Sujet Précédent Sujet Suivant

Trop dur pour nous

Fermé
brm - 31 déc. 2008 à 14:20
broumstick Messages postés 22 Date d'inscription mercredi 31 décembre 2008 Statut Membre Dernière intervention 6 décembre 2009 - 2 janv. 2009 à 14:42
Bonjour,

Histoire de bien finir l année, nous nous sommes vu méchamment infectés.
Premiers signes: un explorateur net qui vous redirige à loisir + malwarebytes, spybot, ad aware inopérants (impossibles à lancer)
Après bien des efforts, un passage sous f-prot et elistarA a permis de récupérer les fonctionnalités de malwarebytes et spy bot. ad aware se mets aussi à jour. néanmoins, après désinfection, le pc est extrêmement lent. d'après nos recherches, il semblerait que nous étions infectés par "fakealert" qui se manifeste sous des entrées "tdss".
Tous les fichiers tdss on été éliminés manuellement du système, mais après une ballade dans les clefs de registres, il reste des entrées.

aujourd'hui malwarebyte, spybot, elistarA, f-prot ,avast, bit defender scan online ne trouvent rien (le tout MAJ). seul ad-aware trouve "fakealert" sans pouvoir l éliminer.

Aidez moi, obiwan kenobi, vous êtes notre seul espoir^^
Merci à ceux qui se pencheront sur notre problème, et bonnes fêtes a tous
A voir également:

93 réponses

Précédent
Réponse 41 / 93
Utilisateur anonyme
31 déc. 2008 à 18:19
Re,

NON .

Fait ce que je t'es demander et ensuite tu me poste le rapport et tu reéssaira combofix.
0
Réponse 42 / 93
broumstick
31 déc. 2008 à 19:06
wowowow on se retrouve avec un autre antivir. nous demandions juste une analyse de la base de registre. ne sommes nous pas en train de nous égarer? au départ, nous demandions de l aide pour purger de maniere "sure" les clefs de registre relationnée "tdss" les manips effectuées jusqu'à presents, n'ont eliminés aucune entrée de la base de registre. Sommes nous sur la bonne voie? un scan en mode sans échec, sur avast c'est un minimum de 18h chez nous. es tu certain de tes recommandations?
0
Réponse 43 / 93
Utilisateur anonyme
31 déc. 2008 à 19:11
Re,

Fait ce que je te demande n'y plus n'y moins.

Tu es obliger de passer combofix pour les rootkits qui reste.

Sa c'est un reste de beagle que tu as désinfecter a moitié.

Maintenant avast et pas un bonne antivirus.

Si tu veut pas faire ce que je te demande et ben dit le moi et laisse tomber.

Bonne fête de fin d'année.
0
Réponse 44 / 93
broumstick
31 déc. 2008 à 19:21
c etait juste une simple question: on rechigne parfois a executer "bêtement" sans comprendre. nous allons donc lancer les dernieres commandes preconisées. bonnes fêtes a toi aussi :)
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 45 / 93
Utilisateur anonyme
31 déc. 2008 à 19:23
Re,

OKI.

;)
0
Réponse 46 / 93
broumstick
31 déc. 2008 à 19:45
arf, dsl mais nous arrivons dans nos lmites: en mode sans echec, je ne vois pas la moitié de l ecrans de l antivir. aurais tu une manip "standard a suivre pour l executer svp?
0
Réponse 47 / 93
Utilisateur anonyme
31 déc. 2008 à 19:47
Re,

Fait le en mode normal.

Poste moi le rapport ensuite.

A++
0
Réponse 48 / 93
broumstick
31 déc. 2008 à 19:48
OMW, sir :)
0
Réponse 49 / 93
broumstick
31 déc. 2008 à 22:30
Avira AntiVir Personal
Report file date: miércoles, 31 de diciembre de 2008 19:49

Scanning for 1138943 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: HOME-E0D3044181

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 24/12/2008 17:41:47
ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 24/12/2008 17:41:48
ANTIVIR3.VDF : 7.1.1.57 277504 Bytes 31/12/2008 17:41:50
Engineversion : 8.2.0.45
AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56
AESCRIPT.DLL : 8.1.1.19 336252 Bytes 31/12/2008 17:42:01
AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 09:41:39
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 31/12/2008 17:41:59
AEHEUR.DLL : 8.1.0.75 1524087 Bytes 31/12/2008 17:41:57
AEHELP.DLL : 8.1.2.0 119159 Bytes 31/12/2008 17:41:53
AEGEN.DLL : 8.1.1.8 323956 Bytes 31/12/2008 17:41:52
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 31/12/2008 17:41:50
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\archivos de programa\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: miércoles, 31 de diciembre de 2008 19:49

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'FPAVServer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned
Scan process 'SetPoint.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'GoogleDesktop.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'E_FATIACE.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '58' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP269\A0046769.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '498bde72.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP269\A0046770.dll
[DETECTION] Is the TR/Killav.28714 Trojan
[NOTE] The file was moved to '498bde76.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP269\A0046772.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to '498bde7a.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP269\A0046773.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to '498bde7c.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP269\A0046774.dll
[DETECTION] Is the TR/Vundo.NS Trojan
[NOTE] The file was moved to '498bde7e.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP283\A0048324.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.adb back-door program
[NOTE] The file was moved to '498bdec4.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP283\A0048325.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to '498bdec6.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP283\A0048326.dll
[DETECTION] Contains a recognition pattern of the (harmful) BDS/TDSS.KD back-door program
[NOTE] The file was moved to '498bdecb.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP283\A0048328.dll
[DETECTION] Is the TR/Drop.Softomat.AN Trojan
[NOTE] The file was moved to '498bdecd.qua'!
C:\System Volume Information\_restore{CE9DCF16-9E34-4671-BF9D-746F7A84E770}\RP283\A0048329.sys
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '498bdecf.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: miércoles, 31 de diciembre de 2008 22:27
Used time: 2:37:57 Hour(s)

The scan has been done completely.

