cheval de troie PSW.Agent.AFWE

Question

Configuration: Windows XP / Firefox 3.6.3

bonjour, je suis infecté par un cheval de troie que je n'arrive pas à supprimer...
AVG me détecte sans cesse des fichiers infectés. 
bien que j'en ai mis une vingtaine en quarantaine, d'autres fichiers apparaissent encore...
 avg me detecte PSW.Agent.AFWE et AFCI la plupart du temps dans C/windows/Temp/qkmi(exemple)/svchost.exe

il m'annonce également infecté par SHeur3.QIC

ps: j'ai spybot, CCleaner, Malwarebytes anti malwares, Hijackthis, Listkill'em

si quelqu'un peut m'aider...

merci d'avance!

Jess,sunbelt · Answer

Bonjour

Poste moi un log Hijackthis

Puis va en mode sans échec et lance un scan complet avec avg et Malwarebytes et bien évidement supprime toutes les menaces détectées

archet9 · Answer

Salut,
Juste pour suivre....

Jess,sunbelt · Answer

Dac'

tchulo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:43:44, on 17/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files	rend micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [ewrgetuj] C:\DOCUME~1\julio\LOCALS~1\Temp\geurge.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

tchulo · Answer

ça y est j'ai scanné en mode sans echec...
j'ai viré 2 fichiers avec avg et 2 avec malwarebytes et vidé les quarantaines.

je rescan en mode normal?

Jess,sunbelt · Answer

Non pas besoin tu la fais en mode sans échec

Poste moi le log hijackthis apres le scan 

Tu as une version de Windows antérieur mes le SP3

tchulo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:23, on 17/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files	rend micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Jess,sunbelt · Answer

Ok

Toujours infecté

fais ceci :

télécharge ZHPDiag  (de Nicolas Coolman) https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
Se laisser guider lors de l'installation, le programme se lancera automatiquement à la fin.
Cliquer sur l'icône représentant une loupe (« Lancer le diagnostic »)
Enregistrer le rapport sur le Bureau à l'aide de l'icône représentant une disquette
Héberger le rapport ZHPDiag.txt sur un site tel que http://cijoint.fr
, puis copier/coller le lien fourni dans ton prochun poste .

tchulo · Answer

ZHPDiaRapport de g/MD5 v1.25.1355 par Nicolas Coolman
Run by julio at 18/04/2010 13:40:21
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html

---\ Web Browser
MSIE: Internet Explorer v7.0.5730.11
MFIE: Mozilla Firefox (3.5.3)

---\ System Information
Platform : Microsoft Windows XP (5.1.2600) Service Pack 2
Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1022 MB (39% free)
System drive C: has 19 GB (16%) free of 114 GB

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 19 Go of 114 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 16 Go of 29 Go)
E:\ Hard drive, Flash drive, Thumb drive (Free 8 Go of 47 Go)
F:\ CD-ROM drive (Not Inserted)
G:\ Hard drive, Flash drive, Thumb drive (Free 19 Go of 114 Go)


