ANTIVIRUS XP 2008

JUMATHO -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,

J'ai été infecté hier soir ( je ne suis pas le seul apparemment ) par le virus Antivirus XP 2008.

Je l'ai supprimé avec avg 7.5 en mode sans échec. a priori il n y a plus de traces de virus après avoir refait un scan complet, par contre il y a toujours les conséquences.

en effet , l'ordinateur s'éteint après quelques secondes en affichant un message du genre ( windows va être arrêté afin de protéger vos fichiers.

il ne fonctionne plus qu'en mode sans échec.

voilà je sollicite donc votre aide car je ne sais pas quoi faire.

d'avance merci.

jumatho
Configuration: Windows XP tablet pc
Internet Explorer 6.0

7 réponses

  1.
    jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    slt,

    télécharge combofix (par sUBs) ici :

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    et enregistre le sur le bureau.

    déconnecte toi d'internet et ferme toutes tes applications.

    désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware)

    double-clique sur combofix.exe et suis les instructions

    à la fin, il va produire un rapport C:\ComboFix.txt

    réactive ton parefeu, ton antivirus, la garde de ton antispyware

    copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse.

    Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.

    Tu as un tutoriel complet ici :

    https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

    _______________________

    colle un rapport hijackthis

    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

    manuel :

    https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."
    0
    1. JUMATHO
       
      merci d'avoir répondu si vite !!!


      alors voici le rapport combo fix:


      [b]SDFix: Version 1.220 [/b]
      Run by 1Tegral06 on 01/09/2008 at 12:41

      Microsoft Windows XP [version 5.1.2600]
      Running From: C:\Documents and Settings\1Tegral06\Bureau\SDFix

      [b]Checking Services [/b]:


      Restoring Default Security Values
      Restoring Default Hosts File

      Rebooting


      [b]Checking Files [/b]:

      Trojan Files Found:

      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted





      Removing Temp Files

      [b]ADS Check [/b]:



      [b]Final Check [/b]:

      catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-09-01 13:43:34
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden services & system hive ...

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv]
      "start"=dword:00000001
      "type"=dword:00000001
      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv]
      "start"=dword:00000001
      "type"=dword:00000001
      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

      scanning hidden registry entries ...

      scanning hidden files ...

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 0


      [b]Remaining Services [/b]:




      Authorized Application Key Export:

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
      "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
      "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
      "C:\\WINDOWS\\system32\\drivers\\svchost.exe"="C:\\WINDOWS\\system32\\drivers\\svchost.exe:*:Disabled:svchost"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

      [b]Remaining Files [/b]:


      File Backups: - C:\DOCUME~1\1TEGRA~1\Bureau\SDFix\backups\backups.zip

      [b]Files with Hidden Attributes [/b]:

      Tue 15 Nov 2005 78,104 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe"
      Thu 24 Nov 2005 17,920 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setup.dll"
      Thu 24 Nov 2005 12,880 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll"
      Sat 26 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\405ae8e48aa46e265982686e1678047b\BIT1.tmp"
      Tue 29 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB110.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB119.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB137.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB13A.tmp"
      Thu 22 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB168.tmp"
      Mon 30 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1A3.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1BC.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1C0.tmp"
      Tue 20 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1E3.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1EF.tmp"
      Wed 11 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1FA.tmp"
      Mon 2 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1FF.tmp"
      Tue 29 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB22D.tmp"
      Wed 2 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB23C.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB29B.tmp"
      Thu 22 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB304.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB33.tmp"
      Sun 1 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB342.tmp"
      Wed 2 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB355.tmp"
      Wed 30 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB4B.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB59.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB5B.tmp"
      Tue 13 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB7.tmp"
      Tue 15 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB81.tmp"
      Tue 8 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB84.tmp"
      Wed 11 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB8C.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBA3.tmp"
      Mon 19 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBCE.tmp"
      Fri 2 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBD3.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBF2.tmp"

