Windows/System32

Penouille -

Bonjour,
J'ai fait une mise à jour de Windows XP ce matin et depuis mon antivirus AVG n'opère plus. Plus rien.
Avec PC Tools Spyware j'ai souvent le message que le programme "nom quelconque" sous C:|Windows|System32 tente de s'ouvrir mais rencontre un problème.

AVG m'indique "there are no active components" quand je tente d'exécuter le programme.

MERCI à l'avance de m'aider.

Voici mon rapport de Hijacks :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:01, on 2009-05-13
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\TPSMain.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 9827 bytes

Configuration: Windows XP
Firefox 3.0.10

Afficher la suite

A voir également

Windows/System32
Clé windows 8 - Guide
Montage video windows - Guide
Windows 11 - Guide
Fin windows 10 - Guide
Registre windows - Guide

13 réponses

Réponse 1 / 13
hamagil
je te conseille antivir a la place d'AVG : http://www.commentcamarche.net/telecharger/telecharger 55 antivir personal

tu a bien fixer les lignes que je t'ais dit avec hijackthis ?

1

Réagir
1. Penouille Auteur
  
  J'ai installé Avast afin d'avoir un antivirus actif au moins.... Il a trouvé 2 filières infectées dont 1 placée en quarantaine. L'autre j'ai pas pu la restaurer, mettre en quarantaine ni supprimer, j'avais le message "introuvable". Les 2 étaient dans C:|Program files|...SYSTEM 32....
  
  Je ne suis toujours pas capable de désinstaller AVG. J'ai essayé de plusieurs façons.
  
  MERCI de me venir en aide. Je dois m'absenter quelques heures cependant.
  
  Voici un nouveau rapport hijack !
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 07:22, on 2009-05-15
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16827)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Spyware Doctor\pctsAuxs.exe
  C:\Program Files\Spyware Doctor\pctsSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Spyware Doctor\pctsTray.exe
  C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
  C:\WINDOWS\system32\TDispVol.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\Synaptics\SynTP\Toshiba.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
  C:\Program Files\Tall Emu\Online Armor\oaui.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
  O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Claude A Lafleur')
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (User 'Claude A Lafleur')
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Claude A Lafleur')
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Claude A Lafleur')
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'Claude A Lafleur')
  O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrateur')
  O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE (User 'Claude A Lafleur')
  O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (User 'Claude A Lafleur')
  O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 User Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE (User 'Claude A Lafleur')
  O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 User Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (User 'Claude A Lafleur')
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  
  0
  
  Réagir
Réponse 2 / 13
hamagil
ton PC est infecte.
telecharge "MalwareBit AntiMalware" , installe le , met le a jours et lance un scan complet de ton PC ( suprime ce qu'il te trouve ).
lien : https://www.clubic.com/telecharger-fiche215092-malwarebytes-anti-malware.html

coche aussi ça dans hijack et clique sur "fixcheked" ( ce sont des applis inutiles qui ce lancent au demarrage du PC )

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

et desinstalle ça

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

0

Réagir
Réponse 3 / 13
hamagil
comme tu a spybot , tu peux desinstaller "spyware doctor" , ou spybot , au choix
et "AVG security suite" , fais aussi anti-spy.

trop de protections tue la protection , la preuve tu est infecte ( en tout cas il te reste des lignes de code malicieux ),les progs entrent en conflit entre eux

0

Réagir
Réponse 4 / 13
Penouille Auteur
Malaware n'a rien trouvé, aucune infection... j'ai dû le faire en mode échec par contre.
J'ai accès à Internet, mes dossiers et mes courriels.
Le problème est que je n'ai plus d'anti-virus et j'aimerais ré-installer AVG mais ça ne fonctionne pas.

MERCI encore,

0

Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 13
Penouille Auteur
Quand j'essaie d'installer ou désinstaller AVG, voici le message que j'obtiens...

