Chevale de Troie Avp-sys.exe

Bonjour,

Je suis victime d'un Chevale de Troie "Avp-sys.exe" à chaque démarage Avast me le signale avec ces 4 lignes :

C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\plugin.dat
C:\Users\S.Tapie\AppData\Local\Temp\47455.XXX
C:\Users\S.Tapie\AppData\Local\Temp\47455.YYY
C:\Users\S.Tapie\AppData\Local\Temp\47455.KKK

J'ai tout esseilé ou presque visiblement donc je fais appel à vôtre AIDE.

Merci

Bonjour stephane.T,
Vas faire un scanne en ligne avec IE, ici: http://assiste.com.free.fr/...
A+

Voila c'est fait et voici le raport :

Thursday, March 26, 2009
Operating System: Microsoft Windows Vista Ultimate Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, March 26, 2009 11:00:50
Records in database: 1972240
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area Folder
C:\
Scan statistics
Files scanned 107524
Threat name 1
Infected objects 1
Suspicious objects 0
Duration of the scan 01:09:10

File name Threat name Threats count
C:\Windows\System32\dll32.dll Infected: Trojan.Win32.Agent2.gko 1

UP

PLS HELP ME CA FAT 4 JOURS QUE JE SUIS EN GALERE MMMMEEEERRRRCCCCIIIIIII

RE
Postes un rapport Hijack, il y aura bien quelqu'un pour le regarder.
Telecharges Hijack , tu le lances, tu clic sur "do a scann system and save the log", a la fin, le bloc notes doit s'ouvrir, tu postes le rapport.
A+

merci lacharpente

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:12:37, on 26/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\Voxsync.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Orange\Logiciel de Synchronisation Orange\SyncManager.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\Avp-sys.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\Avp-sys.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\S.Tapie\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php%3Fref%3Dhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [system] C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\Avp-sys.exe
O4 - HKCU\..\Run: [dll] rundll32 dll32,sm
O4 - HKCU\..\Run: [sysyran] C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\Avp-sys.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logiciel de Synchronisation Orange.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

RE
Telecharges Malwarebytes, tu le lances, tu fais la mise a jour, le scanne, tu mets en quarantaine et tu postes le rapport.
A+

RE, voila le journal

Malwarebytes' Anti-Malware 1.34
Version de la base de données: 1903
Windows 6.0.6001 Service Pack 1

26/03/2009 22:37:47
mbam-log-2009-03-26 (22-37-47).txt

Type de recherche: Examen complet (C:\|D:\|H:\|)
Eléments examinés: 183791
Temps écoulé: 30 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 20
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 41

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\Windows\System32\dll32.dll (Backdoor.Bot) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RkHit (Rogue.SpywareCease) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dll (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\S.Tapie\Local Settings\Application Data\cgqgmei_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\cgqgmei_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\cgqgmei.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\kkouu_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\kkouu.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\yicuequ_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\yicuequ_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\yicuequ.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\Local Settings\Application Data\yicuequ.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\dll32.dll (Backdoor.Bot) -> Delete on reboot.
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\2622376.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\2622376.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\2622376.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\2622376.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\29508743.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\29508743.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\29508743.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\29508743.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\3373131.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\3373131.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\3373131.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\3373131.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\47455.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\47455.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\47455.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\47455.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\57221.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\57221.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\57221.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\57221.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\95379.KKK (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\95379.XXX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\95379.YYY (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\95379.ZZZ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\plugin.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\msmark2.dat (Trojan.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\t55ft2792f44.dat (Trojan.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\t55ft2810f44.dat (Trojan.KoobFace) -> Quarantined and deleted successfully.
C:\Users\S.Tapie\AppData\Local\Temp\IXP001.TMP\Avp-sys.exe (Trojan.FakeAlert) -> Delete on reboot.

RE
Jolie lot non. Supprimes cette quarantaine et le rapport dans Malwarebytes, regardes dans ton antivirus si il y a quelque chose en quarantaine, tu supprimes aussi. Supprimes les points de restaurations: https://www.thesiteoueb.net/faq-astuces/fiche-pratique-515-comment-supprimer-les-points-de-restauration-sous-vista.html et redemarres.
Vas recreer un point de restauration: http://www.libellules.ch/restauration_system_vista.php
Ensuite telecharges: Navilog1, , et fais l'option 1, postes le rapport. Regardes Le Tuto pour Vista
A+

RE
Tu peux faire l'options 2 et poster le rapport. As tu d'autres sessions sur ton PC?
Si ton Pc ne redemarres pas tout seul en debut et a la fin de l'option 2, tu le fais manuellement par les boutons du menu demarrer.
Comment se comporte le PC? Quelle version de Firefoxe as tu?
A+

