\xidtksuf.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\xxcmrhnt.dll
    C:\WINDOWS\system32\xxcmrhnt.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ypstdced.dll
    C:\WINDOWS\system32\ypstdced.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ywehgump.exe
    C:\WINDOWS\system32\ywehgump.exe Has been deleted!

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    VundoFix V6.3.16

    Checking Java version...

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Scan started at 19:24:41 14/03/2007

    Listing files found while scanning....

    No infected files were found.


    Beginning removal...

    Logfile of HijackThis v1.99.1
    Scan saved at 19:54:38, on 14/03/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\lg_fwupdate\fwupdate.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
    C:\Documents and Settings\Florent.FAMILLE\Bureau\hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - C:\DOCUME~1\Florent2\MESDOC~2\nf\IEBUTT~1.DLL (file missing)
    O2 - BHO: (no name) - {4C4BD312-590A-4B21-A51A-F742959A8819} - C:\WINDOWS\system32\rjwkqpfk.dll
    O2 - BHO: (no name) - {56CF0B3C-3681-7578-CEDD-08344D0D664B} - C:\WINDOWS\system32\mngwlni.dll (file missing)
    O2 - BHO: (no name) - {6CEFB00A-A93D-472F-B6FE-86E4824BADD2} - C:\WINDOWS\system32\kbdblr32.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
    O2 - BHO: (no name) - {A2AD7E81-5B77-4FBC-BCFA-BB648AA9A669} - C:\WINDOWS\system32\d3dim32.dll (file missing)
    O2 - BHO: (no name) - {A7DACF6A-5088-4C6C-A3D8-142DCBB7CB5c} - C:\WINDOWS\system32\rjwkqpfk.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {B07CB267-5E6F-441F-9B3C-324EFE70F897} - C:\WINDOWS\system32\hggfefg.dll (file missing)
    O2 - BHO: (no name) - {B27F4A68-C3E9-4CE8-B8E5-4BA30E7F98ED} - C:\WINDOWS\system32\mljgh.dll (file missing)
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll (file missing)
    O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll (file missing)
    O2 - BHO: (no name) - {CC32529E-1B49-46DF-8CFE-C8CB25C3A0B8} - C:\WINDOWS\system32\rjwkqpfk.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\MI-4500X WIRELESS OPTICAL MOUSE\Mouse32a.exe
    O4 - HKLM\..\Run: [EPSON Stylus CX6400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\jsxxdvdr.dll",setvm
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: .protected
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.ca...
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls...
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClie...
    O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPACl...
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.ca...
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll MsgPlusLoader.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

    Bonjour a tous,

    J'ai choper le virus win32 trojan-gen et après un redémarage AVAST m'a trouvé 4 fichiers et les a supprimés; Mais j'ai l'impresion que mon ordi rame un peu es ce normal : ci-dessous le rapport de hijackthis

    Merci de votre aide


    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Lassé par la pub ? Créez un compte

    Créer un nouveau sujet

    Tom's guide dans le monde