Local machine: installation failed
Installation:
Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
Error 0x80070005

0

Réagir
Réponse 6 / 13
hamagil
tu est toujours infecte ( ou du moins il te reste des traces ).
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

clees de l'infection.
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_CLASSES_ROOT\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-

a cocher et fixer car inutile au demarrage du PC.
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Claude A Lafleur')
O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Claude A Lafleur')
O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-1007\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Claude A Lafleur')
O4 - HKUS\S-1-5-21-2513123473-2066120518-4031470784-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrateur')
O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE (User 'Claude A Lafleur')
O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (User 'Claude A Lafleur')
O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 User Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE (User 'Claude A Lafleur')
O4 - S-1-5-21-2513123473-2066120518-4031470784-1007 User Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE (User 'Claude A Lafleur')

voila l'utilitaire pour desinstaller AVG : http://download.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe

apres telecharge CCLEANER et netois ton PC : http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

0

Réagir
1. Penouille Auteur
  
  à partir du lien que vous m'avez donné pour désinstaller AVG, voici le log :
  
  2009-05-15 22:23:13,218 DEBUG AvgDir param set to C:\Program Files\AVG\AVG8.
  2009-05-15 22:23:13,250 DEBUG AvgDataDir param set to C:\Documents and Settings\All Users\Application Data\avg8.
  2009-05-15 22:23:29,375 INFO AvgRemover runs in attempt number 1
  2009-05-15 22:23:29,375 INFO ***** Services *****
  2009-05-15 22:23:29,375 INFO Processing service avg8emc
  2009-05-15 22:23:29,390 INFO Service avg8emc is not running
  2009-05-15 22:23:29,390 DEBUG Service avg8emc Delete
  2009-05-15 22:23:29,718 DEBUG Service avg8emc RegCleanup
  2009-05-15 22:23:29,812 INFO Processing service avgfws8
  2009-05-15 22:23:30,140 INFO Service avgfws8 is not installed
  2009-05-15 22:23:30,140 DEBUG Service avgfws8 RegCleanup
  2009-05-15 22:23:30,140 DEBUG Registry keys for service avgfws8 are not present
  2009-05-15 22:23:30,140 INFO Processing service avg8wd
  2009-05-15 22:23:30,140 DEBUG Service avg8wd BeforeStop
  2009-05-15 22:23:31,046 WARN Service avg8wd Failed to SetStoppable command (error: e0010127)
  2009-05-15 22:23:31,046 DEBUG Service avg8wd BeforeStop failed
  2009-05-15 22:23:31,046 INFO Service avg8wd is not running
  2009-05-15 22:23:31,046 DEBUG Service avg8wd Delete
  2009-05-15 22:23:31,093 DEBUG Service avg8wd RegCleanup
  2009-05-15 22:23:31,156 INFO Processing service AvgMfx86
  2009-05-15 22:23:31,171 DEBUG Service AvgMfx86 Stop
  2009-05-15 22:24:51,484 DEBUG Service AvgMfx86 Stop failed (error: e0010031), RESTART planned
  2009-05-15 22:24:51,484 DEBUG Service AvgMfx86 Stop failed
  2009-05-15 22:24:51,484 DEBUG Service AvgMfx86 Delete
  
  0
  
  Réagir
Réponse 7 / 13
hamagil
c'est bon , tu a bien reussis a desinstaller AVG ?

a tu fixer les lignes dans hijack ?

0

Réagir
1. Penouille Auteur
  
  voici le nouveau log...
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 18:44, on 2009-05-15
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16827)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  C:\Program Files\Alwil Software\Avast4\ashServ.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Spyware Doctor\pctsAuxs.exe
  C:\Program Files\Spyware Doctor\pctsSvc.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
  C:\WINDOWS\system32\TDispVol.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\Program Files\Synaptics\SynTP\Toshiba.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Spyware Doctor\pctsTray.exe
  C:\Program Files\Tall Emu\Online Armor\oaui.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
  C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
  O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  
  0
  
  Réagir
Réponse 8 / 13
hamagil
tu est toujours infecte.
tu a AVAST et AVG d'installer ? il ne faut jamais installer 2 anti-virus car ils entrent en conflits.
mais AVG a l'air d'etre desinstaller
pour desinstaller avast : https://www.avast.com/fr-fr/uninstall-utility
vire le dossier d'AVG8 dans C:/prog file.
installe antivir apres et lance un scan ( sauf si tu prefere garder AVAST dans ce cas le desinstalle pas et installe pas antivir )
tu peuc aussi faire un scan en ligne pour virer ton infection car AVAST la trouveras peut etre pas ( d'ou antivir ) : http://www.kaspersky.com/kos/eng/partner/71365/pages/default/check.html?n=1242427562960
tu a scane ton PC avec spyware doctor ? car ton infection est un malware

fais aussi un nettoyage du registre avec ccleaner pour virer les restes de tes desinstallations