Clean Navipromo version 3.7.6 commencé le 27/03/2009 à 12:13:51,98

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 14.03.2009 à 18h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Intégrale ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz )
BIOS : BIOS Date: 07/13/07 21:27:16 Ver: 08.00.12
USER : S.Tapie ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1229 [VPS 081124-0] 4.8.1229 (Activated)

C:\ (Local Disk) - NTFS - Total:74 Go (Free:39 Go)
D:\ (Local Disk) - FAT32 - Total:279 Go (Free:65 Go)
E:\ (Local Disk) - NTFS - Total:298 Go (Free:145 Go)
F:\ (Local Disk) - NTFS - Total:232 Go (Free:63 Go)
G:\ (Local Disk) - NTFS - Total:465 Go (Free:57 Go)
H:\ (Local Disk) - NTFS - Total:0 Go (Free:0 Go)
I:\ (CD or DVD)
J:\ (USB)
K:\ (USB)

Mode suppression automatique
avec prise en charge résultats Catchme et GNS

Nettoyage exécuté au redémarrage de l'ordinateur

*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *

* Suppression dans "C:\Users\S.Tapie\AppData\Local\Microsoft" *

* Suppression dans "C:\Users\S.Tapie\AppData\Local\virtualstore\windows\system32" *

* Suppression dans "C:\Users\S.Tapie\AppData\Local" *

*** Suppression dossiers dans "C:\Windows" ***

*** Suppression dossiers dans "C:\Program Files" ***

*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***

*** Suppression dossiers dans "C:\ProgramData" ***

*** Suppression dossiers dans c:\users\s2bc3~1.tap\appdata\roaming\micros~1\windows\startm~1\programs ***

*** Suppression dossiers dans "C:\Users\S.Tapie\AppData\Local\virtualstore\Program Files" ***

*** Suppression dossiers dans "C:\Users\S.Tapie\AppData\Local" ***

*** Suppression dossiers dans "C:\Users\S.Tapie\AppData\Roaming" ***

*** Suppression fichiers ***

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\S2BC3~1.TAP\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :

* Dans "C:\Windows\system32" *

* Dans "C:\Users\S.Tapie\AppData\Local\Microsoft" *

* Dans "C:\Users\S.Tapie\AppData\Local\virtualstore\windows\system32" *

* Dans "C:\Users\S.Tapie\AppData\Local" *

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***

*** Nettoyage terminé le 27/03/2009 à 12:18:41,04 ***

Il se comporte plutot mieux mais il m'affiche toujours au démarage "gnc.exe a cesser de fontionner" et je ne sais pas ce que c'est.
Merci encore pour ton aide

RE
GNC.EXE fait partie de navilog, tu as eu ce message avant ou apres le dernier rapport?
Tu ne m'as pas repondu: As tu d'autres sessions sur ton PC? La version de Firefoxe?
Plutot mieux, c'est redevenu normal ou autre?
A+

Je l'ai eu apres le dernier rapport
Non pas d'autre session
Firefox 3.0.1

Et il est lent dans les ouverture d'applications et même dans IE et Gmail Notifier Option il ne lance plus même apres réinstalation

Merci

RE
Desinstalles Navilog1, Via le fichier unins000.exe présent dans le dossier C:\Programmes\navilog1., supprimes ensuite le dossier Navilog1.
Ensuite, mets Firefoxe a jour: https://www.mozilla.org/en-US/
Desinstalles Avast: https://www.avast.com/fr-fr/uninstall-utility
Installes Antivir, plus performant:http://www.commentcamarche.net/telecharger/telecharger 55 antivir personal
Fais les mises a jour sur windows updates si il y en a, ensuite tu redemarres et tu repostes un rapport Hijack.
A+

Pour Avast j'ai la verssion payante , la toute derniere et en français :)
je peux la garder ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:50:29, on 27/03/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\S.Tapie\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?ref=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\Core\smax4pnp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

RE
Apparemment, plus de trace d'infection.
Sauvegardes ton profil Firefoxe: http://support.mozilla.com/fr/kb/Sauvegardez+vos+informations
Desinstalles Firefoxe,et et Gmail Notifier aussi fais un nettoyage: CCleaner pour le registre aussi, il est preregle tu ne modifies rien, fais la sauvegardes demandee.
Ensuite reinstalles Firefoxe et les modules complementaires que tu veux: https://www.mozilla.org/en-US/
Si c'est toujours lent, recrees une autre session et vois si c'est pareil.
A+

Ecoutes tout cela a l'air de bien repartir, encore merci pour tout et quand tu veux si je peux te renvoyer l'appareil.

MERCI you are the best

RE
The Best peu etre pas quand meme LOL, merci du retour. Mets ton post en resolu, en dessus de ton premier message.
A+
PS: Pour Avast, je ne savait pas que tu avait une version payante, si tu pense qu'elle est plus performante que la version gratuite, tu peut la remettre, mais il faut desinstaller Antivir auparavant. Pas deux antivirus sur un PC.