AU SECOUR GUSANO BAGLE Résolu

Question

Bonjour, tout le monde et bonne année
je commence l'année avec un gusano bagle, celui ci as désactivé mon antivirus ainsi que quelque programme, j'ai téléchargé elibagla et voici le rapport


Fri Jan 16 20:22:55 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\SROSA2.SYS --> Eliminado Bagle(rootkit)
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\107625.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\110015.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\126343.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\127312.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\142796.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\145390.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\151781.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\152171.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\152328.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\162187.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\165375.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\166328.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\166406.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\182515.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\187156.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\189281.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\190984.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\196421.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\198375.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\201812.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\209078.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\217500.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\225265.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\238093.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\247937.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\263250.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\284609.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\304843.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\319468.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\322515.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\342828.EXE --> Eliminado Bagle.dldr
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\343000.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\348500.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\348515.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\357375.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\368140.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\369531.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\375875.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\401718.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\422859.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\446484.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\476593.EXE --> Eliminado Bagle
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\DOWNLD\487484.EXE --> Eliminado Bagle

	  Fri Jan 16 20:24:03 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:23:48 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:55:46 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:56:51 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:57:16 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:58:34 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:58:53 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 21:58:59 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

	  Fri Jan 16 22:00:00 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\MDELK.EXE --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\DRIVERS\WINUPGRO.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DORIAN MORIN\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Fri Jan 16 22:00:25 2009
EliBagle v12.11b  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 12 de Enero del 2009)
-----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\WINDOWS"





eh oui c'est en espagnol deja que j'ai un peu de mal avec le francais lol, comment m'en debarasser j'ai un ordi windows XP. Merci pour vos reponse. Encore autre chose mon ordi refuse depuis de redemarré en mode sans echec, j'ai un ecran bleu d'erreur qui m'empeche d'aller plus loin.

V-X · Answer

Salut,



FindyKill de Chiquitine29

&#x25B6 Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .

&#x25B6 ( Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

&#x25B6 Laisse toi guider pour l'installer.

&#x25B6 Double clic sur " FindyKill." pour lancer l'outil .

&#x25B6 Choisis La langue:F pour français

&#x25B6 Choisis  l'option 1 . Puis laisses travailler ...

&#x25B6 Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Les-risques-securitaires-du-peer-to-peer

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

merci je laisse donc le compte rendue de findkill ----------------- FindyKill V4.713 ------------------ * User : DORIAN MORIN - SN100177990248 * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 17/01/09 par Chiquitine29 * Recherche effectuée à 1:47:52 le 17/01/2009 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32 etdde.exe C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\clipsrv.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\System32\svchost.exe c:\program files\fichiers communs\aol\1209822846\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe c:\program files\fichiers communs\aol\1209822846\ee\aolsoftware.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Documents and Settings\DORIAN MORIN\Bureau\Antibagle-fr.exe C:\Program Files\Internet Explorer\iexplore.exe c:\program files\aol\aol toolbar 4.0\AolTbServer.exe C:\Program Files\Windows Live\Toolbar\wltuser.exe C:\Program Files\Mozilla Firefox\firefox.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: Found ! [16/01/2009 20:22] - "C:\Muestras" Found ! [16/01/2009 19:48] - "C:\Avenger" Found ! [16/01/2009 22:35] - C:\InfoSat.txt »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch Found ! - C:\WINDOWS\prefetch\107625.EXE-1428301B.pf Found ! - C:\WINDOWS\prefetch\127312.EXE-0E2473E0.pf Found ! - C:\WINDOWS\prefetch\142796.EXE-1DB877E3.pf Found ! - C:\WINDOWS\prefetch\151781.EXE-2A050572.pf Found ! - C:\WINDOWS\prefetch\152171.EXE-004FD173.pf Found ! - C:\WINDOWS\prefetch\165375.EXE-15A964ED.pf Found ! - C:\WINDOWS\prefetch\166328.EXE-00AA7B16.pf Found ! - C:\WINDOWS\prefetch\182515.EXE-055E840B.pf Found ! - C:\WINDOWS\prefetch\189281.EXE-35297986.pf Found ! - C:\WINDOWS\prefetch\190984.EXE-0AB33FD9.pf Found ! - C:\WINDOWS\prefetch\196421.EXE-096324C8.pf Found ! - C:\WINDOWS\prefetch\209078.EXE-284BB15B.pf Found ! - C:\WINDOWS\prefetch\263250.EXE-02326F4C.pf Found ! - C:\WINDOWS\prefetch\304843.EXE-1A81ED06.pf Found ! - C:\WINDOWS\prefetch\319468.EXE-182CAB81.pf Found ! - C:\WINDOWS\prefetch\342828.EXE-19C44D16.pf Found ! - C:\WINDOWS\prefetch\343000.EXE-19AA868E.pf Found ! - C:\WINDOWS\prefetch\348500.EXE-210AFC84.pf Found ! - C:\WINDOWS\prefetch\348515.EXE-05BD2F72.pf Found ! - C:\WINDOWS\prefetch\357375.EXE-20A31B9B.pf Found ! - C:\WINDOWS\prefetch\368140.EXE-1D88A5A3.pf Found ! - C:\WINDOWS\prefetch\375875.EXE-25B382DB.pf Found ! - C:\WINDOWS\prefetch\422859.EXE-010E1987.pf Found ! - C:\WINDOWS\prefetch\446484.EXE-30DBBB6F.pf Found ! - C:\WINDOWS\prefetch\476593.EXE-216ACA02.pf Found ! - C:\WINDOWS\prefetch\487484.EXE-2E043BE5.pf Found ! - C:\WINDOWS\prefetch\685921.EXE-0137CD3B.pf Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-3688F26E.pf Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-10910089.pf Found ! - C:\WINDOWS\Prefetch\KEYGEN.EXE-1D52764A.pf Found ! - C:\WINDOWS\Prefetch\KEYGEN.EXE-1D52764A.pf Found ! - C:\WINDOWS\Prefetch\NBKEYSCAN.EXE-2E1DB169.pf »»»» Presence des fichiers dans C:\WINDOWS\system32 Found ! [16/01/2009 22:47] - C:\WINDOWS\system32\mdelk.exe Found ! [16/01/2009 22:47] - C:\WINDOWS\system32\wintems.exe Found ! [17/01/2009 00:56] - C:\WINDOWS\system32\ban_list.txt »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\DORIAN MORIN\Application Data Found ! [16/01/2009 20:08] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\flec006.exe" Found ! [16/01/2009 22:36] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\list.oct" Found ! [16/01/2009 22:37] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\data.oct" Found ! [16/01/2009 22:37] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\srvlist.oct" Found ! [16/01/2009 22:44] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared" Found ! [16/01/2009 22:37] - "C:\Documents and Settings\DORIAN MORIN\Application Data\m" Found ! [16/01/2009 22:42] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers" Found ! [16/01/2009 22:42] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\srosa2.sys" Found ! [16/01/2009 22:42] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys" Found ! [10/08/2006 07:09] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe" Found ! [16/01/2009 22:49] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld" »»»» Presence des fichiers dans C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe AOL=C:\PROGRA~1\AOL9~1.0VR\aol.exe -smailbox Neuf Media Center="C:\Program Files\Neuf\Media Center\MediaCenter.exe" AOL Fast Start="C:\PROGRA~1\AOL9~1.0VR\AOL.EXE" -b [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] NvCplDaemon="RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup SoundMan=SOUNDMAN.EXE HostManager="C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe" UserFaultCheck=%systemroot%\system32\dumprep 0 -u NeroFilterCheck=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe NBKeyScan="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" AppleSyncNotifier=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe" avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= Installed=1 NoChange=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = [HKEY_CURRENT_USER\software\local appwizard-generated applications\dfgdfgdfgghjkhjykhjykhjgfhgfhgfhgfh] [HKEY_CURRENT_USER\software\local appwizard-generated applications\DocUnins] [HKEY_CURRENT_USER\software\local appwizard-generated applications\keygen] [HKEY_CURRENT_USER\software\local appwizard-generated applications\MediaCenter] [HKEY_CURRENT_USER\software\local appwizard-generated applications\NMBgMonitor] [HKEY_CURRENT_USER\software\local appwizard-generated applications\SmaPanel] [HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro] --------------- [ Registre / Clés infectieuses ] ---------------- Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\keygen Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\bisoft Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\FFC Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\FirtR Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\keygen Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S Found ! - HKEY_CURRENT_USER\Software\bisoft Found ! - HKEY_CURRENT_USER\Software\FirtR /!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1 --------------- [ Etat / Services ] ---------------- Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /!\ Mode sans echec non fonctionnel !! Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal /!\ Mode sans echec non fonctionnel !! Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network /!\ Mode sans echec non fonctionnel !! +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] /!\ Ndisuio - Type de démarrage = 4 EapHost - Type de démarrage = 3 /!\ Ip6Fw - Type de démarrage = 4

V-X · Answer

Re,

Findykill de chiquitine29 option 2:

&#x25B6 Branche tes disques amovibles à ton PC ( (clefs USB, disque dur externe, etc...) sans les ouvrir

&#x25B6 Double-clique sur le raccourci FindyKill sur ton bureau

&#x25B6 Au menu principal, choisisl'option 2 (Suppression)

/!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

&#x25B6 Ensuite, poste le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

alors voila le rapport apres le deuxieme netoyage




----------------- FindyKill V4.713 ------------------

* User : DORIAN MORIN - SN100177990248
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 11:08:40 the 17/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
etdde.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
Deleted ! - "C:\Muestras"  
Deleted ! - C:\InfoSat.txt  
Deleted ! - "C:\Avenger\m\shared"  
Deleted ! - "C:\Avenger\m"  
Deleted ! - C:\Avenger\flec006.exe  
Deleted ! - C:\Avenger\wintems.exe  
Deleted ! - "C:\Avenger"  
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
Deleted ! - C:\WINDOWS\prefetch\107625.EXE-1428301B.pf 
Deleted ! - C:\WINDOWS\prefetch\127312.EXE-0E2473E0.pf 
Deleted ! - C:\WINDOWS\prefetch\142796.EXE-1DB877E3.pf 
Deleted ! - C:\WINDOWS\prefetch\151781.EXE-2A050572.pf 
Deleted ! - C:\WINDOWS\prefetch\152171.EXE-004FD173.pf 
Deleted ! - C:\WINDOWS\prefetch\165375.EXE-15A964ED.pf 
Deleted ! - C:\WINDOWS\prefetch\166328.EXE-00AA7B16.pf 
Deleted ! - C:\WINDOWS\prefetch\182515.EXE-055E840B.pf 
Deleted ! - C:\WINDOWS\prefetch\189281.EXE-35297986.pf 
Deleted ! - C:\WINDOWS\prefetch\190984.EXE-0AB33FD9.pf 
Deleted ! - C:\WINDOWS\prefetch\196421.EXE-096324C8.pf 
Deleted ! - C:\WINDOWS\prefetch\209078.EXE-284BB15B.pf 
Deleted ! - C:\WINDOWS\prefetch\263250.EXE-02326F4C.pf 
Deleted ! - C:\WINDOWS\prefetch\304843.EXE-1A81ED06.pf 
Deleted ! - C:\WINDOWS\prefetch\319468.EXE-182CAB81.pf 
Deleted ! - C:\WINDOWS\prefetch\342828.EXE-19C44D16.pf 
Deleted ! - C:\WINDOWS\prefetch\343000.EXE-19AA868E.pf 
Deleted ! - C:\WINDOWS\prefetch\348500.EXE-210AFC84.pf 
Deleted ! - C:\WINDOWS\prefetch\348515.EXE-05BD2F72.pf 
Deleted ! - C:\WINDOWS\prefetch\357375.EXE-20A31B9B.pf 
Deleted ! - C:\WINDOWS\prefetch\368140.EXE-1D88A5A3.pf 
Deleted ! - C:\WINDOWS\prefetch\375875.EXE-25B382DB.pf 
Deleted ! - C:\WINDOWS\prefetch\422859.EXE-010E1987.pf 
Deleted ! - C:\WINDOWS\prefetch\446484.EXE-30DBBB6F.pf 
Deleted ! - C:\WINDOWS\prefetch\476593.EXE-216ACA02.pf 
Deleted ! - C:\WINDOWS\prefetch\487484.EXE-2E043BE5.pf 
Deleted ! - C:\WINDOWS\prefetch\685921.EXE-0137CD3B.pf 
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-3688F26E.pf 
Deleted ! - C:\WINDOWS\prefetch\KEYGEN.EXE-1D52764A.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf 
Deleted ! - C:\WINDOWS\prefetch\NBKEYSCAN.EXE-2E1DB169.pf 
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf 
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-10910089.pf 
 