      [b]Finished![/b]





      et voici de rapport hijackthis:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:40:37, on 01/09/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Safe mode

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\SYSTEM32\WISPTIS.EXE
      C:\WINDOWS\System32\tabbtnu.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ovh.co.uk/mail/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
      O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Fichiers communs\microsoft shared\ink\tabtip.exe" /resume
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
      O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [TvOutSwitch] C:\AddOn\Fujitsu\DispSwitch\DispSwitchLauncher.exe
      O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe
      O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe
      O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrtAp.exe
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
      O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [SDFix] C:\Documents and Settings\1Tegral06\Bureau\SDFix\RunThis.bat /second
      O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\1TEGRA~1\Bureau\SDFix\RunThis.bat /second
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
      O8 - Extra context menu item: Crawler Search - tbr:iemenu
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
      O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O20 - Winlogon Notify: FJWSEL - C:\WINDOWS\SYSTEM32\FJWSWNP.dll
      O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
      O23 - Service: Digitizer Service (Digitizer) - WACOM - C:\WINDOWS\System32\digtizer.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
      O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
      O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
      O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
      O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\WINDOWS\system32\o2flash.exe
      O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
      0
    2. JUMATHO
       
      merci d'avoir répondu si vite !!!


      alors voici le rapport combo fix:


      [b]SDFix: Version 1.220 [/b]
      Run by 1Tegral06 on 01/09/2008 at 12:41

      Microsoft Windows XP [version 5.1.2600]
      Running From: C:\Documents and Settings\1Tegral06\Bureau\SDFix

      [b]Checking Services [/b]:


      Restoring Default Security Values
      Restoring Default Hosts File

      Rebooting


      [b]Checking Files [/b]:

      Trojan Files Found:

      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted
      C:\WINDOWS\system32\tdssadw.dll - Deleted
      C:\WINDOWS\system32\tdssinit.dll - Deleted
      C:\WINDOWS\system32\tdssl.dll - Deleted
      C:\WINDOWS\system32\tdsslog.dll - Deleted
      C:\WINDOWS\system32\tdssmain.dll - Deleted
      C:\WINDOWS\system32\tdssservers.dat - Deleted





      Removing Temp Files

      [b]ADS Check [/b]:



      [b]Final Check [/b]:

      catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-09-01 13:43:34
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden services & system hive ...

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv]
      "start"=dword:00000001
      "type"=dword:00000001
      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TDSSserv]
      "start"=dword:00000001
      "type"=dword:00000001
      "imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

      scanning hidden registry entries ...

      scanning hidden files ...

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 0


      [b]Remaining Services [/b]:




      Authorized Application Key Export:

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
      "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
      "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
      "C:\\WINDOWS\\system32\\drivers\\svchost.exe"="C:\\WINDOWS\\system32\\drivers\\svchost.exe:*:Disabled:svchost"

      [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
      "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

      [b]Remaining Files [/b]:


      File Backups: - C:\DOCUME~1\1TEGRA~1\Bureau\SDFix\backups\backups.zip

      [b]Files with Hidden Attributes [/b]:

      Tue 15 Nov 2005 78,104 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe"
      Thu 24 Nov 2005 17,920 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setup.dll"
      Thu 24 Nov 2005 12,880 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll"
      Sat 26 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\405ae8e48aa46e265982686e1678047b\BIT1.tmp"
      Tue 29 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB110.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB119.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB137.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB13A.tmp"
      Thu 22 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB168.tmp"
      Mon 30 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1A3.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1BC.tmp"
      Tue 26 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1C0.tmp"
      Tue 20 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1E3.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1EF.tmp"
      Wed 11 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1FA.tmp"
      Mon 2 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB1FF.tmp"
      Tue 29 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB22D.tmp"
      Wed 2 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB23C.tmp"
      Thu 31 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB29B.tmp"
      Thu 22 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB304.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB33.tmp"
      Sun 1 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB342.tmp"
      Wed 2 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB355.tmp"
      Wed 30 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB4B.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB59.tmp"
      Wed 27 Aug 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB5B.tmp"
      Tue 13 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB7.tmp"
      Tue 15 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB81.tmp"
      Tue 8 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB84.tmp"
      Wed 11 Jun 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NB8C.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBA3.tmp"
      Mon 19 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBCE.tmp"
      Fri 2 May 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBD3.tmp"
      Thu 17 Jul 2008 20,480 A..H. --- "C:\Documents and Settings\1Tegral06\Local Settings\Application Data\Microsoft\Journal\Cache\NBF2.tmp"