---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK


---\ Processus lancés
[MD5.B4C1C657FCCCAF24EBF028CE68E6D086] - (.PC Tools - PC Tools Firewall GUI.) -- C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe   [3168216]
[MD5.64E41E8FEE655B03E3F19DED21BA5118] - (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe   [15360]
[MD5.390679F7A217A5E73D756276C40AE887] - (.Safer-Networking Ltd. - System settings protector.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe   [2260480]
[MD5.D2D52012C5A3CD41FEC0F090A8E47EE7] - (.Microsoft Corporation - DLL d'action personnalisée d'installation.) -- C:\WINDOWS\system32	scupgrd.exe   [44544]
[MD5.2911A46A482F1BBE39F47BAC4CF6F609] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\WINDOWS\system32\Ati2evxx.exe   [602112]
[MD5.2B2CC2C47F5DE490F27D4292F0EDC034] - (.Pas de propriétaire - ATI Smart.) -- C:\WINDOWS\system32\ati2sgag.exe   [593920]
[MD5.2979B03D5382A602623C0535B16AB9C0] - (.Microsoft Corporation - Generic Host Process for Win32 Services.) -- C:\WINDOWS\System32\svchost.exe   [14336]
[MD5.A7FA230D63DEDEFBEAD66E566462234F] - (.AVG Technologies CZ, s.r.o. - AVG E-Mail Scanner.) -- C:\Program Files\AVG\AVG9\avgemc.exe   [916760]
[MD5.2EC36C3F9F64FB0B55BA3C43C11293B1] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe   [308064]
[MD5.3C8B6609712F4FF78E521F6DCFC4032B] - (.Creative Technology Ltd - Creative Service for CDROM Access.) -- C:\WINDOWS\system32\CTsvcCDA.exe   [44032]
[MD5.63DCDE1A0D86EEB8924D6738FF616EAD] - (.Microsoft Corporation - Applications Services et Contrôleur.) -- C:\WINDOWS\system32\services.exe   [108544]
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [135664]
[MD5.09417134F248DFCEEA15C72BCC87F592] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe   [153376]
[MD5.C45ED958D60B95E98BACB45F4F2F1649] - (.PC Tools - PC Tools Firewall Plus service.) -- C:\Program Files\PC Tools Firewall Plus\FWService.exe   [818432]
[MD5.259AF82A0932EEA4F316F92DB94707B6] - (.Microsoft Corporation - LSA Shell (Export Version).) -- C:\WINDOWS\system32\lsass.exe   [13312]
[MD5.3978F082274F723AD5A0A8058C2417DD] - (.Analog Devices, Inc. - SoundMAX service agent component.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe   [45056]
[MD5.AD3D9D191AEA7B5445FE1D82FFBB4788] - (.Microsoft Corporation - Spooler SubSystem App.) -- C:\WINDOWS\system32\spoolsv.exe   [57856]


---\ Internet Explorer URLSearchHook (R3)
[MD5.914F39EF1D068737012FF7F90025F848] - (.Microsoft Corporation - Internet Explorer.) -- C:\WINDOWS\system32\ieframe.dll   [6049280]


---\ Browser Helper Objects de navigateur (O2)
[MD5.5CF6190CD875DA6B35256FEE573E7908] - (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll   [75128]
[MD5.62AF967D28EE464C8919CD87C6E6FF86] - (.AVG Technologies CZ, s.r.o. - Safe Search for Internet Explorer.) -- C:\Program Files\AVG\AVG9\avgssie.dll   [1602912]
[MD5.35F73F1936BDE91F1B6995510A61E7A8] - (.Safer Networking Limited - SBSD IE Protection.) -- C:\PROGRA~1\SPYBOT~1\SDHelper.dll   [1562960]
[MD5.8B8F5035D9F686FED66B72A64BA3FAF8] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\WOT\WOT.dll   [1262240]
[MD5.7AF9D3B7B88AF81D2F87AA846DC2EE70] - (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll   [41760]
[MD5.37EDBCC7E5E0B89E59941FF79A2F9746] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter binary.) -- C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll   [73728]


---\ Internet Explorer Toolbars (O3)
[MD5.8B8F5035D9F686FED66B72A64BA3FAF8] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\WOT\WOT.dll   [1262240]


---\ Applications démarrées automatiquement par le registre (O4)


---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)


---\ Winsock hijacker (Layered Service Provider) (O10)
[MD5.6FA2DDF70DC9B762EBF8920F89B6BEA3] - (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Micro.) -- C:\WINDOWS\system32\mswsock.dll   [247808]
[MD5.361E71D790096C2D4A2A9F56D0F0327F] - (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll   [16896]
[MD5.6FA2DDF70DC9B762EBF8920F89B6BEA3] - (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Micro.) -- C:\WINDOWS\system32\mswsock.dll   [247808]


---\ Protocole additionnel et piratage de protocole (O18)
[MD5.B661E7895B0672BC46D5DF7E1266DD94] - (.AVG Technologies CZ, s.r.o. - Safe Search pluggable protocol.) -- C:\Program Files\AVG\AVG9\avgpp.dll   [91416]
[MD5.8B8F5035D9F686FED66B72A64BA3FAF8] - (.Pas de propriétaire - Pas de description.) -- C:\Program Files\WOT\WOT.dll   [1262240]


