plantage après infection. Fermé

Question

Bonjour,
Mon pc a été infecté par bolivar 28 et worm koobface.  Antivir a  fonctionné mais depuis, mon pc plante tout le temps et surtout quand on navigue ou que l'on joue.
J'ai bien essayé de faire des analyses en tout genre mais là aussi, il se coupe et même en mode sans échec.  Je pense qu'il me reste des petits trucs mais impossible de trouver ce qui se passe.
Pouvez-vous m'aider SVP ?
PC ACER    XPSP2      
Merci

ezekielo · Answer

telecharge hidjaktis voici le lien: http://www.commentcamarche.net/telecharger/telechargement 159 hijackthis .te fai do scan et colle le rapore ici

marojo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:28:55, on 13/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\a-squared Free\a2service.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
D:\Program Files\ma-config.com\maconfservice.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\InterMute\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - D:\Program Files\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [IncrediMail] D:\Program Files\IncrediMail\bin\IncMail.exe /c (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [IncrediMail] D:\Program Files\IncrediMail\bin\IncMail.exe /c (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://belgacom.extrafilm.be/ImageUploader5.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} (Image Uploader) - http://www.extrafilm.fr/ImageUploader4.cab
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - D:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

marojo · Answer

Vous ne trouvez rien ?
Merci de votre attention.

marojo · Answer

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1203
Windows 5.1.2600 Service Pack 2

13/12/2008 18:49:32
mbam-log-2008-12-13 (18-49-32).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 145738
Temps écoulé: 1 hour(s), 5 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
voilà, ça a été long mais il s'est encore arrêté.

ezekielo · Answer

kan tu scan avc antivir il trouve ou il y a rien?

ezekielo · Answer

il y a rien en logiciel espion,portable le pc?

marojo · Answer

Je ne sais plus faire de scan complet avec antivir car le pc se coupe.  Mon pc n'est pas un portable.  Je n'y comprends vraiment rien.
Merci pour l'aide

ezekielo · Answer

il mai férmeture de window ou il se coup directement?

ezekielo · Answer

mai moi ici le rappore du scan antivir kan il a trouvé les virus stp , tu a supprimé les virus?

ezekielo · Answer

les virus se gréfé au  fichier et kan tu suprime un virus tu supprim le fichier!

