TR SPY GEN infection [Résolu]

Salut :)

Gloups ! Me suis fait grilled :)

Bonne suite,@+

Merci j execute vos directives immediatement

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:42:38, on 11/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\alg.exe
C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Claro 3G\UIMain.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
c:\arquivos de programas\avira\antivir desktop\avcenter.exe
c:\arquivos de programas\avira\antivir desktop\avscan.exe
C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe
C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://br.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ig.com.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://br.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.msn.com/
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: www.bb.com.br
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Detecção de dispositivo) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{783FDBC4-24A0-409C-90F3-DC6E2FAE8246}: NameServer = 200.169.119.221 200.169.119.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB91C423-BA30-4E3F-BD3A-CA566EDBBF9C}: NameServer = 200.204.0.10,200.204.0.138
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Arquivos de programas\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll
O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

Thanks pour votre prompte reponse.
j ai fermé avira antivir je ne sais pas ou est le dernier rapport donc je refais un scan avira antivirus j en suis á 60%

c est lent j ensuis á 75%

On n'est pas pressé ;-)

voila le rapport d avira



Avira AntiVir Personal
Report file date: sexta-feira, 11 de junho de 2010 10:19

Scanning for 2203496 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : user
Computer name : USER-917ABF77C4

Version information:
BUILD.DAT : 9.0.0.422 21701 Bytes 9/3/2010 10:29:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 8/2/2010 23:44:09
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/2/2009 13:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/2/2009 14:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/2/2009 13:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6/11/2009 13:45:22
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 13:46:00
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/1/2010 23:44:08
VBASE003.VDF : 7.10.3.75 996864 Bytes 26/1/2010 23:44:08
VBASE004.VDF : 7.10.4.203 1579008 Bytes 5/3/2010 22:29:30
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/4/2010 12:28:56
VBASE006.VDF : 7.10.7.218 2294784 Bytes 2/6/2010 14:04:39
VBASE007.VDF : 7.10.7.219 2048 Bytes 2/6/2010 14:04:40
VBASE008.VDF : 7.10.7.220 2048 Bytes 2/6/2010 14:04:41
VBASE009.VDF : 7.10.7.221 2048 Bytes 2/6/2010 14:04:41
VBASE010.VDF : 7.10.7.222 2048 Bytes 2/6/2010 14:04:42
VBASE011.VDF : 7.10.7.223 2048 Bytes 2/6/2010 14:04:42
VBASE012.VDF : 7.10.7.224 2048 Bytes 2/6/2010 14:04:42
VBASE013.VDF : 7.10.8.37 270336 Bytes 10/6/2010 01:06:32
VBASE014.VDF : 7.10.8.38 2048 Bytes 10/6/2010 01:06:34
VBASE015.VDF : 7.10.8.39 2048 Bytes 10/6/2010 01:06:35
VBASE016.VDF : 7.10.8.40 2048 Bytes 10/6/2010 01:06:36
VBASE017.VDF : 7.10.8.41 2048 Bytes 10/6/2010 01:06:42
VBASE018.VDF : 7.10.8.42 2048 Bytes 10/6/2010 01:06:42
VBASE019.VDF : 7.10.8.43 2048 Bytes 10/6/2010 01:06:43
VBASE020.VDF : 7.10.8.44 2048 Bytes 10/6/2010 01:06:43
VBASE021.VDF : 7.10.8.45 2048 Bytes 10/6/2010 01:06:44
VBASE022.VDF : 7.10.8.46 2048 Bytes 10/6/2010 01:06:44
VBASE023.VDF : 7.10.8.47 2048 Bytes 10/6/2010 01:06:46
VBASE024.VDF : 7.10.8.48 2048 Bytes 10/6/2010 01:06:46
VBASE025.VDF : 7.10.8.49 2048 Bytes 10/6/2010 01:06:47
VBASE026.VDF : 7.10.8.50 2048 Bytes 10/6/2010 01:06:48
VBASE027.VDF : 7.10.8.51 2048 Bytes 10/6/2010 01:06:49
VBASE028.VDF : 7.10.8.52 2048 Bytes 10/6/2010 01:06:49
VBASE029.VDF : 7.10.8.53 2048 Bytes 10/6/2010 01:06:50
VBASE030.VDF : 7.10.8.54 2048 Bytes 10/6/2010 01:06:51
VBASE031.VDF : 7.10.8.57 12288 Bytes 10/6/2010 01:06:52
Engineversion : 8.2.2.6
AEVDF.DLL : 8.1.2.0 106868 Bytes 26/4/2010 12:29:33
AESCRIPT.DLL : 8.1.3.31 1352058 Bytes 4/6/2010 14:05:53
AESCN.DLL : 8.1.6.1 127347 Bytes 24/5/2010 17:00:54
AESBX.DLL : 8.1.3.1 254324 Bytes 26/4/2010 12:29:34
AERDL.DLL : 8.1.4.6 541043 Bytes 26/4/2010 12:29:29
AEPACK.DLL : 8.2.1.1 426358 Bytes 28/3/2010 01:18:52
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 24/5/2010 17:00:53
AEHEUR.DLL : 8.1.1.33 2724214 Bytes 4/6/2010 14:05:49
AEHELP.DLL : 8.1.11.5 242038 Bytes 4/6/2010 14:05:09
AEGEN.DLL : 8.1.3.10 377205 Bytes 4/6/2010 14:05:05
AEEMU.DLL : 8.1.2.0 393588 Bytes 26/4/2010 12:29:11
AECORE.DLL : 8.1.15.3 192886 Bytes 24/5/2010 17:00:40
AEBB.DLL : 8.1.1.0 53618 Bytes 26/4/2010 12:29:10
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 11:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 8/2/2010 23:44:09
AVREP.DLL : 8.0.0.7 159784 Bytes 3/3/2010 12:12:21
AVREG.DLL : 9.0.0.0 36609 Bytes 5/12/2008 13:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/3/2009 18:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/1/2009 13:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/1/2009 18:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 11:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 5/12/2008 13:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/5/2009 18:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 8/2/2010 23:44:08