---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
[MD5.910C5C253DCE1FBA4A902A50A61C5AF9] - (.ATI Technologies Inc. - ATI External Event Utility DLL Module.) -- C:\WINDOWS\System32\Ati2evxx.dll   [155648]
[MD5.EE8FA2FA1E7D8F3A23AE76DDEA5B4A67] - (.AVG Technologies CZ, s.r.o. - AVG Resident Shield Starter.) -- C:\WINDOWS\System32\avgrsstx.dll   [12464]


---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSODL) (O21)
[MD5.D7256CE18090BE360F7AFAEB3F41836D] - (.Microsoft Corporation - Web Site Monitor.) -- C:\WINDOWS\system32\webcheck.dll   [231424]
[MD5.5BF4D66FDCEEE153E7DA36CA919F305F] - (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll   [9131520]
[MD5.5BF4D66FDCEEE153E7DA36CA919F305F] - (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll   [9131520]
[MD5.5B8837602F19CA97E9F6C003ACE7F43D] - (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS\system32\stobject.dll   [122368]
[MD5.045E228F71C31901084B64BE59093499] - (.Microsoft Corporation - Windows Portable Device Shell Service Objec.) -- C:\WINDOWS\system32\WPDShServiceObj.dll   [133632]


---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
[MD5.688721DEDBB428961D40EA898DA337B6] - (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\system32\browseui.dll   [1022976]


---\ Liste des services NT non Microsoft et non désactivés (O23)
[MD5.2911A46A482F1BBE39F47BAC4CF6F609] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\WINDOWS\system32\Ati2evxx.exe   [602112]
[MD5.2B2CC2C47F5DE490F27D4292F0EDC034] - (.Pas de propriétaire - ATI Smart.) -- C:\WINDOWS\system32\ati2sgag.exe   [593920]
[MD5.A7FA230D63DEDEFBEAD66E566462234F] - (.AVG Technologies CZ, s.r.o. - AVG E-Mail Scanner.) -- C:\Program Files\AVG\AVG9\avgemc.exe   [916760]
[MD5.2EC36C3F9F64FB0B55BA3C43C11293B1] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe   [308064]
[MD5.3C8B6609712F4FF78E521F6DCFC4032B] - (.Creative Technology Ltd - Creative Service for CDROM Access.) -- C:\WINDOWS\system32\CTsvcCDA.exe   [44032]
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe   [135664]
[MD5.09417134F248DFCEEA15C72BCC87F592] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe   [153376]
[MD5.C45ED958D60B95E98BACB45F4F2F1649] - (.PC Tools - PC Tools Firewall Plus service.) -- C:\Program Files\PC Tools Firewall Plus\FWService.exe   [818432]
[MD5.3978F082274F723AD5A0A8058C2417DD] - (.Analog Devices, Inc. - SoundMAX service agent component.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe   [45056]