»»»» Supression files in C:\WINDOWS\system32 
 
Deleted ! - C:\WINDOWS\system32\mdelk.exe  
Deleted ! - C:\WINDOWS\system32\wintems.exe  
Deleted ! - C:\WINDOWS\system32\ban_list.txt  
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\DORIAN MORIN\Application Data 
 
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\flec006.exe"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\list.oct"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\data.oct"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\srvlist.oct"  
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\2.Panda.Antivirus.Titanium.2004.v3.0---Crack.Username.Y.Password.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\2_Norton.Ghost.2004.Symantec..serial.txt.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\310-051 - Sun Certified Enterprise Architect for J2EE Technology Practice Test Questions 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\4Musics WMA to WAV Converter 4.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AB Commander XP 6.96.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Access Password 11.0.8051.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AccessPatrol 2.0.1100.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Address Book Recovery 1.2.18.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AlmerShredder 1.05.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Alpha Flight 1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Apnoti for IE 1.2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Avast.Antivirus.Pro.v4.7.817.FR.Incl-Keygen.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AVG_internetsecurity7.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Basketball 1.6.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Beautiful Cactus 3.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\BitDefender.Internet.Security.v9.FR.Incl-Keygen.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Blaxton Video Capture 1.1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Cambodge Angkor Screensaver EV.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Check Book Reconciliation 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Chinup - Chinese Popup Translator 0.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\CompuSpy KeyLogger 1.0.0.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Convert Word to HTML COM 1.50.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Count Source Lines 1.3.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\CraigsPalFree - Craigslist Reader Pro 3.21.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DB Mail 2.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Dealio Comparison Shopping Toolbar 3.4.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Declare 1.0.6.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Desktop Icons Arranger 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Disk benchmark 2006 1.0.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DiveVisions 2.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DocFetcher 0.9.5.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DriveClone Pro 3.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DriveXplorer 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\eMule Turbo Accelerator 2.6.1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Eudora Password Recovery 1.4.1.50.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\FastSum Command Line Edition 1.9.0.149.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\FileStorage 3.0.4.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\FilmLoop 2.0.1.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Flourish Player 0.01.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Free HTTP Sniffer 1.1 Build 20080704.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Freeze Burn 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Fuzzy File Find 1.13.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\FXTrade Ticker 1.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\GDataPipe 1.0.0.750.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\GemX eBook Reader 4.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Happy Note! Valentine 1.00.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Heather Graham Screensaver2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Hixus Drop Down Menu Builder 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\How To Study and Teaching How To Study 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\HyperAdmin 1.2.4886.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\JLC's UPX GUI 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\JSecureConnect 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kaspersky.Anti-Virus.v6.0.0.303.+.Key.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kaspersky.Anti-Virus.V6.0.300.CHT(Personal).zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kastrul 1.0.004.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Keep It Simple Timer 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kigo Image Converter 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Killer 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\KinderMail 1.0.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kingdia DVD to Zune Converter 3.5.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Koala Bear Screensaver 4 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LanSpeed2 3.0.7.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LineTally 1.7.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Lite Photos 1.3.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LogMeIn Ignition 1.1.22.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Lookbao 2005 1.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\MailCheck 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Matrix zeroizer 1.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\McAfee.Viruscan.2005.V9.0.Fr_Firewall.plus.2005.Fr.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Mercury Document System Portable 2.2.0.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Mihov Info Saver 0.3.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Multi-Instrument Pro 3.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\My Privacy 3.8.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Naked on a mobile Phone 27 (AmadoresReais).zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Nebula Accounting for Access 2003 ADP 1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Newton's Aquarium 1.0b2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Norton.Antivirus.2007.complet.FR.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Odtu Radio 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Old Fashioned Halloween Slide Show.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Panda.Titanium.Antivirus.2004.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PC SMS Bulk Sender 1.7 build 1405.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PDF Vision .NET 1.2.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PHARMACY 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PhotoArtist 2.0.4.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Pianito MicroStudio 3.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Portable Celestia 1.5.1.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Portable IrfanView 4.20.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PQ iPod Video Converter 2.6 build 01.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Precision CW Tutor 4.6.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PrefixNE Pinger 3.5.0.154.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Project Buzz 1.01.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ProLingo English Dutch Dictionary 1.4.8.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Protected Storage Explorer 2.0.0.12.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\QuickDelete 3.1.0.9.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Remote Script 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Remove noise for After Effects 1.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\sharedia RTL 2 radio player 1.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Sea Dive3D Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SimAQUARIUM 2 Screensaver 2.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Spell Catcher Plus 3.0 build 1842.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Spell Helper 3.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\spimage 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SpinXpress 1.00.1140.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Step Into Chinese 0.5.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Studio Necessities 2.5.2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Symantec.Ghost.8.3.0.1331.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Synttari 1.3.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TaskPatrol Personal 2.0.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\The Rapture 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\The Rusted Clock 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TomTom Mobile 2005 - Navigator Map of Finland.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TrafficRefine 2.02.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TrueBell 1.5.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\USPS Signature Confirmation Tool 1.32.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\VB Build Manager 1.0.8.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ViewCompanion Standard 4.15.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Virtual Drillmaster 3.6.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\VirusCop 2.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Vista Game Explorer Editor 2.14a Beta.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Voice Tune Master.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Watcher1 Pro 1.05.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Website Rank Info 1.0.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Windows Registry Guide.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\WinFR 4.40.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Wise Optimizer 1.00.01.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\WS Matrix Screensaver 2.zip 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Xming 6.9.0.31.zip 
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m\shared"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\m"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\srosa2.sys"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers"  
 
»»»» Supression files in C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\1Y8YUXZU\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\1Y8YUXZU\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\35ALNY9D\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\35ALNY9D\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\35ALNY9D\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\35ALNY9D\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\35ALNY9D\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\6MPPKCT0\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\6MPPKCT0\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\6MPPKCT0\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\6MPPKCT0\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\6MPPKCT0\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_2[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\8024EDNG\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\9BEOEMBL\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\9BEOEMBL\mxd[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\I73HGNL3\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\J0KXIFQQ\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\J0KXIFQQ\b64[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\J0KXIFQQ\b64[3].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\b64_3[3].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\MQ6DD63F\file[1].txt    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64_1[3].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64_1[4].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\NWPTD843\b64_1[5].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\R2SDKH7S\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\R2SDKH7S\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\R2SDKH7S\b64_2[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\RNJGOPRM\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\RNJGOPRM\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\SFNZ16P8\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\UCAMYGLT\b64[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\UCAMYGLT\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\UCAMYGLT\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\UCAMYGLT\b64_3[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\UCAMYGLT\b64_3[3].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\WADB8YLS\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\WADB8YLS\b64_1[2].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\ZC8IS8HW\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\ZC8IS8HW\b64_3[2].jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_CURRENT_USER\Software\bisoft   
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! - HKEY_CURRENT_USER\Software\FirtR   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\keygen   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\FFC   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\MuleAppData   
 
--------------- [ States / Restarting of services ] ---------------- 
 
+- Safe boot mode restored ! 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - Type of startup  = 3 
 
EapHost - Type of startup  = 2 
 
Ip6Fw - Type of startup  = 2 
 
SharedAccess - Type of startup  = 2 
 
wuauserv - Type of startup  = 2 
 
wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

E: - Lecteur fixe

F: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Other Infections ] ----------------  
 
 
Références de comparaison Bagle MD5 :

113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\mdelk.exe 
113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\wintems.exe 
23759c3885093ce20351c89bf7d7c792  C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe 
23759c3885093ce20351c89bf7d7c792  C:\Muestras\WINUPGRO.EXE.Muestra EliBagle v12.11b 
5d641d5e744ad9aca087e8dae68e7822  C:\Avenger\wintems.exe 

Suspect ! - 23759c3885093ce20351c89bf7d7c792  C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe  
Suspect ! - 23759c3885093ce20351c89bf7d7c792  C:\Program Files\Neuf\Media Center\MediaCenter.exe  
Suspect ! - 64f497dace34ea0c38569c4c0549fe03  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP17\A0001693.exe  
Suspect ! - 806c29d6f39e4cecad64d0d99cb10746  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP42\A0010207.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010909.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010910.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010917.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010918.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010919.exe  
Suspect ! - 9c498d9305a5014caf113709499e093a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010923.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010926.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010928.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010929.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010930.exe  
Suspect ! - 9c498d9305a5014caf113709499e093a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010931.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010933.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010939.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010940.exe  
Suspect ! - 23759c3885093ce20351c89bf7d7c792  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011066.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011111.exe  
Suspect ! - 9c498d9305a5014caf113709499e093a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011158.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011159.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011206.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011291.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011316.exe  
Suspect ! - 2ee1faebb127647063aaef58a992519a  C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011330.exe  
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\DORIAN MORIN\Application Data\Microsoft\Office\Fichiers r‚cents\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk
C:\Documents and Settings\DORIAN MORIN\Recent\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk
 
 
---------------- ! End of report ! ------------------  
 
                 

merci d'ailleur j'ai une question je n'ai pas fait de telechargement depuis quelque temps ni recu de mail suspect alors comment j'aurai pu etre infecté, mais enfin j'ai mon fils qui se sert de mon ordi alors je ne sais pas s'il s'en ai servi mais comment faire pour savoir si c'est lui qui n'a pas telchargé ce baqle. Quelle aurait ete le fichier incriminé je ne vais pas le sermoné pas d'inquietude mais c juste pour savoir. Merci encore

V-X · Answer

Re,

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :


:files
C:\Documents and Settings\DORIAN MORIN\Application Data\Microsoft\Office\Fichiers r‚cents\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk
C:\Documents and Settings\DORIAN MORIN\Recent\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk 

:commands
[purity]
[emptytemp]




---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

DORIANGF · Answer

OK MERCI VOILA LE RAPPORT

========== FILES ==========
File/Folder C:\Documents and Settings\DORIAN MORIN\Application Data\Microsoft\Office\Fichiers r‚cents\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk not found.
File/Folder C:\Documents and Settings\DORIAN MORIN\Recent\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_FqKaV5XJb9SjmTc0erd8 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01172009_160849

V-X · Answer

Re,

A pas prit.


