[aide] pour eradication de virus
Résolu
la_paille
Messages postés
24
Date d'inscription
Statut
Membre
Dernière intervention
-
Utilisateur anonyme -
Utilisateur anonyme -
Bonjour,
alors voila j ai de gros problemes avec mon ordinateur et mon antivirus (antivir) qui detecte des vers de partout. J ai essayé de me servir de patch mais cela n a pas tout résolu... Si quelqu un pouvait m aider a m en sortir... J ai vu sur d autres discussions qu Hijack était utile donc voila ce qu il en ressort.
Merci d avance,
Logfile of HijackThis v1.99.1
Scan saved at 08:12:41, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Documents and Settings\Moi\Mes documents\FixMytob.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\PROGRA~1\CleanUp!\cleanup.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [WINTASK] taskgmr.exe
O4 - HKLM\..\RunServices: [WINTASK] taskgmr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [WINTASK] taskgmr.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: CGCJBGF0 - {389C0A4B-21FA-6624-23B2-09DA04203382} - C:\WINDOWS\System32\Dieeijeb.dll (file missing)
O21 - SSODL: mtkle - {84E673EF-0FF6-431B-748C-FB1627EC8440} - C:\WINDOWS\System32\ffhna32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
alors voila j ai de gros problemes avec mon ordinateur et mon antivirus (antivir) qui detecte des vers de partout. J ai essayé de me servir de patch mais cela n a pas tout résolu... Si quelqu un pouvait m aider a m en sortir... J ai vu sur d autres discussions qu Hijack était utile donc voila ce qu il en ressort.
Merci d avance,
Logfile of HijackThis v1.99.1
Scan saved at 08:12:41, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Documents and Settings\Moi\Mes documents\FixMytob.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\PROGRA~1\CleanUp!\cleanup.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [WINTASK] taskgmr.exe
O4 - HKLM\..\RunServices: [WINTASK] taskgmr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [WINTASK] taskgmr.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: CGCJBGF0 - {389C0A4B-21FA-6624-23B2-09DA04203382} - C:\WINDOWS\System32\Dieeijeb.dll (file missing)
O21 - SSODL: mtkle - {84E673EF-0FF6-431B-748C-FB1627EC8440} - C:\WINDOWS\System32\ffhna32.dll (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
A voir également:
- [aide] pour eradication de virus
- Virus mcafee - Accueil - Piratage
- Virus facebook demande d'amis - Accueil - Facebook
- Undisclosed-recipients virus - Guide
- Panda anti virus gratuit - Télécharger - Antivirus & Antimalwares
- Impossible de terminer l'opération car le fichier contient un virus - Forum Virus
25 réponses
salut
tu peux faire ceci avant?
demarer<poste de travail < c < program files < av personal < logfiles < NTGRDRT.LOG <---copie/colle sur le forum tout ce qu il y a a l interieur stp
a+
tu peux faire ceci avant?
demarer<poste de travail < c < program files < av personal < logfiles < NTGRDRT.LOG <---copie/colle sur le forum tout ce qu il y a a l interieur stp
a+
Bonjour,
Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:
1/
Spybot S&D 1.4 <<nouvelle version.
http://www.safer-networking.org/fr/index.html
Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
2/
Ad-Aware SE 1.06 <<nouvelle version.
http://www.lavasoftusa.com/software/adaware/
-Une aide:
http://www.tutopat.com/viewtopic.php?t=1191
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf
----------------------------------------------------------------------------
¤Désactive ta restauration système (uniquement si tu es sous XP):
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu coches la case « désactiver la restauration » et applique.
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
¤Vide tes fichiers temps et temporary internet file:
:: Supprimer les fichiers temporaires ::
vider tout le contenu de ces dossiers.
Passe clean up !
----------------------------------------------------------------------------
¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :
O4 - HKLM\..\Run: [WINTASK] taskgmr.exe
O4 - HKLM\..\RunServices: [WINTASK] taskgmr.exe
O4 - HKCU\..\Run: [WINTASK] taskgmr.exe
O21 - SSODL: CGCJBGF0 - {389C0A4B-21FA-6624-23B2-09DA04203382} - C:\WINDOWS\System32\Dieeijeb.dll (file missing)
O21 - SSODL: mtkle - {84E673EF-0FF6-431B-748C-FB1627EC8440} - C:\WINDOWS\System32\ffhna32.dll (file missing)
----------------------------------------------------------------------------
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers (si présents).
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
----------------------------------------------------------------------------
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal,
Lance ce scan en ligne:
http://www.bitdefender.com/scan/licence.php
Copie/colle le rapport
relance Hijackthis et copie/colle un nouveau rapport sur le forum.