---\ Tâches planifiées en automatique (O39)
[MD5.D7A28ABAE384B983D2EC02C45C065355] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At1.job   [338]
[MD5.B4C139950B10B1F22E67F5AE1DD13F24] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At10.job   [338]
[MD5.6B290119F900FDDD4925199E2D0F38DD] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At11.job   [338]
[MD5.082FC1584FEC4A6457AEBD50F5F43E2D] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At12.job   [338]
[MD5.7D86B4435F02EC9F1E5C4056313C6EB9] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At13.job   [338]
[MD5.A26A09BB051E97884560C7232A266298] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At14.job   [338]
[MD5.2A6A38184A1EE4C35F3C7AA990E12F03] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At15.job   [338]
[MD5.1E509CED3B99FA0969775D12846DB6A5] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At16.job   [338]
[MD5.6506BDB03131CB4B5014ECAFB9D50994] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At17.job   [338]
[MD5.DA45B8A44CB9F3DE1791BDEDF552D091] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At18.job   [338]
[MD5.218AA5EFC79854ABF71A49440DB509A5] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At19.job   [338]
[MD5.F723D7C56A808D088522A19571D66FFD] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At2.job   [338]
[MD5.3420CBCC99C65F6F36BAF962B699FEC0] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At20.job   [338]
[MD5.527E3DE565F40059C1AB9858217F6F71] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At21.job   [338]
[MD5.574362C1BF1F8C66101BCBD35CAC5F89] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At22.job   [338]
[MD5.223237F5F1BD9FA96AB8CE2957051AEC] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At23.job   [338]
[MD5.881B1D1E0C01A6001F534CF1F58A7246] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At24.job   [338]
[MD5.74988449A11E8A03CCE2DB5A2F6C22F7] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At3.job   [338]
[MD5.F94D16BEE28E66492E84B90E4BF2B40B] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At4.job   [338]
[MD5.1A6661E0EF8FE6D020627FCF3D616F29] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At5.job   [338]
[MD5.B48B2F41226DE053A0E47AB8B4B807A9] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At6.job   [338]
[MD5.037E34D24F05815CB51179A4827410BF] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At7.job   [338]
[MD5.3FDA605D6F9393D6AA69C16CACD832CD] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At8.job   [338]
[MD5.81783767731D70828816D52BE3019AB1] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\At9.job   [338]
[MD5.B3F35144B5BD43700E63A1FD5F795FF9] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job   [1048]
[MD5.17A0A1F5B088375D58D4F092BBAA2340] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job   [1052]

tchulo · Answer

---\ Composants installés (ActiveSetup Installed Components) (O40)
[MD5.463A6F355F129C9217F564C935D46C1F] - (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\binegutils.dll   [266240]
[MD5.B9470E48ECD2DDB235135539E784D095] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\msnetmtg.inf   [92736]
[MD5.7D16F9B3B5F18D2B96313DA181618CEE] - (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\INF\wmp.inf   [57762]
[MD5.1240074B72B4F6F2D6AEE92DB1D29AED] - (.Macromedia, Inc. - Macromedia Flash Player 6.0  r79.) -- C:\WINDOWS\system32\macromed\flash\flash.ocx   [832872]

tchulo · Answer

---\ Pilotes lancés au démarrage (O41)

tchulo · Answer

---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)

tchulo · Answer

O44 - LFC:[MD5.EE1EA6F2149F6E0A91CEA746A2405F7A] - 18/04/2010 - 12:36:41 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS\setupapi.log   [2974]
O

tchulo · Answer

O44 - LFC:[MD5.ED3BDB14707AAF25B549155B74BF51DA] - 18/04/2010 - 12:36:36 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\WINDOWS
tbtlog.txt   [195374]

Jess,sunbelt · Answer

Désactive les logiciels de protection (Antivirus, Antispywares) puis :

Télécharge Combofix sUBs : combofix.exe et sauvegarde le sur ton bureau et pas ailleurs! http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double-clic sur combofix, accepte la licence d'utilisation et laisse toi guider.