&#x25B6 Télécharge hijackthis

&#x25B6 Enregistre la cible sous .... "le bureau" 

&#x25B6 Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation

&#x25B6 Clique sur Install ensuite sur "I Accept"

&#x25B6 Clique sur" Do a scan system and save log file"

&#x25B6 Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse 

&#x25B6 Tuto hijackthis(Merci à Balltrap34)

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

oups desolé j'ai envoyé le post avant qu'il redemmarre alors voila de nouveau le rapport apres le reboot

========== FILES ==========
File/Folder C:\Documents and Settings\DORIAN MORIN\Application Data\Microsoft\Office\Fichiers r‚cents\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk not found.
File/Folder C:\Documents and Settings\DORIAN MORIN\Recent\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, m‚sanges,fente,euro,baise,amusement,pl.doc.lnk not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_FqKaV5XJb9SjmTc0erd8 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01172009_160849

Files moved on Reboot...
File C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_FqKaV5XJb9SjmTc0erd8 not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ moved successfully.
File C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ not found!
File C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ not found!
File C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ not found!
File C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ not found!
File C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ not found!

V-X · Answer

Re,

Fait ce que je t'ai demander ICI

DORIANGF · Answer

il m'indique:
 hijackthis.exe n'est pas une application Win32 valide

V-X · Answer

Re,

OKI.

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :

Renomme le au téléchargement en "KILLBAGLE".

Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

--->Je te conseil d'installer la console de récupération.(Voir le tutoriel).

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp 

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

voila le rapport fait par combofix ComboFix 09-01-16.04 - DORIAN MORIN 2009-01-17 17:26:11.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.511.244 [GMT 1:00] Lancé depuis: c:\documents and settings\DORIAN MORIN\Bureau\KILLBAGLE.exe AV: G DATA InternetSecurity 2008 *On-access scanning disabled* (Outdated) * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\148937.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\164687.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\164718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\170656.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\177250.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\177296.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\185296.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\185359.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\191750.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\192171.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\193718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\194890.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\195250.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\198515.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\210703.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\212093.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\212765.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\218671.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\228906.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\230968.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\237921.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\238484.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\239281.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\239484.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\243562.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\243750.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\246796.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\251671.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\254531.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\270859.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\272234.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\273187.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\273671.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\289500.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\306718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\326281.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\326828.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\326859.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\344359.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\346296.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\346812.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\347734.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\349296.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\349781.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\373593.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\374500.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\374859.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\375421.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\380078.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\394937.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\395000.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\408765.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\410453.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\411375.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\411968.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\412250.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\412718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\412796.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\413281.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\413328.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\413796.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\414140.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\414187.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\419843.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\420859.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\420921.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\428390.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\429515.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\430125.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\431281.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\432328.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\433015.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\438421.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\439687.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\439718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\440343.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\440828.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\441312.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\442406.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\443218.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\444437.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\449656.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\455218.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\456093.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\456718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\465437.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\472671.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\473718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\474265.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\487781.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\512671.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\516687.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\517203.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\517421.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\525265.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\583343.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\585234.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\586281.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\588718.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\637171.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\638437.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\downld\640078.exe c:\documents and settings\DORIAN MORIN\Application Data\drivers\srosa2.sys c:\documents and settings\DORIAN MORIN\Application Data\drivers\winupgro.exe c:\documents and settings\DORIAN MORIN\Application Data\m\data.oct c:\documents and settings\DORIAN MORIN\Application Data\m\list.oct c:\documents and settings\DORIAN MORIN\Application Data\m\shared c:\documents and settings\DORIAN MORIN\Application Data\m\shared\3Q DVD to PSP Converter 2.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\602Pro PC SUITE 7.1.100.1248.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\AbsoluteShield Internet Eraser Pro 3.65.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Acronis True Image Home 2009 12.0.9646.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Actual Live 7.0.9.32.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\AgataSoft Shutdown Pro 2.9.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Alchemy SDK 0.4a.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\American Glory Screensaver.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Aplus DivX to H.264 1.00.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Apple iPhone DVD Converter 3.22.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Art Appreciation 1.4.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Automatically Push My Buttons 2.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\AutoSysBot 3.03.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Avaide MPEG Converter 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Avira_Antivir_Premium_HBEDV_Serial_Licence.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Berthside 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\BitTorrent Toolbar - TorrentSeek 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Bluescreen 3.2.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Bug Cursors 1.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Cafezee 3.8.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Calc Pro 1.6.7.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\CDSurf.Net Professional 3.0.8.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Chronos 1.2.2.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\ClockWatch Radio Sync Server 3.0.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\ColorClipse Clock 1.0.0.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Complete Anonymous Internet 1.0.2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\DataWatch 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Desktop Lock 7.2.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Desktop Netstat 1.3a.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\deviantArtAdsKiller! 0.9.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\DF Encryption Pad 2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Diode Processor 1185.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\discoDSP Vertigo 2.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\DracoSoftware Process Killer 0.9.7.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Drive Folder 7.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Dup Filter 2.30.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Dutch Radar Widget 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\EA.Mobile.The.Simpsons.Minutes.To.Meltdown.v4.1.79.S60v2.webpleasure.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Easiestutils Video to Zune Converter 2.9.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\ERC (Email Redirecting Client) 2.02.01.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Exilty 0.86.7.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\F-Prot.Antivirus.para.Windows.3.14a.espa%C3%B1ol.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\False Teeth.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\File by OCR 1.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\File Renamer Basic 5.0.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\File Valet 1.2.1.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Folder Customiser 2.0.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Folder Pilot 1.00.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Forewave Audio Converter 2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Freewire TV 2.1.2.0 Beta.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\GoogImager Browser 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Handy Recovery 4.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\HP0-242 Practice Exam Testing Software 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\IdealWeightCalculator 1.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\IE Flower 1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\IFAebook 8.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\iFolder 3.2.5347.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\imgcnvrt.dll - Image Converter DLL 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\inCard 1.1.0.55.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\InstantLyric 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\inStep 1.4.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\iSeeSong Player 2.5.1.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\iWellsoft Audio to AMR MP3 AAC AC3 Converter 1.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\JSpecView 1.0.20060627-2100.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Just Watching 2.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Kaspersky.Anti-Virus.2006.Keys.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\LI Matrix calculator 1.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\LottoRocket 5.05.03.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\macedonia toolbar for IE 4.5.132.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\MBRtool 2.2.100.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\McAfee.AntiSpyware.v2.0.0.167-ZWT.[nfoil.com].[WarezFaw.Com].zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\MemoryCards 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Morgan Stream Switcher v0.99.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Mp3Works 1.00.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Navier 1.03.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Neuron Visual Java 1.0 b6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\NGM 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\NHL Team Schedule 1.6.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Nocturnal Elusions 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Norpath Elements Studio 3.2 build 390.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\NTFS Streams Info 2.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Obsidian 1.04.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Off The Road Winch Load Calculator 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Oracle Delete (Remove) Duplicate Entries Software 7.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Password Policy Manager 1.0.0.26.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\PDF4U Pro 2.00.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Personal Budgeting Tool 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Personal Inventory Organiser 2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\PictoGrab 1.1.2.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Pismo Trace Monitor SDK 1.0.0 Build 045.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\ProofGoogler.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Protected Storage PassView 1.63.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Protocol Reader 1.0.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\QMR.FM Radio Player 1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\QRYCLIENTIP 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Reeves Photo Assistant 1.0 Build 2006-06-03-1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Resolve for Alcra-B 1.07.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\RevLib PDF Edition 1.4.8.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\River Past Crazi Video for Blackberry 2.7.16.1904.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\RM-X Mov To DivX 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Seekyou 4.32.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Serial.Avg.7.Free.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Simplest Clock Screensaver 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\SmartAudio Console 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\SpyDefy 2.0.291.725.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\StarCauldron 14.3.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Starry Night 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Stock Explorer 1.2.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\SuperStorm 1.5.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Superversion French PPC 3.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Swiftpage for Lotus Notes 1.7.3.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Symantec Mail Security v4.6 Server for MS Exchange Crack - Keygen - Serial.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Symantec.Norton.Ghost.2003.ITA.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Synclosure 0.1.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Tiger Envelopes 0.8.9.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Toon Filter 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Trustix AntiVirus 2005 Edition.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\TSLogins 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\TurboVBLite 3.3.6.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\UK Map Locator 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Undelete for Floppy 2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Unerase for NTFS 2.7.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\usingGuestBook 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\VRMultimedia.dll 1.0.2227.41406.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Winrental 868.00.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Withes Tarot 1.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\shared\Zip-I-Mage 2.0.zip c:\documents and settings\DORIAN MORIN\Application Data\m\srvlist.oct c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe c:\program files\Neuf\Media Center\MediaCenter.exe c:\windows\system32\a.bat c:\windows\system32\mdelk.exe c:\windows\system32\win32.dll c:\windows\system32\wintems.exe c:\documents and settings\DORIAN MORIN\Application Data\m . . . . impossible à supprimer . ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-17 au 2009-01-17 )))))))))))))))))))))))))))))))))))) . 2009-01-17 17:07 . 2009-01-17 17:07 d-------- C:\32788R22FWJFW.0.tmp 2009-01-17 16:48 . 2009-01-17 16:48 d-------- c:\program files\Trend Micro 2009-01-17 16:08 . 2009-01-17 16:08 d-------- C:\_OTMoveIt 2009-01-17 11:48 . 2009-01-17 17:33 d--h----- c:\documents and settings\DORIAN MORIN\Application Data\m 2009-01-17 11:38 . 2009-01-17 17:40 d--h----- c:\documents and settings\DORIAN MORIN\Application Data\drivers 2009-01-17 01:46 . 2009-01-17 13:46 d-------- c:\program files\FindyKill 2009-01-16 21:40 . 2009-01-16 21:40 d-------- c:\windows\system32\Kaspersky Lab 2008-12-20 14:29 . 2008-12-20 14:29 d-------- c:\program files\Bonjour 2008-12-18 23:55 . 2009-01-17 17:42 d-------- c:\documents and settings\DORIAN MORIN\Tracing 2008-12-18 23:25 . 2008-12-18 23:25 d-------- c:\program files\Microsoft Silverlight 2008-12-18 23:25 . 2008-12-08 17:01 55,136 --a------ c:\windows\system32\drivers\fssfltr_tdi.sys 2008-12-18 23:23 . 2008-12-18 23:23 d-------- c:\program files\Microsoft Sync Framework 2008-12-18 23:21 . 2008-12-18 23:21 d-------- c:\program files\Microsoft SQL Server Compact Edition 2008-12-18 23:21 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll 2008-12-18 23:15 . 2008-12-18 23:15 d-------- c:\program files\Windows Live SkyDrive 2008-12-18 23:15 . 2008-12-18 23:25 d-------- c:\program files\Microsoft 2008-12-18 23:07 . 2008-12-18 23:07 d-------- c:\program files\Fichiers communs\Windows Live 2008-12-17 00:23 . 2008-12-17 00:23 d-------- c:\program files\EasyFlirt Messenger . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-17 14:49 --------- d-----w c:\program files\TuneUp Utilities 2008 2009-01-16 18:52 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-16 16:09 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-01-16 12:34 --------- d-----w c:\program files\eMule 2009-01-14 15:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-14 15:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-01-06 10:19 --------- d-----w c:\program files\DivX 2008-12-29 17:03 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-18 22:25 --------- d-----w c:\program files\Windows Live 2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll 2008-12-12 10:18 87,336 ----a-w c:\windows\system32\dns-sd.exe 2008-12-12 10:11 61,440 ----a-w c:\windows\system32\dnssd.dll 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys 2008-12-04 23:11 308,584 ----a-w c:\windows\WLXPGSS.SCR 2008-12-02 21:37 49,480 ----a-w c:\windows\system32\sirenacm.dll 2008-11-29 14:43 --------- d-----w c:\documents and settings\DORIAN MORIN\Application Data\Apple Computer 2008-11-29 14:33 --------- d-----w c:\program files\Safari 2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-11-21 19:56 --------- d-----w c:\program files\iTunes 2008-11-21 19:56 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-21 19:55 --------- d-----w c:\program files\iPod 2008-11-21 19:55 --------- d-----w c:\program files\Fichiers communs\Apple 2008-11-21 19:50 --------- d-----w c:\program files\QuickTime 2008-10-24 11:21 455,296 ------w c:\windows\system32\dllcache\mrxsmb.sys 2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2008-04-21 19:08 39,136 ----a-w c:\documents and settings\DORIAN MORIN\Application Data\GDIPFONTCACHEV1.DAT 2008-04-21 12:04 39,136 ----a-w c:\documents and settings\MARIE ROUXEL\Application Data\GDIPFONTCACHEV1.DAT 2008-08-06 13:38 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008080620080807\index.dat . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2008-12-02 3882312] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-17 1833296] "AOL"="c:\progra~1\AOL9~1.0VR\aol.exe" [2007-06-21 50480] "AOL Fast Start"="c:\progra~1\AOL9~1.0VR\AOL.EXE" [2007-06-21 50480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-12-17 3059712] "HostManager"="c:\program files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe" [2006-09-26 50736] "NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136] "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-01-17 81000] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,\ [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL] --a------ 2007-06-21 12:44 50480 c:\progra~1\AOL9~1.0VR\aol.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start] --a------ 2007-06-21 12:44 50480 c:\progra~1\AOL9~1.0VR\aol.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager] --a------ 2006-09-26 01:52 50736 c:\program files\Fichiers communs\aol\1209822846\ee\aolsoftware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] --a------ 2008-12-02 22:41 3882312 c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steekup] --a------ 2007-01-04 13:51 7952048 c:\program files\Steek\Steekup\Steekup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion un-] "Steekup"="C:/Program Files/Steek/Steekup/Steekup.exe" /delayed "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un-] "EPSON Stylus CX6400"=c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0L2.EXE /P19 "EPSON Stylus CX6400" /O6 "USB001" /M "Stylus CX6400" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\eMule\emule.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\GetData\Recover My Files\RecoverMyFiles.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= R4 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2008-12-18 55136] R4 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2008-12-04 226640] S1 aswSP;avast! Self Protection; [x] S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-12-08 533344] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-23 33752] S4 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys --> c:\windows\system32\DRIVERS\aswFsBlk.sys [?] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - SROSA *Deregistered* - srosa HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contenu du dossier 'Tâches planifiées' 2009-01-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2009-01-17 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 08:23] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Nero\Lib\NMBgMonitor.exe HKCU-Run-Neuf Media Center - c:\program files\Neuf\Media Center\MediaCenter.exe . ------- Examen supplémentaire ------- . uStart Page = hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1231966182&rver=5.5.4177.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fmail%2FInboxLight.aspx%3FFolderID%3D00000000-0000-0000-0000-000000000001%26InboxSortAscending%3DFalse%26InboxSortBy%3DDate%26n%3D1942590590&id=64855 uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local IE: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0 esources\fr-FR\local\search.html Trusted Zone: www.5-a-7.com Trusted Zone: www.sexfunlove.com FF - ProfilePath - c:\documents and settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9 FF - plugin: c:\program files\Microsoft\Office Live pOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins p-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins pmozax.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology pViewpoint.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll ---- PARAMETRES FIREFOX ---- FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.notify.interval - 600000 FF - user.js: content.switch.threshold - 1000000 FF - user.js: nglayout.initialpaint.delay - 600 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-17 17:41:43 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... c:\documents and settings\DORIAN MORIN\Application Data\m\flec006.exe [2520] 0x825952D0 Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... c:\windows\system32\winupgro.exe 3588 bytes executable c:\documents and settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys 121548 bytes executable c:\documents and settings\DORIAN MORIN\Application Data\m\flec006.exe 95027 bytes executable Scan terminé avec succès Fichiers cachés: 3 ************************************************************************** [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"="c:\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe" "german.exe"="c:\WINDOWS\system32\wintems.exe" "mule_st_key"="c:\Documents and Settings\DORIAN MORIN\Application Data\m\flec006.exe" [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\srosa] "ImagePath"="\??\c:\documents and settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys" . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32 etdde.exe c:\program files\Fichiers communs\aol\acs\AOLacsd.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32\clipsrv.exe c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\windows\system32 vsvc32.exe c:\windows\system32\wscntfy.exe c:\progra~1\AOL9~1.0VR\waol.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Fichiers communs\aol\1209822846\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe c:\progra~1\AOL9~1.0VR\shellmon.exe c:\windows\system32\verclsid.exe . ************************************************************************** . Heure de fin: 2009-01-17 18:01:51 - La machine a redémarré ComboFix-quarantined-files.txt 2009-01-17 17:01:32 Avant-CF: 43 331 629 056 octets libres Après-CF: 43,179,737,088 octets libres 467 --- E O F --- 2009-01-14 13:07:51 un grand merci pour ton aide