0

Réagir
1. Penouille Auteur
  
  D'AC. Je vais faire un scan en ligne proposé. Je garde AVAST car AVG meme s'il semble présent n'est plus là.
  Je vais faire CCleaner par la suite.
  Je déposerai un autre hijackthis log après.
  
  MERCI et à bientot
  
  0
  
  Réagir
2. Penouille Auteur
  
  Bon alors j'ai réussi après maintes reprises d'avoir un scan complet mais j'ai dû le faire ne mode sans echec avec Antivir. J'ai désinstallé Avast.
  Je joins le rapport du scan effectué et aussi du log de Hijackthis après le scan complété.
  
  MERCI encore.
  
  Voici le rapport de Antivir après le scan :
  
  Avira AntiVir Personal
  Report file date: 2009-05-17 08:34
  
  Scanning for 1284893 virus strains and unwanted programs.
  
  Licensee : Avira AntiVir Personal - FREE Antivirus
  Serial number : 0000149996-ADJIE-0000001
  Platform : Windows XP
  Windows version : (Service Pack 3) [5.1.2600]
  Boot mode : Save mode
  Username : Huberte Vienneau
  Computer name : HUBERTETOSHIBA
  
  Version information:
  BUILD.DAT : 9.0.0.394 17962 Bytes 2009-04-17 11:20:00
  AVSCAN.EXE : 9.0.3.5 466689 Bytes 2009-04-17 13:57:30
  AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 15:58:24
  LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 16:35:49
  LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 15:58:52
  ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 17:30:36
  ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2009-02-11 01:33:26
  ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 2009-03-03 12:41:14
  ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 2009-03-05 19:58:20
  Engineversion : 8.2.0.100
  AEVDF.DLL : 8.1.1.0 106868 Bytes 2009-01-27 22:36:42
  AESCRIPT.DLL : 8.1.1.56 352634 Bytes 2009-02-27 01:01:56
  AESCN.DLL : 8.1.1.7 127347 Bytes 2009-02-12 16:44:25
  AERDL.DLL : 8.1.1.3 438645 Bytes 2008-10-29 23:24:41
  AEPACK.DLL : 8.1.3.10 397686 Bytes 2009-03-04 18:06:10
  AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2009-02-27 01:01:56
  AEHEUR.DLL : 8.1.0.100 1618295 Bytes 2009-02-25 20:49:16
  AEHELP.DLL : 8.1.2.2 119158 Bytes 2009-02-27 01:01:56
  AEGEN.DLL : 8.1.1.24 336244 Bytes 2009-03-04 18:06:10
  AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-09 19:32:40
  AECORE.DLL : 8.1.6.6 176501 Bytes 2009-02-17 19:22:44
  AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 19:32:40
  AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 13:47:59
  AVPREF.DLL : 9.0.0.1 43777 Bytes 2008-12-05 15:32:15
  AVREP.DLL : 8.0.0.3 155905 Bytes 2009-01-20 19:34:28
  AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 15:32:09
  AVARKT.DLL : 9.0.0.3 292609 Bytes 2009-03-24 20:05:41
  AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 15:37:08
  SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 20:03:49
  SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 13:21:33
  NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 15:32:10
  RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 2009-02-09 16:45:45
  RCTEXT.DLL : 9.0.37.0 86785 Bytes 2009-04-17 15:19:48
  
  Configuration settings for the scan:
  Jobname.............................: Complete system scan
  Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
  Logging.............................: low
  Primary action......................: interactive
  Secondary action....................: ignore
  Scan master boot sector.............: on
  Scan boot sector....................: on
  Boot sectors........................: C:,
  Process scan........................: on
  Scan registry.......................: on
  Search for rootkits.................: on
  Integrity checking of system files..: off
  Scan all files......................: All files
  Scan archives.......................: on
  Recursion depth.....................: 20
  Smart extensions....................: on
  Macro heuristic.....................: on
  File heuristic......................: medium
  Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,
  
  Start of the scan: 2009-05-17 08:34
  
  Starting search for hidden objects.
  The driver could not be initialized.
  