Eventuellement, installe la console de récupération comme cela est conseillé

Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

tchulo · Answer

merci pour votre aide.... ps: je n'ai pas pu installer sp3 ComboFix 10-04-17.07 - julio 18/04/2010 20:01:30.1.2 - x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1023.584 [GMT 2:00] Lancé depuis: c:\documents and settings\julio\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system\oeminfo.ini c:\windows\system32\LANG\ENGLISH.LNG c:\windows\system32 mp33.tmp Une copie infectée de c:\windows\system32\drivers\i8042prt.sys a été trouvée et désinfectée Copie restaurée à partir de - Kitty had a snack :p . ((((((((((((((((((((((((((((( Fichiers créés du 2010-03-18 au 2010-04-18 )))))))))))))))))))))))))))))))))))) . 2010-04-18 01:04 . 2010-04-18 11:49 -------- d-----w- c:\program files\ZHPDiag 2010-04-07 18:54 . 2010-04-07 18:54 4255072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll 2010-04-07 01:49 . 2010-04-08 23:23 -------- d-----w- c:\documents and settings\julio\Application Data\C5CE9B4803E11E4D3F9272A641A176EA 2010-04-01 18:23 . 2010-04-01 18:23 4076824 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgui.exe 2010-04-01 18:23 . 2010-04-01 18:23 2059544 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtray.exe 2010-04-01 18:23 . 2010-04-01 18:23 1598744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll 2010-04-01 18:23 . 2010-04-01 18:23 1274136 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe 2010-04-01 18:23 . 2010-04-01 18:23 598296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgsrmx.dll 2010-04-01 18:23 . 2010-04-01 18:23 556824 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchjwx.dll 2010-04-01 18:23 . 2010-04-01 18:23 459544 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcclix.dll 2010-04-01 18:23 . 2010-04-01 18:23 313112 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avglogx.dll 2010-04-01 18:23 . 2010-04-01 18:23 301336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchclx.dll 2010-04-01 18:23 . 2010-04-01 18:23 1515224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgwd.dll 2010-04-01 18:23 . 2010-04-01 18:23 1086744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgchsvx.exe 2010-04-01 18:17 . 2010-04-01 18:17 1685784 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll 2010-04-01 18:17 . 2010-04-01 18:17 1035032 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-18 17:53 . 2009-11-24 21:32 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-04-17 15:59 . 2009-10-04 23:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-17 00:53 . 2009-10-05 15:36 -------- d-----w- c:\documents and settings\julio\Application Data\vlc 2010-04-14 21:12 . 2002-09-06 19:59 75868 ----a-w- c:\windows\system32\perfc00C.dat 2010-04-14 21:12 . 2002-09-06 19:59 467972 ----a-w- c:\windows\system32\perfh00C.dat 2010-04-13 16:21 . 2009-11-25 00:13 -------- d-----w- c:\documents and settings\julio\Application Data\BitTorrent 2010-04-13 15:50 . 2009-10-19 17:15 -------- d-----w- c:\documents and settings\julio\Application Data\dvdcss 2010-04-13 14:34 . 2009-12-16 19:15 -------- d-----w- c:\program files\Google 2010-04-12 12:21 . 2004-08-19 15:56 54400 ----a-w- c:\windows\system32\drivers\i8042prt.sys 2010-04-09 11:56 . 2009-12-01 02:07 -------- d-----w- c:\program files\PC Tools Firewall Plus 2010-04-07 21:32 . 2009-11-25 22:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-07 21:29 . 2009-12-21 19:38 5918776 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-04-07 05:42 . 2009-12-17 21:42 -------- d-----w- c:\documents and settings\julio\Application Data\LimeWire 2010-04-07 01:50 . 2004-08-19 15:56 54400 -c--a-w- c:\windows\system32\drivers\i8042prt.sys.tmp 2010-03-29 22:46 . 2009-11-25 22:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-29 22:45 . 2009-11-25 22:32 20824 -c--a-w- c:\windows\system32\drivers\mbam.sys 2010-03-15 18:44 . 2009-11-29 22:38 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-03-15 18:44 . 2009-11-29 22:38 12464 ----a-w- c:\windows\system32\avgrsstx.dll 2010-03-15 18:44 . 2009-11-29 22:38 29512 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-03-15 18:43 . 2009-11-29 22:38 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys . [code]

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\PC Tools Firewall Plus\FirewallGUI .exe