10778 Scanning directories
404093 Files were scanned
10 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
10 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
404081 Files not concerned
3619 Archives were scanned
2 Warnings
10 Notes
0
Réponse 50 / 93
broumstick
31 déc. 2008 à 22:41
et le hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:43, on 31/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Archivos de programa\Google\Google Desktop Search\GoogleDesktop.exe
C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Logitech\SetPoint\SetPoint.exe
C:\Archivos de programa\Archivos comunes\Logitech\KhalShared\KHALMNPR.EXE
C:\Archivos de programa\Google\Google Desktop Search\GoogleDesktop.exe
C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.es
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {568DF331-063E-46AF-BA3D-FEE69B4399A3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Archivos de programa\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB002" /M "Stylus DX3800"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Archivos de programa\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Archivos de programa\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Archivos de programa\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.es/scan_es/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CF633FC-A68E-481D-BEFF-4830010AD862}: NameServer = 62.14.63.145,62.14.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4CF633FC-A68E-481D-BEFF-4830010AD862}: NameServer = 62.14.63.145,62.14.2.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{4CF633FC-A68E-481D-BEFF-4830010AD862}: NameServer = 62.14.63.145,62.14.2.1
O20 - AppInit_DLLs: C:\ARCHIV~1\Google\GOOGLE~1\GOEC62~1.DLL wgpfaf.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Archivos de programa\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Archivos de programa\Archivos comunes\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer) - FRISK Software International - C:\Archivos de programa\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: Administrador de Google Desktop 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Archivos de programa\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Archivos de programa\ma-config.com\maconfservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
0
Réponse 51 / 93
Utilisateur anonyme
1 janv. 2009 à 00:58
Re,

Vire la quarantaine d'antivir.

Ensuite tu passe combofix.

A++
0
Réponse 52 / 93
broumstick
1 janv. 2009 à 12:04
mal aux cheveux ce matin :p

la quarantaine est virée et combo fix refuse toujours de se lancer.

bonne année :)
0
Réponse 53 / 93
broumstick Messages postés 22 Date d'inscription mercredi 31 décembre 2008 Statut Membre Dernière intervention 6 décembre 2009
1 janv. 2009 à 17:15
Toc toc?
0
Réponse 54 / 93
Utilisateur anonyme
1 janv. 2009 à 18:18
Re,

Refait un scan en mode sans échec avec antivir pour voir.
0
Réponse 55 / 93
broumstick Messages postés 22 Date d'inscription mercredi 31 décembre 2008 Statut Membre Dernière intervention 6 décembre 2009
1 janv. 2009 à 18:33
oki, je vais tester ça. pas trop hs après le reveillon?
0
Réponse 56 / 93
Utilisateur anonyme
1 janv. 2009 à 18:34
Re,

Ben sa va encore .....


Un peut du mal au réveille mais bon cure de cafeine la.
0
Réponse 57 / 93
pierrotdu69330 Messages postés 19 Date d'inscription jeudi 1 janvier 2009 Statut Membre Dernière intervention 4 janvier 2009
1 janv. 2009 à 18:40
c que le logiciel qui trouve les problèmes sans les éliminer est lui meme un virus très difficile a enlever car je l'ai eu
0
Réponse 58 / 93
broumstick
1 janv. 2009 à 22:55
Avira AntiVir Personal
Report file date: jueves, 01 de enero de 2009 18:39

Scanning for 1138943 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Save mode
Username: principal
Computer name: HOME-E0D3044181

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.1.33 1705984 Bytes 24/12/2008 17:41:47
ANTIVIR2.VDF : 7.1.1.34 2048 Bytes 24/12/2008 17:41:48
ANTIVIR3.VDF : 7.1.1.57 277504 Bytes 31/12/2008 17:41:50
Engineversion : 8.2.0.45
AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56
AESCRIPT.DLL : 8.1.1.19 336252 Bytes 31/12/2008 17:42:01
AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 09:41:39
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 31/12/2008 17:41:59
AEHEUR.DLL : 8.1.0.75 1524087 Bytes 31/12/2008 17:41:57
AEHELP.DLL : 8.1.2.0 119159 Bytes 31/12/2008 17:41:53
AEGEN.DLL : 8.1.1.8 323956 Bytes 31/12/2008 17:41:52
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 31/12/2008 17:41:50
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\archivos de programa\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: jueves, 01 de enero de 2009 18:39

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'FPAVServer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
12 processes with 12 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '58' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: jueves, 01 de enero de 2009 22:37
Used time: 3:58:08 Hour(s)

The scan has been done completely.

10645 Scanning directories
362359 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
362357 Files not concerned
2877 Archives were scanned
2 Warnings
0 Notes
@pierrotdu69330: je doute que ad-aware soit un virus, mais merci pour ton interêt sur la question :)
0
Réponse 59 / 93
Utilisateur anonyme
1 janv. 2009 à 22:57
Re,

Refait un scan en mode sans échec avec malwarebyte et pots moi le rapport.

Ensuite tu essai combofix.
0
Réponse 60 / 93
broumstick
2 janv. 2009 à 00:28
oki, on fait ça cette nuit :) puisse le dieux alka seltzer t aider a te retablir ;)
0