TR/CryptXRD.Gen

bonjour,
desole pour hier... ras le bol
il m'est impossible de me connecter le pC redemarre en permanence
comment puis-copier un programme ?

je suis sur un autre pc

non mais pas de connecton internet en mode sans echec

je pense que oui mais la je n'en ai pas sous la main

logiquement oui

j'ai copie le logiciel sur un cd mais lorsque je l'ouvre sur le pc le cd est vide alors que sue le laptop le logiciel est sur le cd

meme probleme avec le laptop le logiciel est sur le cd avec le pc non

OS ???

en fait, impossible de copier avec le laptop car il est securise par la boite
il faut que je cherche un autre laptop ou pc (voisins, amis...)

Aujourd'hui, dur dur

XP

en fait je dois copier le logiciel sur usb ou cd et l'installer sur le PC en mode non echec et apres suivre instructions

bonjour,
voici le rapport
merci pour ton aide


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:43:33, on 14/04/2009
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.onet.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\java\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\java\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\java\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\java\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [lech] C:\Documents and Settings\lech\lech.exe /i
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\java\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1981
Windows 5.1.2600 Dodatek Service Pack 2

14/04/2009 13:27:22
mbam-log-2009-04-14 (13-27-22).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 357567
Temps écoulé: 1 hour(s), 14 minute(s), 0 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 12
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 55

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Spamtool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ws2_32sik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\WINDOWS\MaxTV\uninstall_maxtv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\FOUND.018\FILE0002.CHK (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\Instalki\taboret\bin\uni\uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN10.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN12.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN13.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN14.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN16.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN17.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN19.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN21.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN22.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN23.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN24.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN25.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN26.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN28.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN29.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN30.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN31.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN32.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN33.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN34.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN35.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN37.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN38.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN39.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN3A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN3B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN3C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN3D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN3F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN40.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN41.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN42.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN43.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN44.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN45.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN47.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN48.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

j'ai redemarre le pc comme demande et je viens d'avoir 4 alertes d'antivir avec le meme virus

je viens d'effectuer un scan avec antivir
voici le rapport :
Avira AntiVir Personal
Report file date: 14 kwietnia 2009 13:50

Scanning for 1350736 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Dodatek Service Pack 2) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : LESZEK

Version information:
BUILD.DAT : 9.0.0.387 17962 Bytes 2009-03-24 11:04:00
AVSCAN.EXE : 9.0.3.3 464641 Bytes 2009-02-24 10:13:28
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 08:58:26
LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 09:35:50
LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 08:58:54
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 10:30:38
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2009-02-11 18:33:28
ANTIVIR2.VDF : 7.1.3.0 1330176 Bytes 2009-04-01 11:49:46
ANTIVIR3.VDF : 7.1.3.48 217088 Bytes 2009-04-14 11:49:48
Engineversion : 8.2.0.138
AEVDF.DLL : 8.1.1.0 106868 Bytes 2009-01-27 15:36:42
AESCRIPT.DLL : 8.1.1.73 373114 Bytes 2009-04-14 11:50:14
AESCN.DLL : 8.1.1.10 127348 Bytes 2009-04-14 11:50:10
AERDL.DLL : 8.1.1.3 438645 Bytes 2008-10-29 16:24:42
AEPACK.DLL : 8.1.3.12 397687 Bytes 2009-04-14 11:50:10
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2009-02-26 18:01:58
AEHEUR.DLL : 8.1.0.114 1700214 Bytes 2009-04-14 11:50:06
AEHELP.DLL : 8.1.2.2 119158 Bytes 2009-02-26 18:01:58
AEGEN.DLL : 8.1.1.33 340340 Bytes 2009-04-14 11:49:54
AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-09 12:32:40
AECORE.DLL : 8.1.6.7 176502 Bytes 2009-04-14 11:49:50
AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 12:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 06:48:00
AVPREF.DLL : 9.0.0.1 43777 Bytes 2008-12-05 08:32:16
AVREP.DLL : 8.0.0.3 155905 Bytes 2009-01-20 12:34:30
AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 08:32:10
AVARKT.DLL : 9.0.0.1 292609 Bytes 2009-02-09 05:52:26
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 08:37:10
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 13:03:50
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 06:21:34
NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 08:32:12
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 2009-02-09 09:45:46
RCTEXT.DLL : 9.0.35.0 87297 Bytes 2009-03-11 13:55:14