DORIANGF · Answer

un programme nommée flec006 a voulu se connecter j'ai pu le bloquer avec le pare feu mais je ne connais pas ce programme est ce un  nuisible encore, tu le connait?

V-X · Answer

Re,

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :



:files
c:\documents and settings\dorian morin\application data\drivers\winupgro.exe
c:\documents and settings\dorian morin\application data\m\shared\imgcnvrt.dll
c:\documents and settings\dorian morin\application data\m\shared\vrmultimedia.dll
c:\windows\system32\mdelk.exe
c:\windows\system32\win32.dll
c:\windows\system32\wintems.exe
c:\documents and settings\dorian morin\application data\m\flec006.exe


:commands
[purity]
[emptytemp]
[reboot] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

DORIANGF · Answer

voila de nouveau rapport

========== FILES ==========
File/Folder c:\documents and settings\dorian morin\application data\drivers\winupgro.exe not found.
File/Folder c:\documents and settings\dorian morin\application data\m\shared\imgcnvrt.dll not found.
File/Folder c:\documents and settings\dorian morin\application data\m\shared\vrmultimedia.dll not found.
File/Folder c:\windows\system32\mdelk.exe not found.
File/Folder c:\windows\system32\win32.dll not found.
File/Folder c:\windows\system32\wintems.exe not found.
File move failed. c:\documents and settings\dorian morin\application data\m\flec006.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_g67ucfTT1ZQfxtiEnl57 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01172009_182655

Files moved on Reboot...
File move failed. c:\documents and settings\dorian morin\application data\m\flec006.exe scheduled to be moved on reboot.
File C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_g67ucfTT1ZQfxtiEnl57 not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

V-X · Answer

Re,

fait hijackthis .

DORIANGF · Answer

comme precedent il me note
hijackthis.exe n'est pas une application Win32 valide

V-X · Answer

Re,

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen complet si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune. 


Tutoriel pour MalwareByte's

DORIANGF · Answer

voila la rapport malware 

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1662
Windows 5.1.2600 Service Pack 3

17/01/2009 19:27:55
mbam-log-2009-01-17 (19-27-55).txt

Type de recherche: Examen complet (C:\|E:\|F:\|)
Eléments examinés: 86408
Temps écoulé: 38 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mule_st_key (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

V-X · Answer

Re,

Dans l'ordre:

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 

* Clique sur Recherche et laisse le scan se terminer. 

* Clique sur Suppression pour finaliser. 

* Tu peux, si tu le souhaites, te servir des Options facultatives. 

* Clique sur Quitter, pour que le rapport puisse se créer. 

* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
FindyKill de Chiquitine29

&#x25B6 Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .

&#x25B6 ( Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils ) .

&#x25B6 Laisse toi guider pour l'installer.

&#x25B6 Double clic sur " FindyKill." pour lancer l'outil .

&#x25B6 Choisis La langue:F pour français

&#x25B6 Choisis  l'option 1 . Puis laisses travailler ...

&#x25B6 Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Les-risques-securitaires-du-peer-to-peer

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

et c'est reparti, 
le rapport toolscleaner

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\HijackThis.exe: trouvé !
C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\avenger: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\DORIAN MORIN\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\detail\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\WINDOWS\Gmer.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\HijackThis.exe: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HJTInstall.exe: supprimé !
C:\Program Files\Trend Micro\detail\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\WINDOWS\Gmer.exe: ERREUR DE SUPPRESSION !!
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\OTMoveIt3.exe: supprimé !
C:\avenger: ERREUR DE SUPPRESSION !!
C:\Qoobox: ERREUR DE SUPPRESSION !!
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\DORIAN MORIN\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\FindyKill: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

maintenant je lance findy

DORIANGF · Answer

et findy annonce ----------------- FindyKill V4.713 ------------------ * User : DORIAN MORIN - SN100177990248 * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 17/01/09 par Chiquitine29 * Recherche effectuée à 10:56:39 le 18/01/2009 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32 etdde.exe C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\clipsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32 vsvc32.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\WINDOWS\system32\wuauclt.exe c:\program files\fichiers communs\aol\1209822846\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe c:\program files\fichiers communs\aol\1209822846\ee\aolsoftware.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: Found ! [17/01/2009 19:43] - "C:\Avenger" »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch »»»» Presence des fichiers dans C:\WINDOWS\system32 »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\DORIAN MORIN\Application Data Found ! [17/01/2009 17:40] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers" Found ! [17/01/2009 17:14] - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys" »»»» Presence des fichiers dans C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe msnmsgr="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] NvCplDaemon="RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup SoundMan=SOUNDMAN.EXE HostManager="C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe" UserFaultCheck=%systemroot%\system32\dumprep 0 -u NeroFilterCheck=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe NBKeyScan="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" AppleSyncNotifier=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe" avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= Installed=1 NoChange=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = [HKEY_CURRENT_USER\software\local appwizard-generated applications\MediaCenter] [HKEY_CURRENT_USER\software\local appwizard-generated applications\NMBgMonitor] [HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro] --------------- [ Registre / Clés infectieuses ] ---------------- Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\MuleAppData Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA /!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1 --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] /!\ Ndisuio - Type de démarrage = 4 EapHost - Type de démarrage = 2 /!\ Ip6Fw - Type de démarrage = 4 SharedAccess - Type de démarrage = 2 wuauserv - Type de démarrage = 2 wscsvc - Type de démarrage = 2 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe E: - Lecteur fixe F: - Lecteur fixe +- presence des fichiers : --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! --------------------

V-X · Answer

Re,

Fait l'option 2 de findykill et poste le rapport et retente un hijackthis.