      [b]Finished![/b]





      et voici de rapport hijackthis:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:40:37, on 01/09/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Safe mode

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\SYSTEM32\WISPTIS.EXE
      C:\WINDOWS\System32\tabbtnu.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ovh.co.uk/mail/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
      O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Fichiers communs\microsoft shared\ink\tabtip.exe" /resume
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
      O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [TvOutSwitch] C:\AddOn\Fujitsu\DispSwitch\DispSwitchLauncher.exe
      O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe
      O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe
      O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrtAp.exe
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
      O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [SDFix] C:\Documents and Settings\1Tegral06\Bureau\SDFix\RunThis.bat /second
      O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\1TEGRA~1\Bureau\SDFix\RunThis.bat /second
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
      O8 - Extra context menu item: Crawler Search - tbr:iemenu
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
      O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O20 - Winlogon Notify: FJWSEL - C:\WINDOWS\SYSTEM32\FJWSWNP.dll
      O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
      O23 - Service: Digitizer Service (Digitizer) - WACOM - C:\WINDOWS\System32\digtizer.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
      O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
      O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
      O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
      O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\WINDOWS\system32\o2flash.exe
      O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
      0
  2. bidouillepc Messages postés 99 Statut Membre 2
     
    salut
    malewarebyte va te faire le ménage

    ensuite tu passe a moziilla et plus de pb (enfin beaucoup moins ) ^^
    0
    1. tribun Messages postés 64900 Date d'inscription   Statut Membre Dernière intervention   12 686
       
      je +soie ,
      Malwarebytes est suffisant pour supprimer Antivirus XP 2008 + CCleaner !
      mais tu dis avoir supprimé A XP 2008, par AVG !!!!!!!!!!
      mais tu as un autre problème d'infection a mon avis !
      et fais un Hijackthis , et je te laisse dans les mains de jlpjlp ;

      0
  3. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    j'avais demandé combofix et non SDFIX

    et mets a jour avg que tu as avec la version 8
    0
    1. JUMATHO
       
      voici le rapport de combo fix: merci


      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:40:37, on 01/09/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16705)
      Boot mode: Safe mode

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\SYSTEM32\WISPTIS.EXE
      C:\WINDOWS\System32\tabbtnu.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\ctfmon.exe
      C:\Hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ovh.co.uk/mail/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.update.microsoft.com/windowsupdate/v6/default.aspx
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
      O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Fichiers communs\microsoft shared\ink\tabtip.exe" /resume
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
      O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
      O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [TvOutSwitch] C:\AddOn\Fujitsu\DispSwitch\DispSwitchLauncher.exe
      O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe
      O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe
      O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
      O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
      O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrtAp.exe
      O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
      O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
      O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKLM\..\Run: [SDFix] C:\Documents and Settings\1Tegral06\Bureau\SDFix\RunThis.bat /second
      O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\1TEGRA~1\Bureau\SDFix\RunThis.bat /second
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe
      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
      O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
      O8 - Extra context menu item: Crawler Search - tbr:iemenu
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
      O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
      O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
      O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
      O20 - Winlogon Notify: FJWSEL - C:\WINDOWS\SYSTEM32\FJWSWNP.dll
      O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll
      O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
      O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
      O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
      O23 - Service: Digitizer Service (Digitizer) - WACOM - C:\WINDOWS\System32\digtizer.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
      O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
      O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
      O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
      O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
      O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\WINDOWS\system32\o2flash.exe
      O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
      0
  4. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    c'est hijakchtis que tu mets...
    0
    1. JUMATHO
       