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: 14 kwietnia 2009 13:50

Starting search for hidden objects.
'31696' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'ALG.EXE' - '1' Module(s) have been scanned
Scan process 'WSCNTFY.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'zlclient.exe' - '0' Module(s) have been scanned
Scan process 'NvMixerTray.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'vsmon.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
30 processes with 30 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '45' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\lech\lech.exe
[DETECTION] Is the TR/Agent.camf Trojan
Begin scan in 'D:\' <New Volume>
D:\Instalki\Acdsee 7 PP\ACDSee v7.0PP kg.exe
[DETECTION] This file has been compressed using unusual runtime compression (PCK/FSG). Please verify the origin of this file.
D:\Instalki\nero\Nero-7.0.1.2_plk.exe
[0] Archive type: RAR SFX (self extracting)
--> Cab\0093A6D4.cab
[1] Archive type: CAB (Microsoft)
--> NeroMediaBrowserCore4B6F2338.dll
[WARNING] The file could not be written!
--> NeroMediaBrowserCorePluginsE7CCFC9A.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\1B05D29F.cab
[1] Archive type: CAB (Microsoft)
--> GCLib6F8EAA22.DLL
[WARNING] The file could not be written!
--> GCLocale9D907DCB.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\28E70B86.cab
[1] Archive type: CAB (Microsoft)
--> NBFtp4A80FEF2.dll
[WARNING] The file could not be written!
--> NBHDMgr92B9F8F8.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\49B52B36.cab
[1] Archive type: CAB (Microsoft)
--> NMDataServices0958A224.dll
[WARNING] The file could not be written!
--> NMFirstStartD9B4E50E.exe
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\4D801849.cab
[1] Archive type: CAB (Microsoft)
--> NeroFileDialog9E8F9C51.dll
[WARNING] The file could not be written!
--> NeroSearchD058B1F2.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\62B880F1.cab
[1] Archive type: CAB (Microsoft)
--> NMSIndexService7AF6D4CB.dll
[WARNING] The file could not be written!
--> NMSMediaServer337E5F47.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\B1EFF3E9.cab
[1] Archive type: CAB (Microsoft)
--> GCCore1F78A30C.dll
[WARNING] The file could not be written!
--> GCHWA37144A8.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\C65395A1.cab
[1] Archive type: CAB (Microsoft)
--> FImgPlg9B6544FA.dll
[WARNING] The file could not be written!
--> freeimage_license0AA2320A.txt
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\DD3AACFD.cab
[1] Archive type: CAB (Microsoft)
--> gaa87623F1A.bin
[WARNING] The file could not be written!
--> InCD_4___FAQF789944C.html
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\F3C38DF7.cab
[1] Archive type: CAB (Microsoft)
--> Aiff3F1F71C6.dll
[WARNING] The file could not be written!
--> DefConvertorA41949AA.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\F9874CBB.cab
[1] Archive type: CAB (Microsoft)
--> NeroMediaBrowserCoreC21DF66B.dll
[WARNING] The file could not be written!
--> NeroMediaBrowserCorePlugins4536A65F.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0193400.exe
[DETECTION] Is the TR/Trash.Gen Trojan
Begin scan in 'E:\' <New Volume>
E:\E-book\Lumley.Brian.Nekroskop.II.INTERNAL.MULTi-FORMAT.PL.eBook-Uuk\uukn2inb.zip
[0] Archive type: ZIP
--> uukn2in.r00
[1] Archive type: RAR
--> HTML\coversmall.jpg
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\E-book\Lumley.Brian.Nekroskop.V.MULTi-FORMAT.PL.eBook-Uuk\uuklbn5b.zip
[0] Archive type: ZIP
--> uuklbn5.r00
[1] Archive type: RAR
--> HTML\coversmall.jpg
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\MEch\Second_Life_1-18-5-3_Setup.exe
[0] Archive type: NSIS
--> [ProgramFilesDir]/SecondLife/7a5c2b26-eff3-5283-558e-90b305eda438.j2c
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\STARY DYSK C\Program Files\ZangoToolbar\ZangoInstaller.exe
[0] Archive type: RSRC
--> Object
[1] Archive type: CAB (Microsoft)
--> clientax.dll
[DETECTION] Contains recognition pattern of the ADSPY/180Solution.Q adware or spyware
E:\STARY DYSK C\WINDOWS\SoftwareDistribution\Download\c400fea62b4639d0b48a59f67a307130\BIT310.tmp
[0] Archive type: CAB (Microsoft)
--> B_31321\atiddc.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\UGS\NX4\UGDOC\html_files\search\data_ugcatia5\qa_1.rds
[0] Archive type: GZ
--> qa_1
[1] Archive type: MacBinary
--> ugcatia5/02topic_1.html.info
[WARNING] The file could not be read!
[WARNING] The file could not be read!

Beginning disinfection:
C:\Documents and Settings\lech\lech.exe
[DETECTION] Is the TR/Agent.camf Trojan
[NOTE] The file was moved to '4a4789b7.qua'!
D:\Instalki\Acdsee 7 PP\ACDSee v7.0PP kg.exe
[DETECTION] This file has been compressed using unusual runtime compression (PCK/FSG). Please verify the origin of this file.
[NOTE] The file was moved to '4a288995.qua'!
D:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0193400.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '4a158982.qua'!
E:\STARY DYSK C\Program Files\ZangoToolbar\ZangoInstaller.exe
[NOTE] The file was moved to '4a5289b3.qua'!


End of the scan: 14 kwietnia 2009 15:02
Used time: 1:10:58 Hour(s)

The scan has been done completely.

17094 Scanned directories
728440 Files were scanned
4 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
4 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
728435 Files not concerned
5380 Archives were scanned
33 Warnings
5 Notes
31696 Objects were scanned with rootkit scan
0 Hidden objects were found

j'ai mis les 4 virus en 40aine
une suite a donner ?

voici la reponse de HijackThis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:14:50, on 14/04/2009
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
E:\java\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
E:\java\bin\jqs.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\java\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\java\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\java\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\java\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [lech] C:\Documents and Settings\lech\lech.exe /i
O4 - HKCU\..\Run: [] C:\Documents and Settings\lech\.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\java\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

j'ai aussi fait un scan antivr en mode sans echec et rien
j'ai recommence en mode normal et voila le resultat : 2 virus
alors que dans le 1er scan antivir il y en avait 4 mis en quarantaine puis detruits
2eme scan :

Avira AntiVir Personal
Report file date: 14 kwietnia 2009 16:58

Scanning for 1350736 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Dodatek Service Pack 2) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : LESZEK

Version information:
BUILD.DAT : 9.0.0.387 17962 Bytes 2009-03-24 11:04:00
AVSCAN.EXE : 9.0.3.3 464641 Bytes 2009-02-24 10:13:28
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 08:58:26
LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 09:35:50
LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 08:58:54
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 2008-10-27 10:30:38
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2009-02-11 18:33:28
ANTIVIR2.VDF : 7.1.3.0 1330176 Bytes 2009-04-01 11:49:46
ANTIVIR3.VDF : 7.1.3.48 217088 Bytes 2009-04-14 11:49:48
Engineversion : 8.2.0.138
AEVDF.DLL : 8.1.1.0 106868 Bytes 2009-01-27 15:36:42
AESCRIPT.DLL : 8.1.1.73 373114 Bytes 2009-04-14 11:50:14
AESCN.DLL : 8.1.1.10 127348 Bytes 2009-04-14 11:50:10
AERDL.DLL : 8.1.1.3 438645 Bytes 2008-10-29 16:24:42
AEPACK.DLL : 8.1.3.12 397687 Bytes 2009-04-14 11:50:10
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2009-02-26 18:01:58
AEHEUR.DLL : 8.1.0.114 1700214 Bytes 2009-04-14 11:50:06
AEHELP.DLL : 8.1.2.2 119158 Bytes 2009-02-26 18:01:58
AEGEN.DLL : 8.1.1.33 340340 Bytes 2009-04-14 11:49:54
AEEMU.DLL : 8.1.0.9 393588 Bytes 2008-10-09 12:32:40
AECORE.DLL : 8.1.6.7 176502 Bytes 2009-04-14 11:49:50
AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 12:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 06:48:00
AVPREF.DLL : 9.0.0.1 43777 Bytes 2008-12-05 08:32:16
AVREP.DLL : 8.0.0.3 155905 Bytes 2009-01-20 12:34:30
AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 08:32:10
AVARKT.DLL : 9.0.0.1 292609 Bytes 2009-02-09 05:52:26
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 08:37:10
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 13:03:50
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 06:21:34
NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 08:32:12
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 2009-02-09 09:45:46
RCTEXT.DLL : 9.0.35.0 87297 Bytes 2009-03-11 13:55:14

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: 14 kwietnia 2009 16:58

Starting search for hidden objects.
HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C91FE6B0-F96F-4D15-A2D1-D9F88E755F88}\ntecontextlist
[INFO] The registry entry is invisible.
'31792' objects were checked, '1' hidden objects were found.

The scan of running processes will be started
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned
Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned
Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned
Scan process 'ZLCLIENT.EXE' - '0' Module(s) have been scanned
Scan process 'NvMixerTray.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned
Scan process 'SCHED.EXE' - '1' Module(s) have been scanned
Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned
Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned
Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned
Scan process 'VSMON.EXE' - '0' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned
Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned
Scan process 'LSASS.EXE' - '1' Module(s) have been scanned
Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned
Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned
Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned
Scan process 'SMSS.EXE' - '1' Module(s) have been scanned
31 processes with 31 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).
The registry was scanned ( '45' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
Begin scan in 'D:\' <New Volume>
D:\Instalki\nero\Nero-7.0.1.2_plk.exe
[0] Archive type: RAR SFX (self extracting)
--> Cab\0093A6D4.cab
[1] Archive type: CAB (Microsoft)
--> NeroMediaBrowserCore4B6F2338.dll
[WARNING] The file could not be written!
--> NeroMediaBrowserCorePluginsE7CCFC9A.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\1B05D29F.cab
[1] Archive type: CAB (Microsoft)
--> GCLib6F8EAA22.DLL
[WARNING] The file could not be written!
--> GCLocale9D907DCB.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\28E70B86.cab
[1] Archive type: CAB (Microsoft)
--> NBFtp4A80FEF2.dll
[WARNING] The file could not be written!
--> NBHDMgr92B9F8F8.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\49B52B36.cab
[1] Archive type: CAB (Microsoft)
--> NMDataServices0958A224.dll
[WARNING] The file could not be written!
--> NMFirstStartD9B4E50E.exe
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\4D801849.cab
[1] Archive type: CAB (Microsoft)
--> NeroFileDialog9E8F9C51.dll
[WARNING] The file could not be written!
--> NeroSearchD058B1F2.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\62B880F1.cab
[1] Archive type: CAB (Microsoft)
--> NMSIndexService7AF6D4CB.dll
[WARNING] The file could not be written!
--> NMSMediaServer337E5F47.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\B1EFF3E9.cab
[1] Archive type: CAB (Microsoft)
--> GCCore1F78A30C.dll
[WARNING] The file could not be written!
--> GCHWA37144A8.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\C65395A1.cab
[1] Archive type: CAB (Microsoft)
--> FImgPlg9B6544FA.dll
[WARNING] The file could not be written!
--> freeimage_license0AA2320A.txt
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\DD3AACFD.cab
[1] Archive type: CAB (Microsoft)
--> gaa87623F1A.bin
[WARNING] The file could not be written!
--> InCD_4___FAQF789944C.html
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\F3C38DF7.cab
[1] Archive type: CAB (Microsoft)
--> Aiff3F1F71C6.dll
[WARNING] The file could not be written!
--> DefConvertorA41949AA.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> Cab\F9874CBB.cab
[1] Archive type: CAB (Microsoft)
--> NeroMediaBrowserCoreC21DF66B.dll
[WARNING] The file could not be written!
--> NeroMediaBrowserCorePlugins4536A65F.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0194432.exe
[DETECTION] This file has been compressed using unusual runtime compression (PCK/FSG). Please verify the origin of this file.
Begin scan in 'E:\' <New Volume>
E:\E-book\Lumley.Brian.Nekroskop.II.INTERNAL.MULTi-FORMAT.PL.eBook-Uuk\uukn2inb.zip
[0] Archive type: ZIP
--> uukn2in.r00
[1] Archive type: RAR
--> HTML\coversmall.jpg
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\E-book\Lumley.Brian.Nekroskop.V.MULTi-FORMAT.PL.eBook-Uuk\uuklbn5b.zip
[0] Archive type: ZIP
--> uuklbn5.r00
[1] Archive type: RAR
--> HTML\coversmall.jpg
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\MEch\Second_Life_1-18-5-3_Setup.exe
[0] Archive type: NSIS
--> [ProgramFilesDir]/SecondLife/7a5c2b26-eff3-5283-558e-90b305eda438.j2c
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\STARY DYSK C\WINDOWS\SoftwareDistribution\Download\c400fea62b4639d0b48a59f67a307130\BIT310.tmp
[0] Archive type: CAB (Microsoft)
--> B_31321\atiddc.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
E:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0194433.exe
[0] Archive type: RSRC
--> Object
[1] Archive type: CAB (Microsoft)
--> clientax.dll
[DETECTION] Contains recognition pattern of the ADSPY/180Solution.Q adware or spyware
E:\UGS\NX4\UGDOC\html_files\search\data_ugcatia5\qa_1.rds
[0] Archive type: GZ
--> qa_1
[1] Archive type: MacBinary
--> ugcatia5/02topic_1.html.info
[WARNING] The file could not be read!
[WARNING] The file could not be read!