marojo · Answer

Avira AntiVir Personal Report file date: mardi 9 décembre 2008 13:48 Scanning for 1078022 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: SPT-72F6FFC7CEB Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 12:47:58 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:56:48 ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 17:30:21 ANTIVIR2.VDF : 7.1.0.198 2048 Bytes 07/12/2008 17:30:22 ANTIVIR3.VDF : 7.1.0.205 28672 Bytes 08/12/2008 17:29:49 Engineversion : 8.2.0.43 AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 11:47:40 AESCRIPT.DLL : 8.1.1.18 336251 Bytes 08/12/2008 17:29:50 AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 12:47:31 AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 12:48:52 AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 12:47:24 AEOFFICE.DLL : 8.1.0.32 196987 Bytes 05/12/2008 17:30:04 AEHEUR.DLL : 8.1.0.74 1519990 Bytes 04/12/2008 17:30:53 AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 12:47:12 AEGEN.DLL : 8.1.1.6 323955 Bytes 29/11/2008 12:47:13 AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 11:47:30 AECORE.DLL : 8.1.5.2 172405 Bytes 29/11/2008 12:47:12 AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 11:47:28 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 25/09/2008 10:26:34 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: d:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: mardi 9 décembre 2008 13:48 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'maconfservice.exe' - '1' Module(s) have been scanned Scan process 'DkService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'PCBooster.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 33 processes with 33 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD2 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD3 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD4 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '43' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\spt\Mes documents\TomTom\HOME\Downloads avcore_7.163.8493.go.cab [0] Archive type: CAB (Microsoft) --> data.chk [WARNING] No further files can be extracted from this archive. The archive will be closed C:\WINDOWS\bolivar28.exe [DETECTION] Contains recognition pattern of the WORM/Koobface.CK worm [NOTE] The file was moved to '49aa6ebb.qua'! Begin scan in 'D:\' D:\Program Files\Scrapbook Factory Deluxe 3.0 (ISO)\ScrapbookFactoryDlx3.0-cd1\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed D:\Program Files\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed End of the scan: mardi 9 décembre 2008 14:42 Used time: 54:20 Minute(s) The scan has been done completely. 9271 Scanning directories 589083 Files were scanned 1 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 1 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 589081 Files not concerned 9670 Archives were scanned 8 Warnings 1 Notes Avira AntiVir Personal Report file date: vendredi 12 décembre 2008 21:00 Scanning for 1085187 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: SPT-72F6FFC7CEB Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 12:47:58 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:56:48 ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 17:30:21 ANTIVIR2.VDF : 7.1.0.198 2048 Bytes 07/12/2008 17:30:22 ANTIVIR3.VDF : 7.1.0.229 137728 Bytes 12/12/2008 17:29:47 Engineversion : 8.2.0.45 AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 11:47:40 AESCRIPT.DLL : 8.1.1.19 336252 Bytes 11/12/2008 17:29:56 AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 12:47:31 AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 12:48:52 AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 12:47:24 AEOFFICE.DLL : 8.1.0.33 196987 Bytes 11/12/2008 17:29:55 AEHEUR.DLL : 8.1.0.75 1524087 Bytes 11/12/2008 17:29:54 AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 12:47:12 AEGEN.DLL : 8.1.1.8 323956 Bytes 11/12/2008 17:29:51 AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 11:47:30 AECORE.DLL : 8.1.5.2 172405 Bytes 29/11/2008 12:47:12 AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 11:47:28 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 25/09/2008 10:26:34 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Local Hard Disks Configuration file...............: d:\program files\avira\antivir personaledition classic\alldiscs.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: vendredi 12 décembre 2008 21:00 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avnotify.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned Scan process 'SUPERANTISPYWARE.EXE' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'maconfservice.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'DkService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 31 processes with 31 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD2 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD3 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD4 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '42' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\spt\Mes documents\TomTom\HOME\Downloads avcore_7.163.8493.go.cab [0] Archive type: CAB (Microsoft) --> data.chk [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'D:\' D:\Program Files\Magic Encyclopedia\magic.exe.bak [DETECTION] Is the TR/Dldr.Agent.asri Trojan [NOTE] The file was moved to '49a9d5ab.qua'! D:\Program Files\Scrapbook Factory Deluxe 3.0 (ISO)\ScrapbookFactoryDlx3.0-cd1\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed D:\Program Files\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed D:\Program Files\stamps\Flower1.ufo [WARNING] Unknown engine error <65536> End of the scan: vendredi 12 décembre 2008 22:30 Used time: 1:30:42 Hour(s) The scan has been done completely. 9242 Scanning directories 583895 Files were scanned 1 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 1 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 583893 Files not concerned 9589 Archives were scanned 9 Warnings 1 Notes Avira AntiVir Personal Report file date: vendredi 12 décembre 2008 21:00 Scanning for 1085187 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: SPT-72F6FFC7CEB Version information: BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 12:47:58 AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19 LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:56:48 ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 17:30:21 ANTIVIR2.VDF : 7.1.0.198 2048 Bytes 07/12/2008 17:30:22 ANTIVIR3.VDF : 7.1.0.229 137728 Bytes 12/12/2008 17:29:47 Engineversion : 8.2.0.45 AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 11:47:40 AESCRIPT.DLL : 8.1.1.19 336252 Bytes 11/12/2008 17:29:56 AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 12:47:31 AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 12:48:52 AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 12:47:24 AEOFFICE.DLL : 8.1.0.33 196987 Bytes 11/12/2008 17:29:55 AEHEUR.DLL : 8.1.0.75 1524087 Bytes 11/12/2008 17:29:54 AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 12:47:12 AEGEN.DLL : 8.1.1.8 323956 Bytes 11/12/2008 17:29:51 AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 11:47:30 AECORE.DLL : 8.1.5.2 172405 Bytes 29/11/2008 12:47:12 AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 11:47:28 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01 AVREP.DLL : 8.0.0.2 98344 Bytes 25/09/2008 10:26:34 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07 RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37 Configuration settings for the scan: Jobname..........................: Local Hard Disks Configuration file...............: d:\program files\avira\antivir personaledition classic\alldiscs.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: vendredi 12 décembre 2008 21:00 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avnotify.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'wscntfy.exe' - '1' Module(s) have been scanned Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned Scan process 'SUPERANTISPYWARE.EXE' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'maconfservice.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'DkService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'a2service.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 31 processes with 31 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD2 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD3 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Master boot sector HD4 [INFO] No virus was found! [WARNING] System error [21]: Le périphérique n'est pas prêt. Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '42' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\Documents and Settings\spt\Mes documents\TomTom\HOME\Downloads avcore_7.163.8493.go.cab [0] Archive type: CAB (Microsoft) --> data.chk [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'D:\' D:\Program Files\Magic Encyclopedia\magic.exe.bak [DETECTION] Is the TR/Dldr.Agent.asri Trojan [NOTE] The file was moved to '49a9d5ab.qua'! D:\Program Files\Scrapbook Factory Deluxe 3.0 (ISO)\ScrapbookFactoryDlx3.0-cd1\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed D:\Program Files\SFW\Pictur~1.cab [0] Archive type: CAB (Microsoft) --> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24 [WARNING] No further files can be extracted from this archive. The archive will be closed D:\Program Files\stamps\Flower1.ufo [WARNING] Unknown engine error <65536> End of the scan: vendredi 12 décembre 2008 22:30 Used time: 1:30:42 Hour(s) The scan has been done completely. 9242 Scanning directories 583895 Files were scanned 1 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 1 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 583893 Files not concerned 9589 Archives were scanned 9 Warnings 1 Notes L'ordinateur se coupe directement et quand il se remet en marche il me dit que le système a récupéré d'une erreur sérieuse. quand je regarde les détails, se sont des fichiers temporaires et quand je les cherche, je ne les trouve pas.