Précise tes soucis s’il en reste....
Tiens-moi au courant
A+
Méthode à suivre dans l'ordre...
----------------------------------------------------------------------------
¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:
1/
Spybot S&D 1.4 <<nouvelle version.
http://www.safer-networking.org/fr/index.html
Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm
2/
Ad-Aware SE 1.06 <<nouvelle version.
http://www.lavasoftusa.com/software/adaware/
-Une aide:
http://www.tutopat.com/viewtopic.php?t=1191
- installe le patch français, tu pourras le trouver ici:
http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
http://pageperso.aol.fr/balltrap34/adawrevid.asf
----------------------------------------------------------------------------
¤Désactive ta restauration système (uniquement si tu es sous XP):
Clic droit sur poste de travail puis,
propriété, tu cliques sur onglet restauration système
tu coches la case « désactiver la restauration » et applique.
----------------------------------------------------------------------------
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
¤Vide tes fichiers temps et temporary internet file:
:: Supprimer les fichiers temporaires ::
vider tout le contenu de ces dossiers.
Passe clean up !
----------------------------------------------------------------------------
¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :
O4 - HKLM\..\Run: [WINTASK] taskgmr.exe
O4 - HKLM\..\RunServices: [WINTASK] taskgmr.exe
O4 - HKCU\..\Run: [WINTASK] taskgmr.exe
O21 - SSODL: CGCJBGF0 - {389C0A4B-21FA-6624-23B2-09DA04203382} - C:\WINDOWS\System32\Dieeijeb.dll (file missing)
O21 - SSODL: mtkle - {84E673EF-0FF6-431B-748C-FB1627EC8440} - C:\WINDOWS\System32\ffhna32.dll (file missing)
----------------------------------------------------------------------------
¤Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
¤Recherche et supprime ceci:
attention seulement les fichiers (si présents).
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
----------------------------------------------------------------------------
¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
----------------------------------------------------------------------------
¤ Vide ta Corbeille.
----------------------------------------------------------------------------
¤ Redémarre en mode normal,
Lance ce scan en ligne:
http://www.bitdefender.com/scan/licence.php
Copie/colle le rapport
relance Hijackthis et copie/colle un nouveau rapport sur le forum.
Précise tes soucis s’il en reste....
Tiens-moi au courant
A+
toujours des alertes d antivir ...bitdefender est en trian de s executer...
Logfile of HijackThis v1.99.1
Scan saved at 10:07:14, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
______________________________________________________
02/11/2005,09:37:52 [INIT] The AVGuard Service is starting.
02/11/2005,09:37:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,09:38:02 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,09:38:02 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa027c.
02/11/2005,09:38:16 [INFO] Start Filter Device.
02/11/2005,09:38:16 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.0.127
02/11/2005,09:38:16 AVGuard has been started successfully!
02/11/2005,09:50:35 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
02/11/2005,09:50:50 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,09:55:01 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[2]
02/11/2005,09:55:09 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[3]
02/11/2005,09:55:11 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[5]
02/11/2005,09:55:12 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[6]
02/11/2005,09:55:14 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[7]
02/11/2005,09:55:15 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[8]
02/11/2005,09:55:15 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[9]
02/11/2005,09:55:17 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[10]
02/11/2005,09:55:18 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MTX8V9OB\XXXXXXXXX[3]
02/11/2005,09:59:21 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
02/11/2005,09:59:28 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
02/11/2005,09:59:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
02/11/2005,09:59:33 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,09:59:35 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,10:00:57 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,10:01:05 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
Logfile of HijackThis v1.99.1
Scan saved at 10:07:14, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
______________________________________________________
02/11/2005,09:37:52 [INIT] The AVGuard Service is starting.
02/11/2005,09:37:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,09:38:02 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,09:38:02 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa027c.
02/11/2005,09:38:16 [INFO] Start Filter Device.
02/11/2005,09:38:16 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.0.127
02/11/2005,09:38:16 AVGuard has been started successfully!
02/11/2005,09:50:35 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
02/11/2005,09:50:50 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,09:55:01 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[2]
02/11/2005,09:55:09 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[3]
02/11/2005,09:55:11 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[5]
02/11/2005,09:55:12 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[6]
02/11/2005,09:55:14 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[7]
02/11/2005,09:55:15 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[8]
02/11/2005,09:55:15 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[9]
02/11/2005,09:55:17 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[10]
02/11/2005,09:55:18 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MTX8V9OB\XXXXXXXXX[3]
02/11/2005,09:59:21 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
02/11/2005,09:59:28 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
02/11/2005,09:59:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
02/11/2005,09:59:33 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,09:59:35 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,10:00:57 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,10:01:05 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
re
utilise ceci comme sur la video
Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe
-aide en image:(merci à Balltrap34).
http://pageperso.aol.fr/balltrap34/democleanup.htm
puis
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
et supprime:
C:\WINDOWS\SYSTEM32\NETHELL.EXE
C:\WINDOWS\SYSTEM32\BINGOO.EXE
a+
utilise ceci comme sur la video
Clean Up 40:
http://pageperso.aol.fr/balltrap34/CleanUp40.exe
-aide en image:(merci à Balltrap34).
http://pageperso.aol.fr/balltrap34/democleanup.htm
puis
¤Affiche tous les fichiers et dossiers :
Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage
Coche « afficher les fichiers et dossiers cachés »
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche « masquer les extensions dont le type est connu »
Puis fais «Ok» pour valider les changements.
Et appliquer !
----------------------------------------------------------------------------
et supprime:
C:\WINDOWS\SYSTEM32\NETHELL.EXE
C:\WINDOWS\SYSTEM32\BINGOO.EXE
a+
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
merci de ton aide régis, j ai fait tout ce que tu m avais dit. J ai redémarré apres avoir vider la corbeille. j espere que cela sera suffisant.
une derniere petite question: antivir est il un antivirus valable selon toi? Dois je decocher la desactivation de rstauration du systeme?
j execute antivir pour voir s il trouve encore qqch.
voila le dernier hijack
Logfile of HijackThis v1.99.1
Scan saved at 11:04:39, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
encore merci!
une derniere petite question: antivir est il un antivirus valable selon toi? Dois je decocher la desactivation de rstauration du systeme?
j execute antivir pour voir s il trouve encore qqch.
voila le dernier hijack
Logfile of HijackThis v1.99.1
Scan saved at 11:04:39, on 02/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.203.15.25:808;gopher=10.203.15.25:808;http=10.203.15.25:808;https=10.203.15.25:808;socks=10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
encore merci!
salut
la restauration systeme, reactive la quand tu n auras plus de soucis (de mme pour les fichiers caches, recaches les quand tu n auras plus de soucis)
**
Pour antivir, si cela te rassure, c est l antivirus dont je dispose ;-)
Tu devrais peut etre mieux te proteger grace a un pare feu, persollement j ai zone alarm
- Un firewall
http://www.inoculer.com/firewall5.php3
http://www.firewall-net.com/
http://www.commentcamarche.net/protect/firewall.php3
Mais selon moi, antivir est un excellent antivirus, bien sur ne pas oublié de le mettre regulierement a jour ! C etait l un des meilleurs antivirus sur le marche il y a quelques mois, a l heure actuel, avast semble etre tres recommandable.ceci dit, je te conseilles de le garder (et en plus je le connais bien donc plus facile pour t aider lol)
a+
la restauration systeme, reactive la quand tu n auras plus de soucis (de mme pour les fichiers caches, recaches les quand tu n auras plus de soucis)
**
Pour antivir, si cela te rassure, c est l antivirus dont je dispose ;-)
Tu devrais peut etre mieux te proteger grace a un pare feu, persollement j ai zone alarm
- Un firewall
http://www.inoculer.com/firewall5.php3
http://www.firewall-net.com/
http://www.commentcamarche.net/protect/firewall.php3
Mais selon moi, antivir est un excellent antivirus, bien sur ne pas oublié de le mettre regulierement a jour ! C etait l un des meilleurs antivirus sur le marche il y a quelques mois, a l heure actuel, avast semble etre tres recommandable.ceci dit, je te conseilles de le garder (et en plus je le connais bien donc plus facile pour t aider lol)
a+
encore une fois merci !
antivir a trouvé encore des virus. je t envoie le rapport.