  The scan of running processes will be started
  Scan process 'avscan.exe' - '1' Module(s) have been scanned
  Scan process 'avcenter.exe' - '1' Module(s) have been scanned
  Scan process 'pctsTray.exe' - '1' Module(s) have been scanned
  Scan process 'pctsSvc.exe' - '1' Module(s) have been scanned
  Scan process 'explorer.exe' - '1' Module(s) have been scanned
  Scan process 'pctsAuxs.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'aawservice.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'svchost.exe' - '1' Module(s) have been scanned
  Scan process 'lsass.exe' - '1' Module(s) have been scanned
  Scan process 'services.exe' - '1' Module(s) have been scanned
  Scan process 'winlogon.exe' - '1' Module(s) have been scanned
  Scan process 'csrss.exe' - '1' Module(s) have been scanned
  Scan process 'smss.exe' - '1' Module(s) have been scanned
  15 processes with 15 modules were scanned
  
  Starting master boot sector scan:
  Master boot sector HD0
  [INFO] No virus was found!
  
  Start scanning boot sectors:
  Boot sector 'C:\'
  [INFO] No virus was found!
  
  Starting to scan executable files (registry).
  The registry was scanned ( '62' files ).
  
  Starting the file scan:
  
  Begin scan in 'C:\' <S3A2422D002FR>
  C:\pagefile.sys
  [WARNING] The file could not be opened!
  [NOTE] This file is a Windows system file.
  [NOTE] This file cannot be opened for scanning.
  C:\WINDOWS\PSEXESVC.EXE
  [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
  
  Beginning disinfection:
  C:\WINDOWS\PSEXESVC.EXE
  [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
  [NOTE] The file was moved to '4a5524a5.qua'!
  
  End of the scan: 2009-05-17 10:50
  Used time: 2:15:50 Hour(s)
  
  The scan has been done completely.
  
  6260 Scanned directories
  271320 Files were scanned
  1 Viruses and/or unwanted programs were found
  0 Files were classified as suspicious
  0 files were deleted
  0 Viruses and unwanted programs were repaired
  1 Files were moved to quarantine
  0 Files were renamed
  1 Files cannot be scanned
  271318 Files not concerned
  7077 Archives were scanned
  1 Warnings
  2 Notes
  
  Rapport HIJACKTHIS :
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 11:17, on 2009-05-17
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16827)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Spyware Doctor\pctsAuxs.exe
  C:\Program Files\Spyware Doctor\pctsSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
  C:\WINDOWS\system32\TDispVol.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Synaptics\SynTP\Toshiba.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Spyware Doctor\pctsTray.exe
  C:\Program Files\Tall Emu\Online Armor\oaui.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
  O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  
  0
  
  Réagir
Réponse 9 / 13
Penouille Auteur
J'ai enlevé Avast et installé Antivir... le système arrête à environ 73 ou 74 % lors du scan.
J'essaie toujours de faire un scan complet.

Je procèderai à un hijackthis dès que j'aurai un scan complété avec l'antivirus.

à bientot

0

Réagir
Réponse 10 / 13
hamagil
on dirais que ta 1ere "infection" est revenue.
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

desinstalle la toolbar , a part ça ça vas.

suprime la askbar.Dll dans "c:\program files\askbardis\bar\bin\askbar.dll". ( ou le dossier complet ).
ou passe un coup de sdfix : https://www.malekal.com/slenfbot-still-an-other-irc-bot/

tu a toujours pas suprimer le dossier d'instal d'AVG8 , dans C:/prog file ( vire le dossier AVG ).

ton rapport antivir est clean , il a fait son travail

0

Réagir
1. Penouille Auteur
  
  Je n'arrive toujours pas à désinstaller AVG convenablement. Il n'est pas en fonction mais ses filières sont toujours dans C:Program files|etc.
  
  Dans le log de HIJACKTHIS : Quelle est cette ligne ? Est-ce un virus encore ?
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  
  Je vais installer SDFIX...
  
