Trojan horse

romain - Dernière réponse le 31 juil. 2004 à 01:20

bonjour je souhaiterai savoir comment se débarrasser de "the trojan horse TR/Dlr.Wintri.BC.1 "paske moi j y arrive pa et sa commence a me prendre la téte alors je ne dirai k une chose "HELP !! " merci d avance !

Trojan horse »

Suggestions

Trojan horse
Introduction aux chevaux de Troie » Articles
Télécharger Trojan Remover » Télécharger
Virus Trojan horse naviPromo0 (Résolu) » Forum
Virus : Trojan Horse dialer.21.K (Résolu) » Forum
Virus trojan horse (Résolu) » Forum
[trojan horse "TR/Startpage.qr.DLL"] svp (Résolu) » Forum
Trojan horse Downloader.Small.14 X (Résolu) » Forum
Virus trojan horse PSW banker 4 !!! help !!! (Résolu) » Forum
Trojan horse TR/Dldr.Conhook.Gen (Résolu) » Forum

Plus

Réponse

bernie61 5 juil. 2004 à 21:44

Salut
Pour un trojan, toujours même procédure: l'effacer là où il est selon ton alerte; c'est plus facile si tu effaces en mode sans échec ou VGA et s'il est dans Restore ou System Volume... alors désactiver restauration système sur XP ou windowsMe;
A+

Ajouter un commentaire

Réponse

romain 5 juil. 2004 à 21:49

toujours pa d réponse a mon probléme : j ai un trojan horse mon antivirus le détecte j le supprime mai a chak foi ke je redémarre mon PC il revient j ai téléchargé antitrojan shield et trojan remover mai ils ne détecte rien QUE FAIRE ? je n y connai pa grand chose alors si quelqu un pouvait m ai der sa serait sympa MERCI

Ajouter un commentaire

Réponse

bernie61 5 juil. 2004 à 21:54

Re salut
ouvre le fichier .log de ton antivirus pour savoir où est ton trojan si tu sais plus et suis le post 1 ci-dessus
A+

Ajouter un commentaire

Afficher les 5 commentaires

romain - 5 juil. 2004 à 22:06

voila ce k il ya dans log :05/07/2004,21:59 AVGuard has scanned the following file:
C:\DOCUMENTS AND SETTINGS\ROMAIN\BUREAU\TRJSETUP.EXE
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,21:59 AVGuard has scanned the following file:
C:\DOCUMENTS AND SETTINGS\ROMAIN\BUREAU\NFS UNDERGROUND.LNK
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,21:59 AVGuard has scanned the following file:
C:\PROGRAM FILES\WINRAR\RAREXT.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,21:59 AVGuard has scanned the following file:
C:\PROGRAM FILES\EA GAMES\NFS UNDERGROUND\SPEED.EXE
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000064
05/07/2004,21:59 AVGuard has scanned the following file:
C:\PROGRA~1\TROJAN~1\TRSHLEX.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,21:59 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\SYNCUI.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,21:59 AVGuard has scanned the following file:
C:\PROGRAM FILES\AVPERSONAL\AVSHLEXT.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\DOCUMENTS AND SETTINGS\ALL USERS\MENU DéMARRER\PROGRAMMES\ACCESSOIRES\OUTILS SYSTèME\NETTOYAGE DE DISQUE.LNK
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\ALL USERS\MENU DéMARRER\PROGRAMMES\ADOBE
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\SHGINA.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\DUSER.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\MSGINA.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\ODBC32.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\ODBCINT.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\RESOURCES\THEMES\LUNA\SHELL\NORMALCOLOR\SHELLSTYLE.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\DOCUMENTS AND SETTINGS\VIDAL GUILLAUME\MES DOCUMENTS\DESKTOP.INI
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\WIASHEXT.DLL
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\WINDOWS\SYSTEM32\STI.DLL
[INFO] User access to the file has been allowed.
Requesting PID=1928 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 AVGuard has scanned the following file:
C:\UNWISE.EXE
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000060
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\DIRECTX
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000010
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\EMULE
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\COMPLUS APPLICATIONS
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\EA GAMES
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\COMMON FILES
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\FICHIERS COMMUNS
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\CLEANER 5 EZ
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\AVPERSONAL
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:00 AVGuard has scanned the following file:
C:\PROGRAM FILES\AVPERSONAL\DELUS.EXE
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000860
05/07/2004,22:00 AVGuard has scanned the following file:
C:\PROGRAM FILES\AVPERSONAL\AVNT.EXE
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000860
05/07/2004,22:00 WARNING: AVGuard detected a problem in the file
C:\PROGRAM FILES\AVPERSONAL\INFECTED
[ERROR] Unable to open the file [13].
Error Code: 13
INFO: The access to the file has been denied!
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00004020
05/07/2004,22:02 AVGuard has scanned the following file:
C:\RECYCLER\S-1-5-21-1715567821-436374069-839522115-1005\INFO2
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=OPEN DesiredAccess=0x00000001 CreateOptions=0x00000860
05/07/2004,22:02 AVGuard has scanned the following file:
C:\RECYCLER\S-1-5-21-1715567821-436374069-839522115-1005\INFO2
[INFO] User access to the file has been allowed.
Requesting PID=652 Mode=CLOSE DesiredAccess=0x00000002 CreateOptions=0x00000860