      ComboFix 08-08-31.01 - 1Tegral06 2008-09-01 14:12:22.2 - NTFSx86 MINIMAL
      Endroit: C:\Documents and Settings\1Tegral06\Bureau\ComboFix.exe

      [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      ---- Previous Run -------
      .
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008.lnk
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Antivirus XP 2008.lnk
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\License Agreement.lnk
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Register Antivirus XP 2008.lnk
      C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Antivirus XP 2008\Uninstall.lnk

      .
      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_TDSSSERV
      -------\Service_TDSSserv


      ((((((((((((((((((((((((((((( Fichiers créés 2008-08-01 to 2008-09-01 ))))))))))))))))))))))))))))))))))))
      .

      2008-09-01 13:40 . 2008-09-01 13:49 <REP> d-------- C:\Hijackthis
      2008-09-01 12:10 . 2008-09-01 12:10 <REP> d-------- C:\WINDOWS\ERUNT
      2008-09-01 01:32 . 2008-09-01 01:34 <REP> d-------- C:\Program Files\RegCleaner
      2008-09-01 01:24 . 2008-09-01 09:53 <REP> d-------- C:\Program Files\Spyware Terminator
      2008-09-01 01:24 . 2008-09-01 01:25 <REP> d-------- C:\Program Files\Crawler
      2008-09-01 01:24 . 2008-09-01 09:25 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
      2008-09-01 01:24 . 2008-09-01 13:34 <REP> d-------- C:\Documents and Settings\1Tegral06\Application Data\Spyware Terminator
      2008-09-01 01:24 . 2008-09-01 01:24 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys
      2008-08-31 22:42 . 2008-08-31 22:42 <REP> d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Yahoo!
      2008-08-31 22:42 . 2008-08-31 22:42 12,288 --a------ C:\WINDOWS\system32\tdssserf.dll
      2008-08-23 19:05 . 2008-08-23 19:05 <REP> d-------- C:\Program Files\Fichiers communs\Enterbrain
      2008-08-23 19:05 . 2008-08-23 19:05 <REP> d-------- C:\Documents and Settings\1Tegral06\Application Data\Enterbrain
      2008-08-23 18:58 . 2008-08-23 18:58 <REP> d-------- C:\Program Files\RPG Maker VX
      2008-08-19 23:53 . 2008-08-19 23:53 28 --a------ C:\WINDOWS\mscpt.dat
      2008-08-02 14:40 . 2008-08-02 14:40 <REP> d-------- C:\Program Files\Rippackv3
      2008-08-02 14:34 . 2008-08-02 14:36 <REP> d-------- C:\Program Files\DVD Rip Factory Pro
      2008-08-02 14:26 . 2008-08-02 14:26 <REP> d-------- C:\Program Files\Xilisoft
      2008-08-02 14:26 . 2008-08-02 14:26 <REP> d-------- C:\Documents and Settings\1Tegral06\Application Data\dvdcss
      2008-08-02 14:26 . 2005-11-21 07:48 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
      2008-08-02 14:26 . 2005-11-21 07:48 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-09-01 09:31 90,112 ----a-w C:\WINDOWS\DUMP8675.tmp
      2008-09-01 07:53 --------- d-----w C:\Documents and Settings\1Tegral06\Application Data\AVG7
      2008-08-31 22:13 --------- d-----w C:\Program Files\Starcraft
      2008-08-31 22:05 --------- d-----w C:\Program Files\LogMeIn
      2008-08-31 08:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
      2008-08-28 13:10 --------- d-----w C:\Program Files\AutoCAD 2007
      2008-08-23 11:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-08-02 12:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
      2008-07-26 21:58 --------- d-----w C:\Documents and Settings\1Tegral06\Application Data\DivX
      2008-07-26 21:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
      2008-07-26 21:16 --------- d-----w C:\Documents and Settings\1Tegral06\Application Data\Yahoo!
      2008-07-26 21:15 --------- d-----w C:\Program Files\Yahoo!
      2008-07-26 21:15 --------- d-----w C:\Program Files\DivX
      2008-07-25 22:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
      2008-07-25 07:25 --------- d-----w C:\Program Files\Warcraft II BNE
      2008-07-23 20:06 98,304 ----a-w C:\WINDOWS\W2BNEUnin.exe
      2008-07-23 20:06 2,829 ----a-w C:\WINDOWS\W2BNEUnin.pif
      2008-07-22 19:13 67,584 ----a-w C:\WINDOWS\ScUnin.exe
      2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
      2008-07-15 19:59 --------- d-----w C:\Program Files\MSXML 4.0
      2008-07-13 12:07 --------- d-----w C:\Documents and Settings\1Tegral06\Application Data\Autodesk
      2008-07-10 20:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
      2008-07-10 20:46 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
      2008-07-10 20:45 --------- d-----w C:\Program Files\AnswerWorks 4.0
      2008-07-10 20:33 --------- d-----w C:\Program Files\Autodesk
      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
      2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
      2008-07-02 20:53 --------- d-----w C:\Program Files\Microsoft Works
      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
      2008-06-24 08:28 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
      2008-06-23 09:21 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
      2008-06-23 09:21 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
      2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
      2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
      2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
      2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
      2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
      2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
      2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
      2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
      2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
      2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
      2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
      2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
      2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
      2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
      2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
      .