ezekielo · Answer

telecharge ca  http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner analise et repare le registre

marojo · Answer

Voilà, j'ai réparé le registre et.... il s'est encore coupé.
Sur l'écran bleu au moment de la coupure, j'ai pu voir nv4qqchose.dll

ezekielo · Answer

le virus c acroché a un dll  mai il me fo le non complet pour pouvoire le restoré

ezekielo · Answer

telecharge ca et fai un scan et mai moi le rapore ici merci http://www.commentcamarche.net/telecharger/telechargement 34055291 toolscleaner

marojo · Answer

[ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\TB.txt: trouvé !
C:\Toolbar SD: trouvé !
C:\Documents and Settings\spt\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\spt\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\spt\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\spt\Bureau\SmitfraudFix\SmitFraudFix.zip: trouvé !

Voilà merci

ezekielo · Answer

fai suprimé

ezekielo · Answer

tu a un cd original de ton windwo? il te mankan un dll dans windwo,et il fau un originale pour reparé, sinon réstoration a léta dusine, mais tu va perde tout t fichier fichier en fesan ca! a moin ke tu a fais une sauvgarde de t fichier?

ezekielo · Answer

telecharge sa et mai option1 http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

marojo · Answer

Bonjour ! J'ai supprimé J'ai mis mes pilotes à jour J'ai réinstallé avec le cd windows Il plante toujours. La dernière fois qu'il a planté il m'a indiqué C:\docume~1\mon nom\locals~1 emp\80f_appcompat.txt J'ai installé findykill et voilà le rapport. ----------------- FindyKill V4.709 ------------------ * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 10/12/08 par Chiquitine29 * Recherche effectuée à 20:42:52 le lun. 15/12/2008 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe D:\Program Files\a-squared Free\a2service.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe D:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\system32 vsvc32.exe D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe D:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32 vraidservice.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch »»»» Presence des fichiers dans C:\WINDOWS\system32 »»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\spt\Application Data »»»» Presence des fichiers dans C:\DOCUME~1\spt\LOCALS~1\Temp »»»» Presence des fichiers dans C:\Documents and Settings\spt\Local Settings\Temporary Internet Files\Content.IE5 --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] SUPERAntiSpyware=D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe HKEY_CURRENT_USER\software\microsoft\windows\currentversion un\AdobeUpdater= = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] avgnt="D:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min QuickTime Task="D:\Program Files\QuickTime\qttask.exe" -atboottime NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz=nwiz.exe /install NVRaidService=C:\WINDOWS\system32 vraidservice.exe NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit RTHDCPL=RTHDCPL.EXE Alcmtr=ALCMTR.EXE HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = --------------- [ Registre / Clés infectieuses ] ---------------- --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] Ndisuio - Type de démarrage = 3 Ip6Fw - Type de démarrage = 3 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe D: - Lecteur fixe +- presence des fichiers : --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! -------------------- Merci de ne pas me laisser tomber.

ezekielo · Answer

clic sur findykill et option 2 desinféction, de rien je ne lacheré pas ten ke cest pas résolu!

ezekielo · Answer

il va sarrété salumé et re sarrété et se ralumé pour la dérnier foi ton ordi mais tinkét c normal

marojo · Answer

Voilà c'est fait mais il ne fonctionne toujours pas ! Pfffff
Il s'est encore coupé 2X

ezekielo · Answer

fai un scan avc antivir en mode sen échec

ezekielo · Answer

tu a fai suprimé les inféction avc antivir? car le scan a trouvé des virus

marojo · Answer

Voilà, problème résolu, j'ai téléchargé uniblue registry booster et après un scan il m'a trouvé + de 300 erreurs.  Tout est rentré dans l'ordre.  Encore merci pour l'aide.
Joyeux Noël !

Plantage après infection.

26 réponses

Discussions similaires