Configuration settings for the scan:
Jobname.............................: Local Drives
Configuration file..................: c:\arquivos de programas\avira\antivir desktop\alldrives.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, F:, A:, G:, D:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: Intelligent file selection
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: sexta-feira, 11 de junho de 2010 10:19

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'UIMain.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'searchindexer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'gbpsv.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
27 processes with 27 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'F:\'
[INFO] No virus was found!
Boot sector 'A:\'
[INFO] In the drive 'A:\' no data medium is inserted!
Boot sector 'G:\'
[INFO] In the drive 'G:\' no data medium is inserted!

Starting to scan executable files (registry).
The registry was scanned ( '49' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
Begin scan in 'F:\'
Begin scan in 'A:\'
Search path A:\ could not be opened!
System error [21]: O dispositivo não está pronto.
Begin scan in 'G:\'
Search path G:\ could not be opened!
System error [21]: O dispositivo não está pronto.
Begin scan in 'D:\'
Search path D:\ could not be opened!
System error [21]: O dispositivo não está pronto.
Begin scan in 'E:\'
Search path E:\ could not be opened!
System error [21]: O dispositivo não está pronto.


End of the scan: sexta-feira, 11 de junho de 2010 11:09
Used time: 49:38 Minute(s)

The scan has been done completely.

9733 Scanned directories
352506 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
352505 Files not concerned
2934 Archives were scanned
1 Warnings
1 Notes

lors de l avant dernier rapport (avant celui ci dessus posté) c est le "warning "1 qui contenait le Tr Spy gen affiché par avira

que fais je maintenant ?

voici le rapport malwarebytes il y avait 3 infections que j ai supprimé
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4189

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/6/2010 11:47:45
mbam-log-2010-06-11 (11-47-45).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 116342
Temps écoulé: 7 minute(s), 3 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

enfin quand je dis 3 infections que j ai supprimé je veux dire que j ai cliqué sur l icone "supprimer"....

ok, d'autres soucis ?

bon 1)avant la detection je ne pouvais plus utiliser les icones du bureau en cliquant (maintenant c est ok)
+
2)je me demande si l icone DVD shrink3d etait sur le bureau(je l ai scannée avec avira et rien de suspect).Je pense qu elle est apparue "seule".

a part cette icone inconnue sur le bureau dvd shrink 3 d rien d autre de suspect ou anormal

si vous pensez que tout est ok je vous remercie et souhaite longue vie á commentçamarche et son equipe!

ce n est peut etre pas le moment ad hoc pour moi de citer cette maxime mais tant pis je la trouve interessante et vous la livre au cas ou vous ne l auriez pas deja rencontrée "nous avançons dans l obscurité avec des reperes eblouissants " rené char

non je pense ne pas avoir de pare feu uniquement avira