      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-11 23:40 68856]
      "MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "ATSwpNav"="C:\Program Files\Fingerprint Sensor\ATSwpNav -run" [X]
      "TabletWizard"="C:\WINDOWS\help\SplshWrp.exe" [2004-08-04 14:00 16384]
      "TabletTip"="C:\Program Files\Fichiers communs\microsoft shared\ink\tabtip.exe" [2006-06-02 15:33 271872]
      "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-02-26 21:34 155648]
      "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-02-26 21:33 131072]
      "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-09 17:26 794713]
      "TvOutSwitch"="C:\AddOn\Fujitsu\DispSwitch\DispSwitchLauncher.exe" [2006-08-03 06:13 81920]
      "PSUtility"="C:\AddOn\Fujitsu\PSUtility\TrayManager.exe" [2006-07-05 21:57 118784]
      "SSUtility"="C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe" [2006-07-22 20:10 233472]
      "LoadFUJ02E3"="C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2006-11-17 16:38 80688]
      "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 01:57 188416]
      "FjStrtAp"="C:\Program Files\Fujitsu\Utils\FjStrtAp.exe" [2006-05-05 02:06 20480]
      "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-19 13:26 579584]
      "LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 11:20 63048]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
      "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
      "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
      "SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-09-01 01:24 1783808]
      "RTHDCPL"="RTHDCPL.EXE" [2007-03-12 20:05 16125440 C:\WINDOWS\RTHDCPL.EXE]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]
      "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-16 15:31 219136]

      C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
      Acc‚l‚rateur de d‚marrage AutoCAD.lnk - C:\Program Files\Fichiers communs\Autodesk Shared\acstart17.exe [2006-03-05 14:43:54 11000]
      Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
      Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-11 23:40:09 125624]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
      2004-08-04 14:00 47104 C:\Program Files\Fichiers communs\Microsoft Shared\Ink\LoginKey.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\FJWSEL]
      2006-06-30 01:45 32768 C:\WINDOWS\system32\FJWSWNP.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
      2007-11-15 19:46 87352 C:\WINDOWS\system32\LMIinit.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PSUTY]
      2006-06-03 03:04 32768 C:\WINDOWS\system32\PSUWNP.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
      2002-08-29 20:45 11776 C:\WINDOWS\system32\tabbtnwl.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
      2004-08-04 14:00 30208 C:\WINDOWS\system32\tpgwlnot.dll