Karina - 5 juil. 2004 à 23:18

Bonjour,
Moi aussi j'ai le probleme des chevaux :o( . Et pour en revenir au conseil numero 1 : comment fait on pour effacer les virus Troj en mode sans echec ???
Merci beaucoup
Karine

bernie61 › bernie61 - 5 juil. 2004 à 23:22

Salut
toutes les explications là selon ton sysème:
http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020905112131924
A+

Karine - 5 juil. 2004 à 23:29

Merci Bernie,
Je vais essayer en suivant les conseils du lien...
Karine

Réponse

Thomas 8 juil. 2004 à 11:54

Bien le bonjour.
De mon côté, le Trojan Horse a eu la bonne idée de se mettre sur mon anti virus. (Symantec, dans le system32 pour faciliter les choses).
Donc quand j'essaye de le supprimer, il refuse vu qu'il est sur un programme ouvert
Et vu que c'est sur un portable que le boulot a prêté durant lecongé maternité, j'hésite à supprimer des applica

Ajouter un commentaire

Réponse

bernie61 8 juil. 2004 à 21:10

Salut
Alors lis et applique ceci:
http://www.lacave.net/~jokeuse/usenet/faq-fcsv.html#a8.5
A+

Ajouter un commentaire

Réponse

Gaelgroove 31 juil. 2004 à 01:20

Salut a tous.
Pour tous les petits problémes de ce genre rien de telle qu'un petit tour dans la base des registres.
Menu démarrer,exécuter et vous tapez Regedit.
Puis dans edition,rechercher et là vous tapez le noms du trojan plusieur fois,effacer dans la partie de droite les lignes qui comporte
le NOM.
Retapez le nom dans rechcher jusqu'a la fenêtre: Recherch dans le registre terminé.
Voilà,il n'y à plus qu'a essayer.
Gaelgroove de Lens.@+

Ajouter un commentaire

Répondre au sujet

Posez votre question

Dossier à la une

5 extensions si vous voulez revenir à l'ancien Facebook

5 extensions si vous voulez revenir à l'ancien Facebook

Vous n'aimez pas le lifting de Facebook ? Le site Mashable propose cinq étapes pour revenir à l'ancienne présentation du réseau social.

Les interviews exclusives

Bazando fidélise ses clients avec les Facebook credits

Toutes les interviews

Collection CommentÇaMarche.net

Jean-François Pillou

Tout sur les réseaux et Internet : Concevoir et sécuriser son réseau

Plus de livres

Trojan horse

Trojan horse »

5 extensions si vous voulez revenir à l'ancien Facebook

"un outil vraiment simple à la portée de tous"

Tout pour bien utiliser l'iPad

Tout sur les réseaux et Internet : Concevoir et sécuriser son réseau

Tout pour bien utiliser Word 2010

Tout pour bien débuter avec Windows 7

Tout sur les outils Google : Découvrez la galaxie des services Google