DORIANGF · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:34:54, on 18/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
etdde.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1231966182&rver=5.5.4177.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fmail%2FInboxLight.aspx%3FFolderID%3D00000000-0000-0000-0000-000000000001%26InboxSortAscending%3DFalse%26InboxSortBy%3DDate%26n%3D1942590590&id=64855&lc=1033
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [drvsyskit] C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [mule_st_key] C:\Documents and Settings\DORIAN MORIN\Application Data\m\flec006.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0esources\fr-FR\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.5-a-7.com/
O15 - Trusted Zone: http://www.sexfunlove.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.bellapix.com/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

V-X · Answer

Re,

Tu as fait l'option deux de findykill ?

DORIANGF · Answer

oui voila le rapport


----------------- FindyKill V4.713 ------------------

* User : DORIAN MORIN - SN100177990248
* Executed from : C:\Program Files\FindyKill
* Update on 17/01/09 by Chiquitine29
* Start at 16:10:14 the 18/01/2009
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
etdde.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\wscntfy.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
Deleted ! - "C:\Avenger\m\shared"  
Deleted ! - "C:\Avenger\m"  
Deleted ! - C:\Avenger\flec006.exe  
Deleted ! - "C:\Avenger"  
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
 
»»»» Supression files in C:\WINDOWS\system32 
 
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\DORIAN MORIN\Application Data 
 
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers\wfsintwq.sys"  
Deleted ! - "C:\Documents and Settings\DORIAN MORIN\Application Data\drivers"  
 
»»»» Supression files in C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5 
 
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-2441644796-1140342021-2939365127-1006\Software\MuleAppData   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - Type of startup  = 3 
 
EapHost - Type of startup  = 2 
 
Ip6Fw - Type of startup  = 2 
 
SharedAccess - Type of startup  = 2 
 
wuauserv - Type of startup  = 2 
 
wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

E: - Lecteur fixe

F: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Other Infections ] ----------------  
 
 
Références de comparaison Bagle MD5 :

33401e357ca50bb899eb290e996ea1bb  C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\winupgro.exe.vir 
121efc2ef1de569460ecb02236642cd0  C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\_winupgro_.exe.zip 

 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\DORIAN MORIN\Application Data\Microsoft\Office\Fichiers récents\comment cracker les Allo Pass (sexe,argent,jeu,divx,mpg,fraudes,fille, mésanges,fente,euro,baise,amusement,pl.doc.lnk
 
 
---------------- ! End of report ! ------------------  
 
                    
je l'avait fait avant hijackthis

V-X · Answer

Re,

Bon fait ceci plutôt:

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :

:processes
explorer.exe

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"drvsyskit"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"german.exe"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"mule_st_key"=-

:files
c:\documents and settings\dorian morin\application data\drivers\winupgro.exe
c:\windows\system32\wintems.exe
c:\documents and settings\dorian morin\application data\m\flec006.exe

:commands
[purity]
[emptytemp]
[start explorer]
[reboot] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

V-X · Answer

Re,

Fait le poste 29 et ensuite ceci:

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen complet si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune. 


Tutoriel pour MalwareByte's

DORIANGF · Answer

la voila deja un premier rapport otmove

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\drvsyskit deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\german.exe deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mule_st_key deleted successfully.
========== FILES ==========
File/Folder c:\documents and settings\dorian morin\application data\drivers\winupgro.exe not found.
File/Folder c:\windows\system32\wintems.exe not found.
File/Folder c:\documents and settings\dorian morin\application data\m\flec006.exe not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_QLQkkrWJc6A3YlFvRNch scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01182009_164246

Files moved on Reboot...
File C:\DOCUME~1\DORIAN~1\LOCALS~1\Temp\etilqs_QLQkkrWJc6A3YlFvRNch not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\XUL.mfl moved successfully.

et maintenant malware analyse  je te post des que c 'est fini

DORIANGF · Answer

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1662
Windows 5.1.2600 Service Pack 3

18/01/2009 17:10:11
mbam-log-2009-01-18 (17-10-11).txt

Type de recherche: Examen complet (C:\|E:\|F:\|)
Eléments examinés: 86207
Temps écoulé: 22 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

tu croix que c'est resolu?
mais mes anti virus ne demarre tjs pas dois je le reinstaller

V-X · Answer

Re,

tu utilises quel antivirus ?

&#x25B6 Télécharge random's system information tool (RSIT) et enregistre le sur ton bureau.

&#x25B6 Double clique sur RSIT.exe pour lancer l'outil.

&#x25B6 Clique sur ' continue ' à l'écran Disclaimer.

&#x25B6 Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.

&#x25B6 Une fois le scan fini , 2 rapports vont apparaitre. Poste le contenu des 2 rapports
( log.txt & info.txt )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

DORIANGF · Answer

je n'ai eu qu'un seul rapport d'afficher

Logfile of random's system information tool 1.05 (written by random/random)
Run by DORIAN MORIN at 2009-01-18 17:20:30
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 41 GB (72%) free of 57 GB
Total RAM: 511 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:34, on 18/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32
etdde.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\fichiers communs\aol\1209822846\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1209822846\ee\aolsoftware.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\DORIAN MORIN\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\DORIAN MORIN.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0esources\fr-FR\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.5-a-7.com/
O15 - Trusted Zone: http://www.sexfunlove.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.bellapix.com/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

V-X · Answer

Re,

&#x25B6 Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :


/!\ Déconnectes toi et fermes toutes applications en cours/!\

&#9679; Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
&#9679; Double clique sur l'icône Ad-removersituée sur ton bureau
&#9679; Au menu principal choisi l'option "A"
&#9679; Postes le rapport qui apparait à la fin .

( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

Note :

"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
&#x25B6 Je te conseil de désinstaller AVAST comment le faire proprement

&#x25B6 D'installer cet Antivirus:

ANTIVIR

&#x25B6 Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches. 

&#x25B6 Dans Antivir, choisis Outils puis Configuration.

&#x25B6 Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages. 

Avast et Antivir : comparaisons, et passage à Antivir.

&#x25B6 Fait la mise à jour d'antivir

DORIANGF · Answer

------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

Start at: 17:38:49 | Dim 18/01/2009 | Microsoft® Windows XP™  SP3 (V5.1.2600)
Boot mode: Normal
Option: SCAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: SN100177990248 | User: DORIAN MORIN ( Current user is an administrator)
Drive(s): 
- C:\  (File System: NTFS)
- E:\  (File System: NTFS)
- F:\  (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 37

+--------------------| Boonty/Boonty Games Elements Found :

.
.

+--------------------| Eorezo Elements Found :

.
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\EoRezo
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\cmhost.cyp
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\ConfMedia.cyp
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\db
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\eoDesktop
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\host.cyp
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\user.cyp
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\db\cat.cyp
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\eoDesktop\config.xml
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\eoDesktop\eoDesktop.html
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo\eoDesktop\userConfig.xml

+--------------------| Everest Casino/Everest Poker Elements Found :

.
.

+--------------------| Funwebproducts/Myway/Mywebsearch/Myglobalsearch Elements Found :

.
.

+--------------------| It's TV Elements Found :

HKCU\SOFTWARE\ItsLabel
.
C:\Documents and Settings\DORIAN MORIN\Application Data\ItsLabel
C:\Documents and Settings\DORIAN MORIN\Application Data\ItsLabel\ItsTV
C:\Documents and Settings\DORIAN MORIN\Application Data\ItsLabel\ItsTV\itsTV.xml

+--------------------| Sweetim Elements Found :

.
.

+--------------------| Added Scan :


+---------- SCANNING PREFS.JS ... ( # Mozilla user preferences )

..\yq6t7akl.default\prefs.js :

~~~~ MOZILLA FIREFOX VERSION 3.0.5 ~~~~

* BROWSER SEARCH DEFAULT ENGINE:  "Google"
* BROWSER SEARCH SELECTED ENGINE:  "Google"
* BROWSER SEARCH DEFAULT URL:  "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"
* BROWSER STARTUP HOMEPAGE:  "http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9"

.
FOUND - user_pref("browser.startup.homepage", "http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9");

+---------------------------------------------------------------------------+


~~~~ INTERNET EXPLORER VERSION 7.0.5730.13 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1231966182&rver=5.5.4177.0&wp=MBI&wreply=http

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

+---------------------------------------------------------------------------+

[~3673 BYTES] - "C:\AD-REPORT-SCAN-18.01.2009.LOG"

End at: 17:43:31 | 18/01/2009 - Time elapsed: 4 minutes, 42 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 72 Lines ]
+---------------------------------------------------------------------------+

V-X · Answer

Re, ▶ /!\ Déconnectes toi et fermes toutes applications en cours /!\ ▶ Relances "Ad-remover" : au menu principal choisi l'option "B" . http://apu.mabul.org/up/apu/2008/11/19/img-221318q2g03.jpg Il faut taper un chiffre et valider systématiquement celui-ci par ENTREE. ▶ Ensuite coche: EoRezo =>Entrée It's TV=>Entrée ▶ Puis "S" ▶ le programme va travailler ... ▶ Postes le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ... ( le rapport est sauvegardé aussi sous C:\Ad-report.log ) /!\ Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides) /!\

DORIANGF · Answer

RAPPORT AD REMOVER



------- LOGFILE OF AD-REMOVER 1.0.9.3 | ONLY XP/VISTA -------

Updated by C_XX on 17/01/2009 at 12:00

*** LIMITED TO ***

Eorezo
It's TV

******************

Start at: 17:59:32 | Dim 18/01/2009 | Microsoft® Windows XP™  SP3 (V5.1.2600)
Boot mode: Normal
Option: CLEAN | Executed from: C:\Program Files\Ad-remover\Ad-remover.bat
Pc: SN100177990248 | User: DORIAN MORIN ( Current user is an administrator)
Drive(s): 
- C:\  (File System: NTFS)
- E:\  (File System: NTFS)
- F:\  (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\System32\

--- Running Processes: 38

(!) ---- IE start pages reset

+--------------------| Eorezo Elements Deleted :

.
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\EoRezo
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Documents and Settings\DORIAN MORIN\Application Data\EoRezo

+--------------------| It's TV Elements Deleted :

HKCU\SOFTWARE\ItsLabel
.
C:\Documents and Settings\DORIAN MORIN\Application Data\ItsLabel

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+--------------------| Added Scan :


+---------- SCANNING PREFS.JS ... ( # MOZILLA USER PREFERENCES )

..\yq6t7akl.default\prefs.js :

~~~~ MOZILLA FIREFOX VERSION 3.0.5 ~~~~

* BROWSER SEARCH DEFAULT ENGINE:  "Google"
* BROWSER SEARCH SELECTED ENGINE:  "Google"
* BROWSER SEARCH DEFAULT URL:  "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"
* BROWSER STARTUP HOMEPAGE:  "http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9"

.
REMOVED - user_pref("browser.startup.homepage", "http://ww17.ads.eorezo.com/cgi-bin/advert/getads.cgi?x_format=redirect&x_dp_id=9");

+---------------------------------------------------------------------------+


~~~~ INTERNET EXPLORER VERSION 7.0.5730.13 ~~~~

+--[HKEY_CURRENT_USER\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\INTERNET EXPLORER\MAIN]

Start page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~2550 BYTES] - "C:\AD-REPORT-CLEAN-18.01.2009.LOG"
[~4014 BYTES] - "C:\AD-REPORT-SCAN-18.01.2009.LOG"

End at: 18:01:09 | 18/01/2009 - Time elapsed: 97.1 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 55 Lines ]
+---------------------------------------------------------------------------+

ET CELUI DE HIJACKTHIS



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:04:05, on 18/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32
etdde.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\fichiers communs\aol\1209822846\ee\services\antiSpywareApp\ver2_0_28_1\AOLSP Scheduler.exe
c:\program files\fichiers communs\aol\1209822846\ee\aolsoftware.exe
C:\WINDOWS\system32
otepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Fichiers communs\AOL\1209822846\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - c:\program files\aol\aol toolbar 4.0esources\fr-FR\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://www.5-a-7.com/
O15 - Trusted Zone: http://www.sexfunlove.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.bellapix.com/ImageUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Fichiers communs\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

V-X · Answer

Re, Dans l'ordre; ▶ Relance hijack et clique sur "Do a system scan only" ▶ Ensuite recherche ces lignes et coches les cases O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" ▶ Ensuite clique sur "Fix checked" xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx > Fais un scan en ligne avec Kaspersky : Kaspersky N.B. : Le scan ne marche que sous Internet Explorer. - Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...). Allume les si necessaire. - Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >. - On va te demander de télécharger un contrôle active x, accepte . - Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer. - Poste le rapport qui sera généré stp. (clique sur puis sauvegarde-le sur ton bureau en choisissant "fichier texte (*.txt)" pour l'extension). S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : clic ici Rappel : le scan est à faire sous Internet Explorer Tuto ici si problème NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne. Pour le rapport Kaspersky il faut que tu choisisses "Afficher le rapport" puis que tu l'enregistres sur ton bureau sous forme de fichier texte (type de fichier "tous les fichiers").