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
      "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
      "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

      R0 FJGSDisk;G-Sensor Application Filter Driver;C:\WINDOWS\system32\DRIVERS\FJGSDisk.sys [2007-11-16 23:12]
      R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2006-10-03 17:23]
      R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-05-11 21:56]
      R3 Fjbtndrv;Fujitsu Button Driver;C:\WINDOWS\system32\DRIVERS\FjBtnDrv.sys [2006-03-30 07:43]
      R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;C:\WINDOWS\system32\DRIVERS\FUJ02E3.sys [2004-01-18 07:15]
      R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-06-07 19:35]
      R3 WacomPen;Pilote de tablette Wacom à stylet série;C:\WINDOWS\system32\DRIVERS\wacompen.sys [2004-08-04 09:04]
      S1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-09-01 01:24]
      S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 11:21]
      S2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 11:20]
      S2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-03-09 11:20]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69f14f8c-39ed-11dd-86cd-c7f80fe24913}]
      \Shell\Auto\command - E:\setup.exe
      \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe
      .
      - - - - ORPHANS REMOVED - - - -

      HKU-Default-Run-TabletWizard - C:\WINDOWS\help\wizard.hta


      .
      ------- Supplementary Scan -------
      .
      R0 -: HKCU-Main,Start Page = https://www.ovh.co.uk/mail/
      O8 -: Crawler Search - tbr:iemenu
      O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
      O18 -: Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

      O16 -: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/5.0.15.0/ImageUploader5.cab
      C:\WINDOWS\Downloaded Program Files\ImageUploader5.inf
      C:\WINDOWS\system32\unicows.dll
      C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx
      .

      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-09-01 14:14:51
      Windows 5.1.2600 Service Pack 2 NTFS

      Balayage processus cachés ...

      Balayage caché autostart entries ...

      Balayage des fichiers cachés ...

      Scan terminé avec succès
      Les fichiers cachés: 0

      **************************************************************************
      .
      Temps d'accomplissement: 2008-09-01 14:15:35
      ComboFix-quarantined-files.txt 2008-09-01 12:15:32

      Pre-Run: 20,150,898,688 octets libres
      Post-Run: 20,136,050,688 octets libres

      197 --- E O F --- 2008-08-14 01:05:51
      0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 041
     
    parfait

    installe la version 8 d' AVG

    ____________
    Mettre a jour java:
    https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

    mettre à jour adobe reader
    https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

    _______________

    vire SDFIX, COMBOFIX DE ton ordi

    encore des soucis???

    pour protéger gratos ton ordi

    http://www.commentcamarche.net/telecharger/logiciel 4 securite

    mettre un antivirus

    AVAST en français ou ANTIVIR (en anglais mais très efficace) ou AVG 8
    https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
    -------------
    des anti-espions :
    MalwareByte's Anti-Malware + SPYBOT
    +
    SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

    Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version
    --------
    un pare feu :
    celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

    http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

    https://forum.pcastuces.com/sujet.asp?f=25&s=35606
    https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
    https://manuelsdaide.com/contact/
    http://www.open-files.com/forum/index.php?showtopic=29277
    http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

    -----------
    CCLEANER pour effacer les traces de surf
    ---------
    naviguer avec firefox ou safari ou opera et non internet explorer plus touché par les virus
    http://www.mozilla-europe.org/fr/products/firefox/
    0
    1. JUMATHO
       
      désolé, mais l'ordi s'arrête encore après quelques seconfdes en mode normal.

      même s'il n y plus de virus.
      0
  7. JUMATHO
     
    apparemment j'ai pas perdu de données, c'est surement un pb systeme.
    0

Discussions similaires

Ou trouver le pilote pour epson xp-2205
lutttinette -
kaneagle -

19 réponses
probleme configuration wifi epson xp-225
sam099 -
Elchaco -

35 réponses
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses