Invasion de Trojan need help

Nathalie -  
Bonjour,

J'ai ete infectee par n virus apres avoir clique sur un lien MSN :
http://viewpics.myphotos.cc/views.php?dir=pics&section=hot&clip=14

Ce virus a envoye ce lien à tous mes contacts qui ont eux aussi ete infectes.

Depuis tous mes parametres de securite ont ete modifies, j'ai du mal à acceder à certain sites comme hotmail, yahoo. Ma version de msn a ete modifiee.

Il semble aussi que j'aie une invasion de trojan, mon antivirus n'arrete pas d'en attraper, voici la liste :

:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\WEBSITE[1].OCX

Is the Trojan horse TR/Dldr.Agent.EX

C:\DOCUME~1\CARREF~1\LOCALS~1\TEMP\RARSFX1\RAR.EXE

Is the Trojan horse TR/Dldr.IstBar.IQ
C:\DOCUME~1\CARREF~1\LOCALS~1\TEMP\RARSFX1\VONNER.EXE

Is the Trojan horse TR/StartPage.nk.8.B

C:\TEMP\NCASEPACKAGE.EXE

Is the Trojan horse TR/Drop.180Soluti.A

C:\TEMP\OPTIMIZE.EXE

Is the Trojan horse TR/Dldr.Dyfuca.ds

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\PROMPT[1].HTM

Contains signature of the HTML script virus HTML/IstBar.A.1

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CTQNGDMJ\WEBSITE[1].OCX

Is the Trojan horse TR/Dldr.Agent.EX

C:\DOCUMENTS AND SETTINGS\CARREFOUR\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\0LIN4T2F\JEEP3YD[1].JPG

Is the Trojan horse TR/LowZones.AN.1

C:\PROGRAM FILES\AVPERSONAL\INFECTED\JOCKER[1].EXE.VIR

Is the Trojan horse TR/StartPage.nk.7

On m'a conseille de faire un scan avec a²free, mais je ne sais pas si ce sera suffisant.

Y'a t-il autre chose à faire?

Dois-je supprimer les fichiers Trojen ou peut il s'agir de fichier systemes?

Que dois je faire d'autre?

Savez-vous quel est le nom d virus par lequel je suis infectee.

Merci milles fois pour vos reponses.

11 réponses

  • Votes
  • Date
  • Date décroissante
  2. Utilisateur anonyme
    salut nathalie et neo;
    et aussi:
    C:\PROGRAM FILES\AVPERSONAL\INFECTED\JOCKER[1].EXE.VIR

    celui ci est dans la quarantaine d antivir suis le chemin et supprime le, et vide ta corbeille !

    a+
    1. Tchoupi51
      Bonjour,

      J'ai le même problème que Nathalie, j'ai beau scanner, supprimer et rescanner après le démarrage de mon ordinateur, les virus revienne. J'ai essayé Antivir, spybot, adware...

      Si qqun a une solution,
      Merci
      1. Utilisateur anonyme
        slt tchoupi
        c est quoi ton antivirus?
        ou te le detecte t il?

        a+
        2. Tchoupi51
          C'est antivir mon antivirus
          Là il les delete à chaque fois mais il revienne

          Ils se trouvent ici mais mon ordinateur ne trouve pas vonner.exe
          C:\DOCUME~1\PAULIN~1\LOCALS~1\TEMP\RARSFX0\VONNER.EXE
          2. Tchoupi51
            Nathalie, je voulais savoir si tu étais débarrassée de tes virus, parce que moi je n'y arrive vraiment pas.

            Merci
            1. balltrap34 Contributeur sécurité
              redemarre en mode sans echec
              assure toi de ceci
              Affiche tous les fichiers et dossiers :
              cliquer sur démarrer/panneau de configuration/option des dossiers/affichage
              Cocher afficher les dossiers cacher

              Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

              Décocher masquer les extensions dont le type est connu
              Puis fais «Ok» pour valider les changements.

              Et appliquer

              recherche et suppr le fichier
              C:\DOCUME~1\PAULIN~1\LOCALS~1\TEMP\RARSFX0\VONNER.EXE

              vde ta poubelle redemarre et scan de verif
              1. Tchoupi51
                SAlut,

                Ca ne marche toujours pas.

                Voici mon dernier scann avec Clean Up

                C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\Local Settings\Historique\History.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                'Typed URLs' (Internet Explorer) - removed from the registry.
                C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\LocalService\locals~1\tempor~1\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\LocalService\Cookies\index.dat currently in use. Will be deleted when Windows is restarted.
                C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat currently in use. Will be deleted when Windows is restarted.
                'Run MRU' list - removed from the registry.
                Paint Recent File List - removed from the registry.
                WordPad Recent File List - removed from the registry.
                Telnet's MRU list - removed from the registry.
                CleanUp! recovered 0 bytes of disk space from 0 files.
                CleanUp! finished on 05/21/05 19:08:45.

                Ainsi que celui avec Ad Aware

                Set : Unload recognized processes & modules during scan
                Set : Scan registry for all users instead of current user only
                Set : Always try to unload modules before deletion
                Set : Prior to deletion, allow unloading Explorer and IE if necessary
                Set : Let Windows remove files in use at next reboot
                Set : Delete quarantined objects after restoring
                Set : Include basic settings in log file
                Set : Include additional settings in log file
                Set : Include reference summary in log file
                Set : Include Alternate Datastream details in log file
                Set : Play sound at scan completion if scan locates critical objects

                21-05-2005 18:36:33 - Scan started. (Full System Scan)

                MRU List Object Recognized!
                Location: : C:\Documents and Settings\Pauline00\recent
                Description : list of recently opened documents

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\adobe\acrobat reader\5.0\avgeneral\crecentfiles
                Description : list of recently used files in adobe reader

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\kazaa\search
                Description : list of recent searches performed with sharman networks kazaa

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\automap\8.0\findmru
                Description : list of recently used find queries used in microsoft automap-based products

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\automap\8.0\recent file list
                Description : list of recently used files in microsoft automap-based products

                MRU List Object Recognized!
                Location: : software\microsoft\direct3d\mostrecentapplication
                Description : most recent application to use microsoft direct3d

                MRU List Object Recognized!
                Location: : software\microsoft\direct3d\mostrecentapplication
                Description : most recent application to use microsoft direct X

                MRU List Object Recognized!
                Location: : software\microsoft\directdraw\mostrecentapplication
                Description : most recent application to use microsoft directdraw

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\directinput\mostrecentapplication
                Description : most recent application to use microsoft directinput

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\directinput\mostrecentapplication
                Description : most recent application to use microsoft directinput

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\internet explorer
                Description : last download directory used in microsoft internet explorer

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\internet explorer\main
                Description : last save directory used in microsoft internet explorer

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\recentfilelist
                Description : list of recently used files in microsoft windows media player

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\recenturllist
                Description : list of recently used web addresses in microsoft windows media player

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\settings
                Description : last save as directory used in jasc paint shop pro

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\player\settings
                Description : last open directory used in jasc paint shop pro

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\mediaplayer\preferences
                Description : last playlist loaded in microsoft windows media player

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\microsoft management console\recent file list
                Description : list of recent snap-ins used in the microsoft management console

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\common\general
                Description : list of recently used symbols in microsoft office

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\excel\recent files
                Description : list of recent files used by microsoft excel

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recent file list
                Description : list of recent files used by microsoft powerpoint

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recent templates
                Description : list of recent templates used by microsoft powerpoint

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\office\10.0\powerpoint\recenttemplatelist
                Description : list of recent templates used by microsoft powerpoint

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\search assistant\acmru
                Description : list of recent search terms used with the search assistant

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\applets\regedit
                Description : last key accessed using the microsoft registry editor

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
                Description : list of recent programs opened

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
                Description : list of recently saved files, stored according to file extension

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows\currentversion\explorer\recentdocs
                Description : list of recent documents opened

                MRU List Object Recognized!
                Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
                Description : windows media sdk

                MRU List Object Recognized!
                Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
                Description : windows media sdk

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\microsoft\windows media\wmsdk\general
                Description : windows media sdk

                MRU List Object Recognized!
                Location: : S-1-5-21-2504082948-1368800587-127087339-1005\software\winrar\dialogedithistory\extrpath
                Description : winrar "extract-to" history

                Listing running processes
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                #:1 [smss.exe]
                FilePath : \SystemRoot\System32\
                ProcessID : 440
                ThreadCreationTime : 21-05-2005 17:15:28
                BasePriority : Normal

                #:2 [csrss.exe]
                FilePath : \??\C:\WINDOWS\system32\
                ProcessID : 492
                ThreadCreationTime : 21-05-2005 17:15:31
                BasePriority : Normal

                #:3 [winlogon.exe]
                FilePath : \??\C:\WINDOWS\system32\
                ProcessID : 516
                ThreadCreationTime : 21-05-2005 17:15:32
                BasePriority : High

                #:4 [services.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 560
                ThreadCreationTime : 21-05-2005 17:15:35
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Système d'exploitation Microsoft® Windows®
                CompanyName : Microsoft Corporation
                FileDescription : Applications Services et Contrôleur
                InternalName : services.exe
                LegalCopyright : © Microsoft Corporation. Tous droits réservés.
                OriginalFilename : services.exe

                #:5 [lsass.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 572
                ThreadCreationTime : 21-05-2005 17:15:35
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : LSA Shell (Export Version)
                InternalName : lsass.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : lsass.exe

                #:6 [svchost.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 728
                ThreadCreationTime : 21-05-2005 17:15:39
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Generic Host Process for Win32 Services
                InternalName : svchost.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : svchost.exe

                #:7 [svchost.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 780
                ThreadCreationTime : 21-05-2005 17:15:40
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Generic Host Process for Win32 Services
                InternalName : svchost.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : svchost.exe

                #:8 [svchost.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 844
                ThreadCreationTime : 21-05-2005 17:15:41
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Generic Host Process for Win32 Services
                InternalName : svchost.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : svchost.exe

                #:9 [svchost.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 968
                ThreadCreationTime : 21-05-2005 17:15:43
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Generic Host Process for Win32 Services
                InternalName : svchost.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : svchost.exe

                #:10 [svchost.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 1032
                ThreadCreationTime : 21-05-2005 17:15:44
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Generic Host Process for Win32 Services
                InternalName : svchost.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : svchost.exe

                #:11 [spoolsv.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 1360
                ThreadCreationTime : 21-05-2005 17:15:50
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Spooler SubSystem App
                InternalName : spoolsv.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : spoolsv.exe

                #:12 [avguard.exe]
                FilePath : C:\Program Files\AVPersonal\
                ProcessID : 1656
                ThreadCreationTime : 21-05-2005 17:15:57
                BasePriority : Normal

                #:13 [avwupsrv.exe]
                FilePath : C:\Program Files\AVPersonal\
                ProcessID : 1724
                ThreadCreationTime : 21-05-2005 17:15:58
                BasePriority : Normal

                #:14 [ccevtmgr.exe]
                FilePath : C:\Program Files\Fichiers communs\Symantec Shared\
                ProcessID : 1768
                ThreadCreationTime : 21-05-2005 17:15:59
                BasePriority : Normal
                FileVersion : 1.03.4
                ProductVersion : 1.03.4
                ProductName : Event Manager
                CompanyName : Symantec Corporation
                FileDescription : Event Manager Service
                InternalName : ccEvtMgr
                LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
                OriginalFilename : ccEvtMgr.exe

                #:15 [mdm.exe]
                FilePath : C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\
                ProcessID : 1920
                ThreadCreationTime : 21-05-2005 17:16:03
                BasePriority : Normal
                FileVersion : 7.00.9064.9150
                ProductVersion : 7.00.9064.9150
                ProductName : Microsoft Development Environment
                CompanyName : Microsoft Corporation
                FileDescription : Machine Debug Manager
                InternalName : mdm.exe
                LegalCopyright : Copyright (C) Microsoft Corp. 1997-2000
                OriginalFilename : mdm.exe

                #:16 [navapsvc.exe]
                FilePath : C:\Program Files\Norton AntiVirus\
                ProcessID : 2016
                ThreadCreationTime : 21-05-2005 17:16:06
                BasePriority : Normal
                FileVersion : 9.05.1015
                ProductVersion : 9.05.1015
                ProductName : Norton AntiVirus
                CompanyName : Symantec Corporation
                FileDescription : Norton AntiVirus Auto-Protect Service
                InternalName : NAVAPSVC
                LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
                OriginalFilename : NAVAPSVC.EXE

                #:17 [alg.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 2728
                ThreadCreationTime : 21-05-2005 17:18:04
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Application Layer Gateway Service
                InternalName : ALG.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : ALG.exe

                #:18 [wscntfy.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 3420
                ThreadCreationTime : 21-05-2005 17:32:28
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : Windows Security Center Notification App
                InternalName : wscntfy.exe
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : wscntfy.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:19 [explorer.exe]
                FilePath : C:\WINDOWS\
                ProcessID : 3092
                ThreadCreationTime : 21-05-2005 17:32:28
                BasePriority : Normal
                FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 6.00.2900.2180
                ProductName : Système d'exploitation Microsoft® Windows®
                CompanyName : Microsoft Corporation
                FileDescription : Explorateur Windows
                InternalName : explorer
                LegalCopyright : © Microsoft Corporation. Tous droits réservés.
                OriginalFilename : EXPLORER.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:20 [igfxtray.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 3716
                ThreadCreationTime : 21-05-2005 17:32:29
                BasePriority : Normal
                FileVersion : 3,0,0,2104
                ProductVersion : 7,0,0,2104
                ProductName : Intel(R) Common User Interface
                CompanyName : Intel Corporation
                FileDescription : igfxTray Module
                InternalName : IGFXTRAY
                LegalCopyright : Copyright 1999-2003, Intel Corporation
                OriginalFilename : IGFXTRAY.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:21 [hkcmd.exe]
                FilePath : C:\WINDOWS\System32\
                ProcessID : 3944
                ThreadCreationTime : 21-05-2005 17:32:29
                BasePriority : Normal
                FileVersion : 3,0,0,2104
                ProductVersion : 7,0,0,2104
                ProductName : Intel(R) Common User Interface
                CompanyName : Intel Corporation
                FileDescription : hkcmd Module
                InternalName : HKCMD
                LegalCopyright : Copyright 1999-2003, Intel Corporation
                OriginalFilename : HKCMD.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:22 [syntplpr.exe]
                FilePath : C:\Program Files\Synaptics\SynTP\
                ProcessID : 3824
                ThreadCreationTime : 21-05-2005 17:32:29
                BasePriority : Normal
                FileVersion : 7.5.5 24Apr03
                ProductVersion : 7.5.5 24Apr03
                ProductName : Progressive Touch
                CompanyName : Synaptics, Inc.
                FileDescription : TouchPad Driver Helper Application
                InternalName : SynTPLpr
                LegalCopyright : Copyright (C) Synaptics, Inc. 1996-2003
                OriginalFilename : SynTPLpr.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"Process terminated successfully

                #:23 [syntpenh.exe]
                FilePath : C:\Program Files\Synaptics\SynTP\
                ProcessID : 980
                ThreadCreationTime : 21-05-2005 17:32:29
                BasePriority : Normal
                FileVersion : 7.5.5 24Apr03
                ProductVersion : 7.5.5 24Apr03
                ProductName : Progressive Touch
                CompanyName : Synaptics, Inc.
                FileDescription : Synaptics TouchPad Enhancements
                InternalName : Scrolleroo
                LegalCopyright : Copyright (C) Synaptics, Inc. 1996-2003
                OriginalFilename : SynTPEnh.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"Process terminated successfully

                #:24 [launchap.exe]
                FilePath : C:\Progra~1\Launch Manager\
                ProcessID : 2540
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1, 0, 0, 3
                ProductVersion : 1, 0, 0, 3
                ProductName : LaunchAp Application
                FileDescription : LaunchAp MFC Application
                InternalName : LaunchAp
                LegalCopyright : Copyright (C) 2001
                OriginalFilename : LaunchAp.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Progra~1\Launch Manager\LaunchAp.exe"Process terminated successfully

                #:25 [powerkey.exe]
                FilePath : C:\Progra~1\Launch Manager\
                ProcessID : 976
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1, 4, 4, 0
                ProductVersion : 1, 4, 4, 0
                FileDescription : Powerkey
                InternalName : Powerkey
                LegalCopyright : Copyright © 2001
                OriginalFilename : Powerkey.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Progra~1\Launch Manager\PowerKey.exe"Process terminated successfully

                #:26 [hotkeyapp.exe]
                FilePath : C:\Progra~1\Launch Manager\
                ProcessID : 788
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1, 0, 4, 7
                ProductVersion : 1, 0, 4, 7
                ProductName : Wistron HotkeyApp
                CompanyName : Wistron
                FileDescription : HotkeyApp
                InternalName : HotkeyApp
                LegalCopyright : Copyright c 2002
                OriginalFilename : HotkeyApp.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Progra~1\Launch Manager\HotkeyApp.exe"Process terminated successfully

                #:27 [ctrlvol.exe]
                FilePath : C:\Progra~1\Launch Manager\
                ProcessID : 2304
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1, 0, 0, 2
                ProductVersion : 1, 0, 0, 2
                ProductName : Wistron ctrlvol
                CompanyName : Wistron
                FileDescription : ctrlvol
                InternalName : ctrlvol
                LegalCopyright : Copyright c 2003
                OriginalFilename : ctrlvol.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Progra~1\Launch Manager\CtrlVol.exe"Process terminated successfully

                #:28 [wbutton.exe]
                FilePath : C:\Progra~1\Launch Manager\
                ProcessID : 2400
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1, 0, 2, 4
                ProductVersion : 1, 0, 2, 4
                ProductName : WButton Application
                FileDescription : WButton MFC Application
                InternalName : WButton
                LegalCopyright : Copyright (C) 2001
                OriginalFilename : WButton.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Progra~1\Launch Manager\Wbutton.exe"Process terminated successfully

                #:29 [almxptray.exe]
                FilePath : C:\Program Files\Acer\Notebook Manager\
                ProcessID : 2912
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 2.0.10.3
                ProductVersion : 2.0.10
                CompanyName : Acer
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\Acer\Notebook Manager\almxptray.exe"Process terminated successfully

                #:30 [agrsmmsg.exe]
                FilePath : C:\WINDOWS\
                ProcessID : 1484
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 2.1.25 2.1.25 02/14/2003 11:58:58
                ProductVersion : 2.1.25 2.1.25 02/14/2003 11:58:58
                ProductName : Agere SoftModem Messaging Applet
                CompanyName : Agere Systems
                FileDescription : SoftModem Messaging Applet
                InternalName : smdmstat.exe
                LegalCopyright : Copyright © Agere Systems 1998-2000
                OriginalFilename : smdmstat.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\WINDOWS\AGRSMMSG.exe"Process terminated successfully

                #:31 [ltmoh.exe]
                FilePath : C:\Program Files\ltmoh\
                ProcessID : 2612
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1.68
                ProductVersion : 1.68
                ProductName : LtMoh Application
                CompanyName : Agere Systems
                FileDescription : LtMoh MFC Application
                InternalName : LtMoh
                LegalCopyright : Agere Copyright © 2001-2002
                LegalTrademarks : LT
                OriginalFilename : LtMoh.EXE
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\ltmoh\Ltmoh.exe"Process terminated successfully

                #:32 [ccapp.exe]
                FilePath : C:\Program Files\Fichiers communs\Symantec Shared\
                ProcessID : 2208
                ThreadCreationTime : 21-05-2005 17:32:30
                BasePriority : Normal
                FileVersion : 1.08.01
                ProductVersion : 1.08.01
                ProductName : Common Client
                CompanyName : Symantec Corporation
                FileDescription : Common Client CC App
                InternalName : ccApp
                LegalCopyright : Copyright (c) 2000-2002 Symantec Corporation. All rights reserved.
                OriginalFilename : ccApp.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:33 [hpztsb10.exe]
                FilePath : C:\WINDOWS\System32\spool\drivers\w32x86\3\
                ProcessID : 4004
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal
                FileVersion : 2.323.0.0
                ProductVersion : 2.323.0.0
                ProductName : HP DeskJet
                CompanyName : HP
                LegalCopyright : Copyright (c) Hewlett-Packard Company 1999-2004
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe"Process terminated successfully

                #:34 [hpwuschd2.exe]
                FilePath : C:\Program Files\Hewlett-Packard\HP Software Update\
                ProcessID : 2908
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal
                FileVersion : 3, 0, 38, 1
                ProductVersion : 3, 0, 38, 1
                ProductName : HP Software Update Application
                CompanyName : Hewlett-Packard Company
                FileDescription : hpwuSchd
                InternalName : hpwuSchd
                LegalCopyright : Copyright © 2003
                OriginalFilename : hpwuSchd.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"Process terminated successfully

                #:35 [hpcmpmgr.exe]
                FilePath : C:\Program Files\HP\hpcoretech\
                ProcessID : 1284
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal
                FileVersion : 2.1.1.0
                ProductVersion : 2.1.4
                ProductName : hp coretech (COmponent REuse TECHnology)
                CompanyName : Hewlett-Packard Company
                FileDescription : HP Framework Component Manager Service
                InternalName : HPComponentManagerService module
                LegalCopyright : Copyright (C) Hewlett-Packard. 2002-2003
                OriginalFilename : HpCmpMgr.exe
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                #:36 [avgnt.exe]
                FilePath : C:\Program Files\AVPersonal\
                ProcessID : 2496
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal

                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\AVPersonal\AVGNT.EXE"Process terminated successfully

                #:37 [msnmsgrs.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 4076
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal

                #:38 [mediaacck.exe]
                FilePath : C:\Program Files\Media Access\
                ProcessID : 3808
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal

                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                "C:\Program Files\Media Access\MediaAccK.exe"Process terminated successfully

                #:39 [ap9h4qmo.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 2308
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\ap9h4qmo.exe)

                SahAgent Object Recognized!
                Type : Process
                Data : ap9h4qmo.exe
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4

                "C:\WINDOWS\system32\ap9h4qmo.exe"Process terminated successfully
                "C:\WINDOWS\system32\ap9h4qmo.exe"Process terminated successfully

                #:40 [mediaaccess.exe]
                FilePath : C:\Program Files\Media Access\
                ProcessID : 2720
                ThreadCreationTime : 21-05-2005 17:32:31
                BasePriority : Normal
                FileVersion : 1, 0, 0, 1
                ProductVersion : 1, 0, 0, 1
                ProductName : LoaderX Module
                FileDescription : LoaderX Module
                InternalName : LoaderX
                LegalCopyright : Copyright 2005
                OriginalFilename : LoaderX.EXE

                WindUpdates Object Recognized!
                Type : Process
                Data : MediaAccess.exe
                Category : Malware
                Comment : (CSI MATCH)
                Object : C:\Program Files\Media Access\
                FileVersion : 1, 0, 0, 1
                ProductVersion : 1, 0, 0, 1
                ProductName : LoaderX Module
                FileDescription : LoaderX Module
                InternalName : LoaderX
                LegalCopyright : Copyright 2005
                OriginalFilename : LoaderX.EXE

                Warning! WindUpdates Object found in memory(C:\Program Files\Media Access\MediaAccess.exe)

                "C:\Program Files\Media Access\MediaAccess.exe"Process terminated successfully
                Warning! "C:\Program Files\Media Access\MediaAccess.exe"Process could not be terminated!

                #:41 [ctfmon.exe]
                FilePath : C:\WINDOWS\system32\
                ProcessID : 356
                ThreadCreationTime : 21-05-2005 17:32:32
                BasePriority : Normal
                FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
                ProductVersion : 5.1.2600.2180
                ProductName : Microsoft® Windows® Operating System
                CompanyName : Microsoft Corporation
                FileDescription : CTF Loader
                InternalName : CTFMON
                LegalCopyright : © Microsoft Corporation. All rights reserved.
                OriginalFilename : CTFMON.EXE

                #:42 [spybotsd.exe]
                FilePath : C:\Program Files\Spybot - Search & Destroy\
                ProcessID : 2252
                ThreadCreationTime : 21-05-2005 17:35:24
                BasePriority : Normal
                FileVersion : 1, 3, 0, 12
                ProductVersion : 1, 3, 0, 12
                ProductName : SpyBot-S&D
                CompanyName : Safer Networking Limited
                FileDescription : Spybot - Search & Destroy
                InternalName : SpybotSD
                LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
                LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
                OriginalFilename : SpyBotSD.exe
                Comments : Software zum Entfernen von Spyware und ähnlichen Bedrohungen.

                #:43 [ad-aware.exe]
                FilePath : C:\Documents and Settings\Pauline00\Mes documents\Mes fichiers reçus\
                ProcessID : 224
                ThreadCreationTime : 21-05-2005 17:36:20
                BasePriority : Normal
                FileVersion : 6.2.0.206
                ProductVersion : VI.Second Edition
                ProductName : Lavasoft Ad-Aware SE
                CompanyName : Lavasoft Sweden
                FileDescription : Ad-Aware SE Core application
                InternalName : Ad-Aware.exe
                LegalCopyright : Copyright © Lavasoft Sweden
                OriginalFilename : Ad-Aware.exe
                Comments : All Rights Reserved
                Warning! SahAgent Object found in memory(C:\WINDOWS\system32\qh4mkbv9.dll)

                SahAgent Object Recognized!
                Type : Process
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                Memory scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 2
                Objects found so far: 55

                Started registry scan
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                SahAgent Object Recognized!
                Type : RegKey
                Data :
                Category : Data Miner
                Comment :
                Rootkey : HKEY_LOCAL_MACHINE
                Object : software\winsock2\layered provider sample

                Registry scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 1
                Objects found so far: 56

                Started deep registry scan
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                SahAgent Object Recognized!
                Type : RegValue
                Data :
                Category : Data Miner
                Comment : "ap9h4qmo"
                Rootkey : HKEY_LOCAL_MACHINE
                Object : Software\Microsoft\Windows\CurrentVersion\Run
                Value : ap9h4qmo

                SahAgent Object Recognized!
                Type : File
                Data : ap9h4qmo.exe
                Category : Data Miner
                Comment :
                Object : c:\windows\system32\
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4

                Deep registry scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 1
                Objects found so far: 58

                Started tracking cookie scan
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                Tracking cookie scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 0
                Objects found so far: 58

                Deep scanning and examining files (C:)
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                WindUpdates Object Recognized!
                Type : File
                Data : ide21201.vxd
                Category : Malware
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : q17i9a4j.exe
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 3, 0, 0, 3
                ProductVersion : 3, 0, 0, 3

                SahAgent Object Recognized!
                Type : File
                Data : qh4mkbv9.dll
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                SahAgent Object Recognized!
                Type : File
                Data : a95kfrhe.exe
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4

                SahAgent Object Recognized!
                Type : File
                Data : A0003780.dll
                Category : Data Miner
                Comment :
                Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
                FileVersion : 4, 0, 0, 2
                ProductVersion : 4, 0, 0, 2

                SahAgent Object Recognized!
                Type : File
                Data : A0003782.exe
                Category : Data Miner
                Comment :
                Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
                FileVersion : 3, 0, 0, 3
                ProductVersion : 3, 0, 0, 3

                SahAgent Object Recognized!
                Type : File
                Data : A0003783.EXE
                Category : Data Miner
                Comment :
                Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4

                SahAgent Object Recognized!
                Type : File
                Data : A0003784.exe
                Category : Data Miner
                Comment :
                Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\
                FileVersion : 4, 0, 0, 4
                ProductVersion : 4, 0, 0, 4

                WindUpdates Object Recognized!
                Type : File
                Data : A0003787.vxd
                Category : Malware
                Comment :
                Object : C:\System Volume Information\_restore{C4B7AD79-6A73-46E1-A68A-83199C24949F}\RP23\

                Disk scan result for C:\
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 0
                Objects found so far: 67

                Deep scanning and examining files (D:)
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                Disk scan result for D:\
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 0
                Objects found so far: 67

                Scanning Hosts file...
                Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                Hosts file scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                1 entries scanned.
                New Critical Objects:0
                Objects found so far: 67

                Performing conditional scans..
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

                SahAgent Object Recognized!
                Type : File
                Data : ap2nqrd4.dat
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : ap9h4qmo.ini
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : baur5s9q.dat
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : bqrufs5f.dat
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : q10pvbrv.dat
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                SahAgent Object Recognized!
                Type : File
                Data : ritsacnk.dat
                Category : Data Miner
                Comment :
                Object : C:\WINDOWS\system32\

                WindUpdates Object Recognized!
                Type : RegKey
                Data :
                Category : Malware
                Comment :
                Rootkey : HKEY_LOCAL_MACHINE
                Object : software\microsoft\windows\currentversion\uninstall\media access

                WindUpdates Object Recognized!
                Type : RegValue
                Data :
                Category : Malware
                Comment :
                Rootkey : HKEY_LOCAL_MACHINE
                Object : software\microsoft\windows\currentversion\uninstall\media access
                Value : UninstallString

                WindUpdates Object Recognized!
                Type : RegValue
                Data :
                Category : Malware
                Comment :
                Rootkey : HKEY_LOCAL_MACHINE
                Object : software\microsoft\windows\currentversion\uninstall\media access
                Value : DisplayName

                WindUpdates Object Recognized!
                Type : RegValue
                Data :
                Category : Malware
                Comment :
                Rootkey : HKEY_LOCAL_MACHINE
                Object : software\microsoft\windows\currentversion\run
                Value : Media Access

                WindUpdates Object Recognized!
                Type : Folder
                Category : Malware
                Comment :
                Object : C:\Program Files\Media Access

                WindUpdates Object Recognized!
                Type : File
                Data : MediaAccC.dll
                Category : Malware
                Comment :
                Object : C:\Program Files\media access\

                WindUpdates Object Recognized!
                Type : File
                Data : MediaAccK.exe
                Category : Malware
                Comment :
                Object : C:\Program Files\media access\

                WindUpdates Object Recognized!
                Type : File
                Data : Info.txt
                Category : Malware
                Comment :
                Object : C:\Program Files\media access\

                WindUpdates Object Recognized!
                Type : File
                Data : MediaAccess.exe
                Category : Malware
                Comment :
                Object : C:\Program Files\media access\
                FileVersion : 1, 0, 0, 1
                ProductVersion : 1, 0, 0, 1
                ProductName : LoaderX Module
                FileDescription : LoaderX Module
                InternalName : LoaderX
                LegalCopyright : Copyright 2005
                OriginalFilename : LoaderX.EXE

                Conditional scan result:
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                New Critical Objects: 15
                Objects found so far: 82

                18:57:13 Scan Complete

                Summary of this scan
                »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
                Total scanning time:00:20:39.933
                Objects scanned:93511
                Objects identified:29
                Objects ignored:0
                New Critical Objects:29

                J'aimerais vraiment arriver à supprimer ce truc C:\Documents and Settings\Pauline00\Local Settings\Temporary Internet Files\Content.IE5\index

                ainsi que tous les autres d'ailleurs

                Merci d'avance
                1. balltrap34 Contributeur sécurité
                  clen up a fait son travail et il te dit qu il les suppr au redemarrage
                  Faite scan en ligne et coller le rapport ici sur le post
                  utiliser l'antivirus en ligne suivant :
                  http://www.ravantivirus.com/scan/
                  Cliquer sur "To continue without subscribing click here" et attendre quelques minutes.

                  Lorsque "Ready" est affiché dans "status", cocher la case "Autoclean" puis cliquer sur "Scan my PC"
                  A la fin de l'analyse, copier/coller le rapport ici.
                  1. braïce
                    bonjours a toi natalie il parai evident que ton pc est dans un vilaine etat.. il me parait difficil de tout supprimé et de repartir comme si ne rien etai donc en vu de ta liste enorme de fichier infecté le mieu a faire est de formater ( supprimé la totalité du disque dur) tu n'aura qu'a ré-instalé windows si tu a tjr le cd....
                    cette solution te virera a coup sur la totalité des virus spyware trojan ver bref tout tout tout

                    pour sauvegardé tes document fai un scan sur "mes documents" et si il n'y a rien sauvegarde les sur cd ensuite tu redemare ton pc en mettan le cd windows dedan tu n'a plus qu'a suivre les instruction

                    je repasserai voir si tu ten est tiré ++
                    1. bernie61
                      salut
                      un peu de sérieux braïce...
                      1. nathalie son message date de 2semaines
                      2. Tchoupi qui avait le même pbm a résolu son pbm il y a 1 semaine
                      3. pourquoi conseiller une réinstallation si les logiciels de nettoyage existent: SpybotS&D, AdAware, SpySwepper et en dernier recours HijackThis ..

                      4. quand on conseille une réinstallation, il faut tout préciser: installer Firewal et antivirus avant connection de mise à jour de WIN...
                      a+

                  Discussions similaires

                  Trojan impossible à supprimer!
                  Gridouu

                  12 réponses
                  Aide pour un virus
                  cerise92700

                  41 réponses
                  Comment supprimer le virus Trojan
                  vitsou

                  18 réponses
                  Installer et utiliser imprimante sans WIFI
                  Kakou

                  10 réponses