DORIANGF · Answer

apres 6h d'analyse le voila enfin




-------------------------------------------------------------------------------
 KASPERSKY ONLINE SCANNER REPORT
 lundi 19 janvier 2009 00:23:25
 Operating System: Microsoft Windows XP Home Edition, Service Pack 3 (Build 2600)
 Kaspersky Online Scanner version: 5.0.84.2
 Kaspersky Anti-Virus database last update: 18/01/2009
 Kaspersky Anti-Virus database records: 1642835
-------------------------------------------------------------------------------

Scan Settings:
	Scan using the following antivirus database: extended
	Scan Archives: true
	Scan Mail Bases: true

Scan Target - My Computer:
	C:\
	D:\
	E:\
	F:\
	H:\

Scan Statistics:
	Total number of scanned objects: 70202
	Number of viruses found: 6
	Number of infected objects: 399 / 0
	Number of suspicious objects: 0
	Duration of the scan process: 05:54:24

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\AOL\UserProfiles\All Users\cls\common.cls	Object is locked	skipped
C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\cert8.db	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\content-prefs.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\cookies.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\downloads.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\formhistory.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\key3.db	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\parent.lock	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\permissions.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\places.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\places.sqlite-journal	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\search.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Bureau\AD-R.exe/TOOLS\cmdow.exe	Infected: not-a-virus:RiskTool.Win32.HideWindows	skipped
C:\Documents and Settings\DORIAN MORIN\Bureau\AD-R.exe	InstallCreator: infected - 1	skipped
C:\Documents and Settings\DORIAN MORIN\Bureau\AD-R.exe	UPX: infected - 1	skipped
C:\Documents and Settings\DORIAN MORIN\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Microsoft\Search Enhancement Pack\Search Box Extension\history.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\B2B1D2C6d01/TOOLS\cmdow.exe	Infected: not-a-virus:RiskTool.Win32.HideWindows	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\B2B1D2C6d01	InstallCreator: infected - 1	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\B2B1D2C6d01	UPX: infected - 1	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_001_	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_002_	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_003_	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\Cache\_CACHE_MAP_	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\urlclassifier3.sqlite	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Mozilla\Firefox\Profiles\yq6t7akl.default\XUL.mfl	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Neuf\Media Center\access.log	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Application Data\Neuf\Media Center\error.log	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Historique\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Historique\History.IE5\MSHist012009011820090119\index.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings	emp\etilqs_tnar5MMZQuid31c3ruD1	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings	emp\~DF9257.tmp	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings	emp\~DFDE06.tmp	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\DORIAN MORIN
tuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Cookies\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	Object is locked	skipped
C:\Documents and Settings\LocalService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\LocalService
tuser.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	Object is locked	skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	Object is locked	skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT	Object is locked	skipped
C:\Documents and Settings\NetworkService
tuser.dat.LOG	Object is locked	skipped
C:\Program Files\Ad-remover\TOOLS\cmdow.exe	Infected: not-a-virus:RiskTool.Win32.HideWindows	skipped
C:\Program Files\Nero\Nero8\Nero BackItUp\BIU2.txt	Object is locked	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\170656.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\198515.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\218671.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\246796.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\251671.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\254531.exe.vir	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\270859.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\289500.exe.vir	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\306718.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\380078.exe.vir	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\449656.exe.vir	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\465437.exe.vir	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\487781.exe.vir	Infected: Email-Worm.Win32.Bagle.majc	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\512671.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\525265.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\downld\588718.exe.vir	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\_winupgro_.exe.zip/winupgro.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\drivers\_winupgro_.exe.zip	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\3Q DVD to PSP Converter 2.1.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\3Q DVD to PSP Converter 2.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\602Pro PC SUITE 7.1.100.1248.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\602Pro PC SUITE 7.1.100.1248.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AbsoluteShield Internet Eraser Pro 3.65.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AbsoluteShield Internet Eraser Pro 3.65.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Acronis True Image Home 2009 12.0.9646.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Acronis True Image Home 2009 12.0.9646.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Actual Live 7.0.9.32.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Actual Live 7.0.9.32.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AgataSoft Shutdown Pro 2.9.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AgataSoft Shutdown Pro 2.9.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Alchemy SDK 0.4a.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Alchemy SDK 0.4a.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\American Glory Screensaver.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\American Glory Screensaver.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Aplus DivX to H.264 1.00.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Aplus DivX to H.264 1.00.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Apple iPhone DVD Converter 3.22.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Apple iPhone DVD Converter 3.22.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Art Appreciation 1.4.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Art Appreciation 1.4.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Automatically Push My Buttons 2.1.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Automatically Push My Buttons 2.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AutoSysBot 3.03.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\AutoSysBot 3.03.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Avaide MPEG Converter 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Avaide MPEG Converter 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Avira_Antivir_Premium_HBEDV_Serial_Licence.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Avira_Antivir_Premium_HBEDV_Serial_Licence.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Berthside 1.0.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Berthside 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\BitTorrent Toolbar - TorrentSeek 1.0.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\BitTorrent Toolbar - TorrentSeek 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Bluescreen 3.2.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Bluescreen 3.2.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Bug Cursors 1.1.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Bug Cursors 1.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Cafezee 3.8.5.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Cafezee 3.8.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Calc Pro 1.6.7.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Calc Pro 1.6.7.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\CDSurf.Net Professional 3.0.8.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\CDSurf.Net Professional 3.0.8.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Chronos 1.2.2.5.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Chronos 1.2.2.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ClockWatch Radio Sync Server 3.0.1.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ClockWatch Radio Sync Server 3.0.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ColorClipse Clock 1.0.0.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ColorClipse Clock 1.0.0.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Complete Anonymous Internet 1.0.2.0.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Complete Anonymous Internet 1.0.2.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DataWatch 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DataWatch 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Desktop Lock 7.2.1.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Desktop Lock 7.2.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Desktop Netstat 1.3a.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Desktop Netstat 1.3a.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\deviantArtAdsKiller! 0.9.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\deviantArtAdsKiller! 0.9.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DF Encryption Pad 2.0.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DF Encryption Pad 2.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Diode Processor 1185.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Diode Processor 1185.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\discoDSP Vertigo 2.6.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\discoDSP Vertigo 2.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DracoSoftware Process Killer 0.9.7.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\DracoSoftware Process Killer 0.9.7.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Drive Folder 7.6.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Drive Folder 7.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Dup Filter 2.30.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Dup Filter 2.30.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Dutch Radar Widget 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Dutch Radar Widget 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\EA.Mobile.The.Simpsons.Minutes.To.Meltdown.v4.1.79.S60v2.webpleasure.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\EA.Mobile.The.Simpsons.Minutes.To.Meltdown.v4.1.79.S60v2.webpleasure.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Easiestutils Video to Zune Converter 2.9.0.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Easiestutils Video to Zune Converter 2.9.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ERC (Email Redirecting Client) 2.02.01.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ERC (Email Redirecting Client) 2.02.01.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Exilty 0.86.7.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Exilty 0.86.7.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\F-Prot.Antivirus.para.Windows.3.14a.espa%C3%B1ol.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\F-Prot.Antivirus.para.Windows.3.14a.espa%C3%B1ol.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\False Teeth.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\False Teeth.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File by OCR 1.1.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File by OCR 1.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File Renamer Basic 5.0.5.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File Renamer Basic 5.0.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File Valet 1.2.1.5.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\File Valet 1.2.1.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Folder Customiser 2.0.5.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Folder Customiser 2.0.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Folder Pilot 1.00.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Folder Pilot 1.00.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Forewave Audio Converter 2.0.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Forewave Audio Converter 2.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Freewire TV 2.1.2.0 Beta.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Freewire TV 2.1.2.0 Beta.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\GoogImager Browser 1.0.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\GoogImager Browser 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Handy Recovery 4.0.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Handy Recovery 4.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\HP0-242 Practice Exam Testing Software 1.0.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\HP0-242 Practice Exam Testing Software 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IdealWeightCalculator 1.1.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IdealWeightCalculator 1.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IE Flower 1.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IE Flower 1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IFAebook 8.6.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\IFAebook 8.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iFolder 3.2.5347.1.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iFolder 3.2.5347.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\imgcnvrt.dll - Image Converter DLL 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\imgcnvrt.dll - Image Converter DLL 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\inCard 1.1.0.55.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\inCard 1.1.0.55.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\InstantLyric 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\InstantLyric 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\inStep 1.4.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\inStep 1.4.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iSeeSong Player 2.5.1.1.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iSeeSong Player 2.5.1.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iWellsoft Audio to AMR MP3 AAC AC3 Converter 1.6.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\iWellsoft Audio to AMR MP3 AAC AC3 Converter 1.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\JSpecView 1.0.20060627-2100.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\JSpecView 1.0.20060627-2100.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Just Watching 2.1.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Just Watching 2.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kaspersky.Anti-Virus.2006.Keys.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Kaspersky.Anti-Virus.2006.Keys.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LI Matrix calculator 1.6.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LI Matrix calculator 1.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LottoRocket 5.05.03.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\LottoRocket 5.05.03.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\macedonia toolbar for IE 4.5.132.0.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\macedonia toolbar for IE 4.5.132.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\MBRtool 2.2.100.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\MBRtool 2.2.100.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\McAfee.AntiSpyware.v2.0.0.167-ZWT.[nfoil.com].[WarezFaw.Com].zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\McAfee.AntiSpyware.v2.0.0.167-ZWT.[nfoil.com].[WarezFaw.Com].zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\MemoryCards 1.0.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\MemoryCards 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Morgan Stream Switcher v0.99.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Morgan Stream Switcher v0.99.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Mp3Works 1.00.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Mp3Works 1.00.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Navier 1.03.zip.vir/install_crack.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Navier 1.03.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Neuron Visual Java 1.0 b6.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Neuron Visual Java 1.0 b6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NGM 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NGM 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NHL Team Schedule 1.6.1.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NHL Team Schedule 1.6.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Nocturnal Elusions 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Nocturnal Elusions 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Norpath Elements Studio 3.2 build 390.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Norpath Elements Studio 3.2 build 390.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NTFS Streams Info 2.1.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\NTFS Streams Info 2.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Obsidian 1.04.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Obsidian 1.04.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Off The Road Winch Load Calculator 1.0.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Off The Road Winch Load Calculator 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Oracle Delete (Remove) Duplicate Entries Software 7.0.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Oracle Delete (Remove) Duplicate Entries Software 7.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Password Policy Manager 1.0.0.26.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Password Policy Manager 1.0.0.26.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PDF4U Pro 2.00.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PDF4U Pro 2.00.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Personal Budgeting Tool 1.0.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Personal Budgeting Tool 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Personal Inventory Organiser 2.0.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Personal Inventory Organiser 2.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PictoGrab 1.1.2.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\PictoGrab 1.1.2.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Pismo Trace Monitor SDK 1.0.0 Build 045.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Pismo Trace Monitor SDK 1.0.0 Build 045.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ProofGoogler.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\ProofGoogler.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Protected Storage PassView 1.63.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Protected Storage PassView 1.63.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Protocol Reader 1.0.1.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Protocol Reader 1.0.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\QMR.FM Radio Player 1.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\QMR.FM Radio Player 1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\QRYCLIENTIP 1.0.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\QRYCLIENTIP 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Reeves Photo Assistant 1.0 Build 2006-06-03-1.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Reeves Photo Assistant 1.0 Build 2006-06-03-1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Resolve for Alcra-B 1.07.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Resolve for Alcra-B 1.07.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\RevLib PDF Edition 1.4.8.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\RevLib PDF Edition 1.4.8.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\River Past Crazi Video for Blackberry 2.7.16.1904.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\River Past Crazi Video for Blackberry 2.7.16.1904.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\RM-X Mov To DivX 1.0.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\RM-X Mov To DivX 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Seekyou 4.32.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Seekyou 4.32.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Serial.Avg.7.Free.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Serial.Avg.7.Free.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Simplest Clock Screensaver 1.0.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Simplest Clock Screensaver 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SmartAudio Console 1.0.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SmartAudio Console 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SpyDefy 2.0.291.725.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SpyDefy 2.0.291.725.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\StarCauldron 14.3.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\StarCauldron 14.3.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Starry Night 1.0.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Starry Night 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Stock Explorer 1.2.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Stock Explorer 1.2.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SuperStorm 1.5.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\SuperStorm 1.5.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Superversion French PPC 3.0.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Superversion French PPC 3.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Swiftpage for Lotus Notes 1.7.3.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Swiftpage for Lotus Notes 1.7.3.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Symantec Mail Security v4.6 Server for MS Exchange Crack - Keygen - Serial.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Symantec Mail Security v4.6 Server for MS Exchange Crack - Keygen - Serial.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Symantec.Norton.Ghost.2003.ITA.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Symantec.Norton.Ghost.2003.ITA.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Synclosure 0.1.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Synclosure 0.1.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Tiger Envelopes 0.8.9.zip.vir/run.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Tiger Envelopes 0.8.9.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Toon Filter 1.0.zip.vir/keygen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Toon Filter 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Trustix AntiVirus 2005 Edition.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Trustix AntiVirus 2005 Edition.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TSLogins 1.0.zip.vir/key_gen.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TSLogins 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TurboVBLite 3.3.6.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\TurboVBLite 3.3.6.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\UK Map Locator 1.0.zip.vir/patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\UK Map Locator 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Undelete for Floppy 2.0.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Undelete for Floppy 2.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Unerase for NTFS 2.7.zip.vir/setup.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Unerase for NTFS 2.7.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\usingGuestBook 1.0.zip.vir/install.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\usingGuestBook 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\VRMultimedia.dll 1.0.2227.41406.zip.vir/key_generator.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\VRMultimedia.dll 1.0.2227.41406.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Winrental 868.00.zip.vir/install_patch.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Winrental 868.00.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Withes Tarot 1.0.zip.vir/crac.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Withes Tarot 1.0.zip.vir	ZIP: infected - 1	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Zip-I-Mage 2.0.zip.vir/serial.exe	Infected: Trojan-Downloader.Win32.Bagle.amf	skipped
C:\Qoobox\Quarantine\C\Documents and Settings\DORIAN MORIN\Application Data\m\shared\Zip-I-Mage 2.0.zip.vir	ZIP: infected - 1	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010376.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010380.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010413.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010445.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010447.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010459.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010461.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010485.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010490.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010493.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010502.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010504.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010508.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010509.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010624.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010627.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP43\A0010628.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010685.exe	Infected: Email-Worm.Win32.Bagle.majc	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010815.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010826.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010856.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010860.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010864.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010870.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010885.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010896.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010899.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010905.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010906.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010907.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010908.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010909.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010910.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010911.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010912.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010913.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010914.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010915.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010916.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010917.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010918.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010919.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010920.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010921.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010922.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010923.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010924.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010925.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010926.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010927.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010928.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010929.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010930.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010931.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010932.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010933.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010934.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010935.exe	Infected: Email-Worm.Win32.Bagle.majc	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010936.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010937.exe	Infected: Email-Worm.Win32.Bagle.majc	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010938.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010939.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010940.exe	Infected: Trojan-PSW.Win32.Agent.lfr	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010941.exe	Infected: Email-Worm.Win32.Bagle.majc	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010942.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0010996.sys	Infected: Trojan-Downloader.Win32.Bagle.amj	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011009.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011012.exe	Infected: Email-Worm.Win32.Bagle.of	skipped
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP44\A0011053.exe