Beginning disinfection:
D:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0194432.exe
[DETECTION] This file has been compressed using unusual runtime compression (PCK/FSG). Please verify the origin of this file.
[NOTE] The file was moved to '4a15c696.qua'!
E:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0194433.exe
[NOTE] The file was moved to '4e56634f.qua'!


End of the scan: 14 kwietnia 2009 19:22
Used time: 2:07:13 Hour(s)

The scan has been done completely.

17111 Scanned directories
728647 Files were scanned
2 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
2 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
728644 Files not concerned
5390 Archives were scanned
33 Warnings
3 Notes
31792 Objects were scanned with rootkit scan
1 Hidden objects were found

certainement tout ca te parle plus qu'a moi

SUPERAntiSpyware journal de bord
voila le rapport
mais avant j'avais envoye un malwarebytes qui avait trouve un virus
https://www.superantispyware.com/
Malwarebytes' Anti-Malware 1.36
Version de la base de données: 1981
Windows 5.1.2600 Dodatek Service Pack 2

14/04/2009 21:31:02
mbam-log-2009-04-14 (21-31-02).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 357653
Temps écoulé: 1 hour(s), 5 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 5

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{9B437680-9167-47DE-98D0-6454C810F1D5}\RP456\A0193399.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\lech\Ustawienia lokalne\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.





Généré 04/14/2009 at 10:16 PM

Version du Logiciel : 4.26.1000

Core Rules Database Version : 3843
Trace Rules Database Version: 1798

Genre de Scan : Scan Complčte
Temps total du Scan : 00:24:28

Articles du Mémoire analysés : 434
Risques de dommage de Mémoire détectés : 0
Articles du Registre analysés : 4790
Risques de dommage de Registre détectés : 0
Articles de fichier scannés : 54634
Risques du Dommage de Fichier Détectés : 0

voici le rapport
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/

Generated 04/15/2009 at 03:33 PM

Application Version : 4.26.1000

Core Rules Database Version : 3843
Trace Rules Database Version: 1798

Scan type : Complete Scan
Total Scan Time : 02:08:34

Memory items scanned : 386
Memory threats detected : 0
Registry items scanned : 4783
Registry threats detected : 0
File items scanned : 359368
File threats detected : 1

Adware.Tracking Cookie
C:\Documents and Settings\lech\Cookies\lech@tradedoubler[1].txt

autre chose a faire
ou le pc est de nouveau sain ?

[ Rapport ToolsCleaner version 2.3.5 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Documents and Settings\All Users\Menu Start\Programy\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Start\Programy\HijackThis\HijackThis.lnk: trouvé !
rapport toolcleaner2
C:\Documents and Settings\lech\Moje dokumenty\HJTInstall.exe: trouvé !
C:\Documents and Settings\lech\Moje dokumenty\dds.scr: trouvé !
C:\Documents and Settings\lech\Pulpit\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users\Menu Start\Programy\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\lech\Moje dokumenty\HJTInstall.exe: supprimé !
C:\Documents and Settings\lech\Pulpit\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Documents and Settings\lech\Moje dokumenty\dds.scr: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\Documents and Settings\All Users\Menu Start\Programy\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

JavaRa 1.13 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Apr 15 20:27:24 2009

Found and removed: C:\Program Files\Java\jre1.6.0_03

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Classes\JavaPlugin.160_03

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_03

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610003

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}

Found and removed: Software\Classes\JavaPlugin.160_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_03

Found and removed: Software\JavaSoft\Java2D\1.6.0_03

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_03\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_07\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_03.b05\

------------------------------------

Finished reporting.

Un GRAND MERCI pour ton aide
des explications tip top
il me reste a retrouver le mot de passe administrateur et le tour sera joue !

derniere question : comment passer le topic en resolu ?

Merci