/code ------- Sigcheck ------- [-] 2006-11-11 . 8D8949936913B041C6A0E184FBF1030B . 359808 . . [5.1.2600.2892] . . c:\windows\system32\drivers cpip.sys [-] 2006-11-18 . 7BA68DF484B550C1F75DD80AE1D7EF67 . 1035264 . . [6.00.2900.2649] . . c:\windows\explorer.exe [-] 2006-12-13 . 0CEF991C04073F5EC8BFD65B961705F1 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll c:\windows\System32\wscntfy.exe ... manque !! . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "P17Helper"="SPIRun.dll" [2006-07-03 10752] "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-04-09 3168216] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide1"="move" [X] "tscuninstall"="c:\windows\system32 scupgrd.exe" [2004-08-19 44544] "nltide2"="rundll32 advpack.dll" [N/A] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoSimpleStartMenu"= 0 (0x0) "HonorAutoRunSetting"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoSMMyPictures"= 0 (0x0) "MaxRecentDocs"= 15 (0xf) "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 0 (0x0) "HonorAutoRunSetting"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\avgrsstarter] 2010-03-15 18:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^SELPHY Photo Print Launcher.lnk] path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\SELPHY Photo Print Launcher.lnk backup=c:\windows\pss\SELPHY Photo Print Launcher.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^julio^Menu Démarrer^Programmes^Démarrage^LimeWire On Startup.lnk] path=c:\documents and settings\julio\Menu Démarrer\Programmes\Démarrage\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2009-12-11 23:57 948672 -c--a-w- c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2009-10-03 03:08 35696 -c--a-w- c:\program files\Adobe\Reader 9.0\Reader eader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)] 2010-03-29 22:46 1086856 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware] 2010-03-29 22:46 437584 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] 2004-09-23 11:41 860160 -c--a-w- c:\program files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] 2004-10-14 08:11 1388544 -c--a-w- c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2009-12-17 21:30 149280 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "c:\Program Files\BitTorrent\bittorrent.exe"= "c:\Program Files\AVG\AVG9\avgemc.exe"= "c:\Program Files\AVG\AVG9\avgupd.exe"= "c:\Program Files\AVG\AVG9\avgnsx.exe"= "c:\Program Files\LimeWire\LimeWire.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [30/11/2009 00:38 216200] R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [30/11/2009 00:38 242696] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [24/11/2009 23:53 233136] R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [30/11/2009 00:38 916760] R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [30/11/2009 00:38 308064] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [24/11/2009 23:53 88040] R3 HCWBT8xx;Hauppauge WinTV 848/9 WDM Video Driver;c:\windows\system32\drivers\HCWBT8XX.sys [04/10/2009 14:39 458820] R3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [01/12/2009 04:07 70664] R3 pctNDIS;PC Tools Driver;c:\windows\system32\drivers\pctNdis.sys [01/12/2009 04:07 58816] R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [01/12/2009 04:07 115216] S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [16/12/2009 21:16 135664] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [17/12/2009 20:00 243056] S3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [01/12/2009 04:07 32680] . Contenu du dossier 'Tâches planifiées' 2010-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-16 19:15] 2010-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-16 19:15] . . ------- Examen supplémentaire ------- . uSearchURL,(Default) = hxxp://www.google.fr/search?q=%s FF - ProfilePath - c:\documents and settings\julio\Application Data\Mozilla\Firefox\Profiles\poak10l1.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - plugin: c:\program files\Google\Google Earth\plugin pgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.23 pGoogleOneClick8.dll FF - plugin: c:\program files\ma-config.com phardwaredetection.dll . ************************************************************************** Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run P17Helper = Rundll32 SPIRun.dll,RunDLLEntry? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(796) c:\windows\system32\Ati2evxx.dll . Heure de fin: 2010-04-18 20:07:35 ComboFix-quarantined-files.txt 2010-04-18 18:07 Avant-CF: 20 048 556 032 octets libres Après-CF: 20 023 930 880 octets libres - - End Of File - - 7BEE495CF6F0DE4B2D245DF1E54E507B

Jess,sunbelt · Answer

Pourquoi tu na pas pu installer le SP3

tchulo · Answer

l'ordi a buggé 2 fois ça à stopper l'installation...

Jess,sunbelt · Answer

Bizarre

Reposte un hijackthis stp

tchulo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:15:26, on 18/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files	rend micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Jess,sunbelt · Answer

Pas d'infection en vu

Ton pc tourne mieux?

Je ne conseille pas trop Pctools comme parfeu mais plutôt Sunbelt personnal firewall

Lien: https://www.vipre.com/vipre-home-protection-products/

Tu as 15 jours d'essais et après tu as quelques option en moins mais le parfeu est toujours complet

tchulo · Answer

le pc à l'air de mieux tourner

merci à toi pour ton aide!

++

Jess,sunbelt · Answer

De rien a++ Mes ton sujet en résolue stp

Cheval de troie PSW.Agent.AFWE - Page 2

Discussions similaires

Newsletters