V-X · Answer

Re,

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant en gras ci-dessous :


:files
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\3q dvd to psp converter 2.1.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\602pro pc suite 7.1.100.1248.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\absoluteshield internet eraser pro 3.65.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\acronis true image home 2009 12.0.9646.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\actual live 7.0.9.32.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\agatasoft shutdown pro 2.9.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\alchemy sdk 0.4a.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\american glory screensaver.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\aplus divx to h.264 1.00.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\apple iphone dvd converter 3.22.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\art appreciation 1.4.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\automatically push my buttons 2.1.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\autosysbot 3.03.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\avaide mpeg converter 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\avira_antivir_premium_hbedv_serial_licence.zip­.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\berthside 1.0.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\bittorrent toolbar - torrentseek 1.0.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\bluescreen 3.2.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\bug cursors 1.1.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\cafezee 3.8.5.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\calc pro 1.6.7.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\cdsurf.net professional 3.0.8.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\chronos 1.2.2.5.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\clockwatch radio sync server 3.0.1.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\colorclipse clock 1.0.0.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\complete anonymous internet 1.0.2.0.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\datawatch 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\desktop lock 7.2.1.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\desktop netstat 1.3a.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\deviantartadskiller! 0.9.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\df encryption pad 2.0.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\diode processor 1185.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\discodsp vertigo 2.6.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\dracosoftware process killer 0.9.7.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\drive folder 7.6.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\dup filter 2.30.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\dutch radar widget 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\ea.mobile.the.simpsons.minutes.to.meltdown.v4.­
1.79.s60v2.webpleasure.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\easiestutils video to zune converter 2.9.0.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\erc (email redirecting client) 2.02.01.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\exilty 0.86.7.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\f-prot.antivirus.para.windows.3.14a.espa%c3%b1­ol.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\false teeth.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\file by ocr 1.1.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\file renamer basic 5.0.5.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\file valet 1.2.1.5.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\folder customiser 2.0.5.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\folder pilot 1.00.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\forewave audio converter 2.0.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\freewire tv 2.1.2.0 beta.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\googimager browser 1.0.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\handy recovery 4.0.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\hp0-242 practice exam testing software 1.0.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\idealweightcalculator 1.1.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\ie flower 1.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\ifaebook 8.6.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\ifolder 3.2.5347.1.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\imgcnvrt.dll - image converter dll 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\imgcnvrt.dll
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\incard 1.1.0.55.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\instantlyric 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\instep 1.4.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\iseesong player 2.5.1.1.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\iwellsoft audio to amr mp3 aac ac3 converter 1.6.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\jspecview 1.0.20060627-2100.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\just watching 2.1.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\li matrix calculator 1.6.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\lottorocket 5.05.03.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\macedonia toolbar for ie 4.5.132.0.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\mbrtool 2.2.100.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\mcafee.antispyware.v2.0.0.167-zwt.[nfoil.com].­[warezfaw.com].zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\memorycards 1.0.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\morgan stream switcher v0.99.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\mp3works 1.00.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
avier 1.03.zip.vir/install_crack.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
euron visual java 1.0 b6.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
gm 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
hl team schedule 1.6.1.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
octurnal elusions 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
orpath elements studio 3.2 build 390.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared
tfs streams info 2.1.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\obsidian 1.04.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\off the road winch load calculator 1.0.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\oracle delete (remove) duplicate entries software 7.0.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\password policy manager 1.0.0.26.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\pdf4u pro 2.00.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\personal budgeting tool 1.0.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\personal inventory organiser 2.0.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\pictograb 1.1.2.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\pismo trace monitor sdk 1.0.0 build 045.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\proofgoogler.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\protected storage passview 1.63.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\protocol reader 1.0.1.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\qmr.fm radio player 1.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\qryclientip 1.0.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\sharedeeves photo assistant 1.0 build 2006-06-03-1.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\sharedesolve for alcra-b 1.07.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\sharedevlib pdf edition 1.4.8.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\sharediver past crazi video for blackberry 2.7.16.1904.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\sharedm-x mov to divx 1.0.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\seekyou 4.32.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\serial.avg.7.free.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\simplest clock screensaver 1.0.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\smartaudio console 1.0.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\spydefy 2.0.291.725.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\starcauldron 14.3.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\starry night 1.0.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\stock explorer 1.2.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\superstorm 1.5.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\superversion french ppc 3.0.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\swiftpage for lotus notes 1.7.3.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\symantec mail security v4.6 server for ms exchange crack - keygen - 
serial.zip.vir/serial.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\symantec.norton.ghost.2003.ita.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\synclosure 0.1.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared	iger envelopes 0.8.9.zip.vir/run.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared	oon filter 1.0.zip.vir/keygen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared	rustix antivirus 2005 edition.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared	slogins 1.0.zip.vir/key_gen.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared	urbovblite 3.3.6.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\uk map locator 1.0.zip.vir/patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\undelete for floppy 2.0.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\unerase for ntfs 2.7.zip.vir/setup.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\usingguestbook 1.0.zip.vir/install.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\vrmultimedia.dll 1.0.2227.41406.zip.vir/key_generator.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\vrmultimedia.dll
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\winrental 868.00.zip.vir/install_patch.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\withes tarot 1.0.zip.vir/crac.exe
c:\qoobox\quarantine\c\documents and settings\dorian morin\application data\m\shared\zip-i-mage 2.0.zip.vir/serial.exe

:commands
[purity]
[emptytemp]
[reboot] 



---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

DORIANGF · Answer

j'ai une mention lorsque je clique move it
invalid time flag! [ crac.exe ]
must be numerical

V-X · Answer

Re,

Supprime tout t'es cracks.

Ensuite fait ce qui suit:

Dans le menu Démarrer, clique droit sur l'icône Poste de travail.
Dans le menu contextuel qui s'affiche, clique sur Propriétés .
Dans l'onglet Restauration du système de la fenêtre qui suit, coche la
case Désactiver la Restauration du système sur tous les lecteurs, clique sur
Appliquer et, quand un message te le demande, confirme la désactivation.
Après quelques secondes d'attente (ou après avoir redémarré le PC), réactive la
Restauration du système en suivant la même procédure que précédemment, mais,
cette fois, en décochant la case Désactiver la Restauration du système sur
tous les lecteurs. Clique sur OK. 