  MERCI
  
  Voici le log que je viens de faire avec HIJACKTHIS (avant SDFIX).
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 19:43, on 2009-05-17
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16827)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\WINDOWS\system32\DVDRAMSV.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Spyware Doctor\pctsAuxs.exe
  C:\Program Files\Spyware Doctor\pctsSvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
  C:\WINDOWS\system32\TDispVol.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Synaptics\SynTP\Toshiba.exe
  C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\system32\TPSMain.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
  C:\WINDOWS\system32\TPSBattM.exe
  C:\Program Files\Spyware Doctor\pctsTray.exe
  C:\Program Files\Tall Emu\Online Armor\oaui.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
  C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\RAMASST.exe
  C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Outlook Express\msimn.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/?gws_rd=ssl
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
  O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
  O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
  O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
  O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
  O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
  O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
  O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
  O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
  O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
  O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Tall Emu\Online Armor\oasrv.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
  
  0
  
  Réagir
Réponse 11 / 13
Penouille Auteur
Je n'ai pas pu copier le rapport SDFix... je n'arrive pas non plus à le retracer dans mes documents.

J'ai trouvé ceci d'ailleurs sur mon "bureau", un icone "catchme" :

file copied: C:\WINDOWS\system32\upnpui.dll -> C:\WINDOWS\temp\SDFix_Filecheck\upnpui.dll ( 240128 bytes )
file copied: C:\WINDOWS\explorer.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\explorer.exe ( 1037824 bytes )
file copied: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\lsass.exe ( 13312 bytes )
file copied: C:\WINDOWS\system32\services.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\services.exe ( 111104 bytes )
file copied: C:\WINDOWS\system32\spoolsv.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\spoolsv.exe ( 57856 bytes )
file copied: C:\WINDOWS\system32\svchost.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\svchost.exe ( 14336 bytes )
file copied: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\temp\SDFix_Filecheck\SF\winlogon.exe ( 512000 bytes )
file copied: C:\WINDOWS\system32\user32.dll -> C:\WINDOWS\system32\dllcache\user32.dll ( 579584 bytes )

0

Réagir
Réponse 12 / 13
Penouille Auteur
Autre problème :

Quand j'ouvre un document Word ou Excel j'ai ce message qui m'apparaît à l'écran :

C:\Documents and settings\nom du dossier\Mesdocuments\Nom du répertoire\Nom du fichier... est actuellement utilisé par un autre utilisateur. Voulez-vous faire une copie ?

Aussi après un petit laps de temps si je n'ai pas cliqué sur Oui ou Annuler l'écran devient blanc si je déplace ma souris. J'ai dû fermer le fichier avec le gestionnaire de tâches.

Je dois toujours avoir un problème à quelque part mais ne sait comment le régler.

MERCI.

0

Réagir
Réponse 13 / 13
hamagil
pour ton prob excel , je vois pas , je ne connais pas ce prog ( son fonctionnement ).
pour ton raport SDFIX , normalement en executant sdfix sur le bureau , le rapport s'ouvre a la fin du scan ( apres le redemarrage du PC ), tu a juste a le sauvegarder ou tu veux.
si tu utilise sdfix dans un dossier particulier , le log doit aussi s'ouvrir a la fin du prog.

tu a toujours pas virer le dossier d'AVG8 , dans C:/Prog Files

ton log hijack ( celui avant sdfix ) est clean.
mais si tu me dis que tu a desinstalle AVG8 , a tu installer un autre anti-virus a la place ? , je n'en vois aucune trace.
mais c'est vrai que tu dois desinstaller AVG8 proprement avant.
telecharge et netois ton PC avec CCLEANER , pour virer les traces de tes anciens progs
ccleaner : http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner

et vire le dossier d'instal d'AVG8 dans C:/Progs Files ( avant de lancer ccleaner )

coche et fixe ça :
C:\Program Files\MSN Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messeng er\msnmsgr.exe" /background
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

0

Réagir
1. Penouille Auteur
  
  D'accord ... je dois m'absenter quelques heures et je m'en occupe dès mon retour.
  
  à bientot et MERCI encore
  
  0
  
  Réagir

Newsletters