Reinstalle ton antivirus et fait un scan avec et poste le rapport.

Destrio5 · Answer

Salut V-X,

Les infections ayant déjà été déplacées dans la quarantaine de ComboFix, il n'est pas utile de les redéplacer dans la quarantaine d'OTMoveIt.

Utilisateur anonyme · Answer

salut

c:\qoobox ->>quarantaine combofix (toolcleaner)

V-X · Answer

Re,

Si pas d'antivirus a part antivir le voilà.


&#x25B6 D'installer cet Antivirus:

ANTIVIR

&#x25B6 Double-clique sur l'icône d'Antivir (Parapluie) dans la barre des tâches. 

&#x25B6 Dans Antivir, choisis Outils puis Configuration.

&#x25B6 Coche Mode Expert et coche Rech. Rootkit au dém. de la recherche à droite dans Autres réglages. 

Avast et Antivir : comparaisons, et passage à Antivir.

&#x25B6 Fait la mise à jour d'antivir et fait le scan en mode sans échec.

Comment accéder au mode sans échec

DORIANGF · Answer

Supprime tout t'es cracks, c'est a dire desolé je ne suis pas un genie de l'informatique

V-X · Answer

Re,

Merci d'intervenir et je doit lui refaire toolscleaner ?

V-X · Answer

Re,



je pense que fait ce qui suit:

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 

* Clique sur Recherche et laisse le scan se terminer. 

* Clique sur Suppression pour finaliser. 

* Tu peux, si tu le souhaites, te servir des Options facultatives. 

* Clique sur Quitter, pour que le rapport puisse se créer. 

* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Destrio5 · Answer

---> Menu Démarrer > Exécuter > Tape combofix /u et valide.

Ça supprime la quarantaine de ComboFix ;)

Utilisateur anonyme · Answer

effectivement

V-X · Answer

Re,

OKI.

Aussi pour DORIANGF:

Voir le poste=>46

DORIANGF · Answer

j'ai supprime combofix com indique dans le post 50 et maintenant je redemarre en mode sans echec avec antivir post 46 merci

V-X · Answer

Re,

Tout à fait.

DORIANGF · Answer

VOILA LE RAPPORT ANTIVIR Avira AntiVir Personal Date de création du fichier de rapport : lundi 19 janvier 2009 01:02 La recherche porte sur 1224506 souches de virus. Détenteur de la licence :Avira AntiVir PersonalEdition Classic Numéro de série : 0000149996-ADJIE-0001 Plateforme : Windows XP Version de Windows :(Service Pack 3) [5.1.2600] Mode Boot : Mode sans échec avec assistance réseau Identifiant : Administrateur Nom de l'ordinateur :SN100177990248 Informations de version : BUILD.DAT : 8.2.0.52 16931 Bytes 02/12/2008 14:55:00 AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:00 AVSCAN.DLL : 8.1.4.1 49921 Bytes 21/07/2008 13:44:27 LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:16 LUKERES.DLL : 8.1.4.0 13057 Bytes 04/07/2008 07:30:27 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36 ANTIVIR1.VDF : 7.1.1.113 2817536 Bytes 14/01/2009 17:08:36 ANTIVIR2.VDF : 7.1.1.114 2048 Bytes 14/01/2009 17:08:36 ANTIVIR3.VDF : 7.1.1.137 304128 Bytes 18/01/2009 17:08:38 Version du moteur: 8.2.0.57 AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56 AESCRIPT.DLL : 8.1.1.26 340347 Bytes 18/01/2009 17:08:49 AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41 AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38 AEPACK.DLL : 8.1.3.5 393588 Bytes 18/01/2009 17:08:48 AEOFFICE.DLL : 8.1.0.33 196987 Bytes 18/01/2009 17:08:46 AEHEUR.DLL : 8.1.0.84 1540471 Bytes 18/01/2009 17:08:45 AEHELP.DLL : 8.1.2.0 119159 Bytes 18/01/2009 17:08:42 AEGEN.DLL : 8.1.1.10 323957 Bytes 18/01/2009 17:08:41 AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56 AECORE.DLL : 8.1.5.2 172405 Bytes 18/01/2009 17:08:39 AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56 AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:02 AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:27:58 AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15 AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:37 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:19 AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:46 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02 SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:36 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:07 RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 04/07/2008 07:23:16 RCTEXT.DLL : 8.0.52.1 86273 Bytes 17/07/2008 10:08:43 Configuration pour la recherche actuelle : Nom de la tâche..................: Contrôle intégral du système Fichier de configuration.........: c:\program files\avira\antivir personaledition classic\sysscan.avp Documentation....................: bas Action principale................: interactif Action secondaire................: ignorer Recherche sur les secteurs d'amorçage maître: marche Recherche sur les secteurs d'amorçage: marche Secteurs d'amorçage..............: C:, E:, F:, Recherche dans les programmes actifs: marche Recherche en cours sur l'enregistrement: marche Recherche de Rootkits............: arrêt Fichier mode de recherche........: Sélection de fichiers intelligente Recherche sur les archives.......: marche Limiter la profondeur de récursivité: 20 Archive Smart Extensions.........: marche Heuristique de macrovirus........: marche Heuristique fichier..............: moyen Début de la recherche : lundi 19 janvier 2009 01:02 La recherche sur les processus démarrés commence : Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés Processus de recherche 'avcenter.exe' - '1' module(s) sont contrôlés Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés Processus de recherche 'services.exe' - '1' module(s) sont contrôlés Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés '13' processus ont été contrôlés avec '13' modules La recherche sur les secteurs d'amorçage maître commence : Secteur d'amorçage maître HD0 [INFO] Aucun virus trouvé ! Secteur d'amorçage maître HD1 [INFO] Aucun virus trouvé ! Secteur d'amorçage maître HD2 [INFO] Aucun virus trouvé ! [AVERTISSEMENT] Erreur système [21]: Le périphérique n'est pas prêt. La recherche sur les secteurs d'amorçage commence : Secteur d'amorçage 'C:\' [INFO] Aucun virus trouvé ! Secteur d'amorçage 'E:\' [INFO] Aucun virus trouvé ! Secteur d'amorçage 'F:\' [INFO] Aucun virus trouvé ! La recherche sur les renvois aux fichiers exécutables (registre) commence. Le registre a été contrôlé ( '57' fichiers). La recherche sur les fichiers sélectionnés commence : Recherche débutant dans 'C:\' C:\pagefile.sys [AVERTISSEMENT] Impossible d'ouvrir le fichier ! Recherche débutant dans 'E:\' Recherche débutant dans 'F:\' Fin de la recherche : lundi 19 janvier 2009 01:56 Temps nécessaire: 53:24 Minute(s) La recherche a été effectuée intégralement 6818 Les répertoires ont été contrôlés 286278 Des fichiers ont été contrôlés 0 Des virus ou programmes indésirables ont été trouvés 0 Des fichiers ont été classés comme suspects 0 Des fichiers ont été supprimés 0 Des virus ou programmes indésirables ont été réparés 0 Les fichiers ont été déplacés dans la quarantaine 0 Les fichiers ont été renommés 1 Impossible de contrôler des fichiers 286277 Fichiers non infectés 8532 Les archives ont été contrôlées 2 Avertissements 0 Consignes

V-X · Answer

Re,

Comment va le pc ?

As tu fait la manip de la restauration ?

DORIANGF · Answer

la manip de la restauration??????????????
j'ai seulement quitté le mode sans echec en redemarrant et pour le moment il a l'air de tourner correctement, comment fait on une restauration si besoin? l'antivirus a l'air de fonctionné et tout a l'air optimal spybot n'as pas l'air de fonctionné mais il avait été semble t il endomagé en le reinstallant j'espere que ce sera assez, mais autrement il a l'air d'etre revenue a la normal dois je ressortir un rapport?

V-X · Answer

Re,

Pour spybot tu devras le réinstaller.

Pour la restauration système comme elle et infecter il faut purger .

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 

* Clique sur Recherche et laisse le scan se terminer. 

* Clique sur Suppression pour finaliser. 

* Tu peux, si tu le souhaites, te servir des Options facultatives. 

* Clique sur Quitter, pour que le rapport puisse se créer. 

* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Dans le menu Démarrer, clique droit sur l'icône Poste de travail.
Dans le menu contextuel qui s'affiche, clique sur Propriétés .
Dans l'onglet Restauration du système de la fenêtre qui suit, coche la
case Désactiver la Restauration du système sur tous les lecteurs, clique sur
Appliquer et, quand un message te le demande, confirme la désactivation.
Après quelques secondes d'attente (ou après avoir redémarré le PC), réactive la
Restauration du système en suivant la même procédure que précédemment, mais,
cette fois, en décochant la case Désactiver la Restauration du système sur
tous les lecteurs. Clique sur OK.

DORIANGF · Answer

ca fait plusieur fois que je lance toolscleaner mais celui se bloque et ne repond pas des son lancement

V-X · Answer

Re,

Dans le menu Démarrer, clique droit sur l'icône Poste de travail.
Dans le menu contextuel qui s'affiche, clique sur Propriétés .
Dans l'onglet Restauration du système de la fenêtre qui suit, coche la
case Désactiver la Restauration du système sur tous les lecteurs, clique sur
Appliquer et, quand un message te le demande, confirme la désactivation.
Après quelques secondes d'attente (ou après avoir redémarré le PC), réactive la
Restauration du système en suivant la même procédure que précédemment, mais,
cette fois, en décochant la case Désactiver la Restauration du système sur
tous les lecteurs. Clique sur OK.

Ensuite désinstalle manuellement les log que l'on a utiliser pour te désinfecter.

DORIANGF · Answer

desole j'etais impatient il l'as fais oups

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\FindyKill.txt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\DORIAN MORIN\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\DORIAN MORIN\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\WINDOWS\Gmer.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\WINDOWS\Gmer.exe: ERREUR DE SUPPRESSION !!
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\DORIAN MORIN\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\DORIAN MORIN\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

V-X · Answer

Re,

Vide ta corbeille et recherche =>C:\WINDOWS\Gmer.exe et supprime le et vide ta corbeille également reinstalle spybot et dit quoi.

Aussi conserve malwarebyte;

Fait ce qui suit également:

&#x25B6 Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
CCLEANER

&#x25B6 Lance-le. Va dans "Options" puis "Avancé",
 
&#x25B6 Tu décoches la case "Effacer uniquement les fichiers etc...". 

&#x25B6 Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage.

&#x25B6 Tu vas dans "Registre", tu fais "Chercher des erreurs". 

Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

&#x25B6 Un tuto ( aide )

DORIANGF · Answer

VOILA C FAIT QUOI D'AUTRE ENSUITE SI IL Y A UNE SUITE

V-X · Answer

Re,

Je pense que maintenant tu peut créer un pont de restauration et sauf avis contraire tu peut mettre en résolu.

DORIANGF · Answer

OK JE TE DOIS UN GRAND MERCI SI JE N'ETAIT PAS MARIE JE T'EPOUSERAI LOL MERCI BEAUCOUP POUR TON ASSISTANCE

AU SECOUR GUSANO BAGLE - Page 4

Discussions similaires

Newsletters