Creation date of the report file: mercredi 2 novembre 2005 11:11
AntiVir®/XP (2000 + NT) PersonalEdition Classic
Build 1111 of 18.10.2005
Mainprogram 6.32.00.50 of 13.10.2005
VDF file 6.32.11.14 (0) of 01.11.2005
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 239807 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149991-WURGE-0001
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
Email ___________________________________________
Platform: Windows NT Workstation
Windows version: 5.1 Build 2600 (Service Pack 1)
Username: Moi
Processor: Pentium
Working memory: 260592 KB free
Version information:
AVWIN.DLL : 6.32.00.50 561192 13.10.2005 16:32:14
AVEWIN32.DLL : 6.32.0.57 954880 01.11.2005 14:58:32
AVGNT.EXE : 6.32.00.02 180327 14.10.2005 12:32:02
AVGUARD.EXE : 6.32.00.12 208424 17.10.2005 08:35:12
GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 11:24:10
AVGCMSG.DLL : 6.32.00.01 295029 13.10.2005 16:32:14
AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 08:07:16
AVPACK32.DLL : 6.32.00.02 319528 18.10.2005 11:57:30
AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 18:10:20
AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 18:10:22
AVSched32.EXE : 6.32.00.01 110632 20.09.2005 14:16:24
AVSched32.DLL : 6.30.00.00 122880 01.02.2005 11:24:10
AVREG.DLL : 6.31.00.05 41000 07.09.2005 16:34:50
AVRep.DLL : 6.32.00.120 1454120 01.11.2005 14:58:44
INETUPD.EXE : 6.32.00.52 262203 17.10.2005 15:46:14
INETUPD.DLL : 6.32.00.52 143360 17.10.2005 15:46:14
CTL3D32.DLL : 2.31.000 27136 24.04.2003 12:00:00
MFC42.DLL : 6.00.8665.0 995383 24.04.2003 12:00:00
MSVCRT.DLL : 7.0.2600.1106 (xpsp1.020828-1920
MSVCRT.DLL : 7.0.2600.1106 323072 24.04.2003 12:00:00
CTL3DV2.DLL : No information
Configuration file:
Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
Start path: C:\Program Files\AVPersonal
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[X] All files
[ ] Program files
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[ ] Delete with prompt
[ ] Delete without prompt
[X] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\DOCUME~1\Moi\LOCALS~1\Temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/NT Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: medium
Drives:
C: Hard disk
D: Hard disk
E: CD-ROM
Start of scan: mercredi 2 novembre 2005 11:11
Memory test OK
Master boot record of hard disk HD0 OK
Boot record of drive C: OK
Boot record of drive D: OK
Access denied! Error during file opening!
Error code: 0x0002
C:\
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
WARNING! Access error/file locked!
C:\WINDOWS\system32
BINGOO.EXE.VIR
[DETECTION] Contains signature of the worm WORM/Mytob.KV
C:\WINDOWS\system32\config
system.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
software.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
default.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SYSTEM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SOFTWARE
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
DEFAULT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\D4EBCZJG
xxxxxxxxx[2]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[3]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[5]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[6]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[7]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[8]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[9]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[10]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\MTX8V9OB
xxxxxxxxx[3]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
AlexaRelated.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
LSA.zip
ArchiveType: ZIP
NOTE! No files to extract.
LSA1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
LSA2.zip
ArchiveType: ZIP
NOTE! No files to extract.
SmitfraudC.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
SmitfraudC1.zip
ArchiveType: ZIP
NOTE! No files to extract.
SmitfraudC2.zip
ArchiveType: ZIP
NOTE! No files to extract.
C:\Documents and Settings\NetworkService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\LocalService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Moi
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Moi\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Program Files\AVPersonal\INFECTED
HOSTS.VIR
[DETECTION] Is the Trojan horse TR/Qhost.AA
C:\Program Files\WinRAR
rarnew.dat
ArchiveType: RAR
NOTE! The archive is created by multiple volumes
End of scan: mercredi 2 novembre 2005 11:32
Time taken: 21:10 min
1989 directories were scanned
45229 files were scanned
24 warning messages were issued
0 files were deleted
0 files were repaired
11 detections
antivir a trouvé encore des virus. je t envoie le rapport.
Creation date of the report file: mercredi 2 novembre 2005 11:11
AntiVir®/XP (2000 + NT) PersonalEdition Classic
Build 1111 of 18.10.2005
Mainprogram 6.32.00.50 of 13.10.2005
VDF file 6.32.11.14 (0) of 01.11.2005
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 239807 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149991-WURGE-0001
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
Email ___________________________________________
Platform: Windows NT Workstation
Windows version: 5.1 Build 2600 (Service Pack 1)
Username: Moi
Processor: Pentium
Working memory: 260592 KB free
Version information:
AVWIN.DLL : 6.32.00.50 561192 13.10.2005 16:32:14
AVEWIN32.DLL : 6.32.0.57 954880 01.11.2005 14:58:32
AVGNT.EXE : 6.32.00.02 180327 14.10.2005 12:32:02
AVGUARD.EXE : 6.32.00.12 208424 17.10.2005 08:35:12
GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 11:24:10
AVGCMSG.DLL : 6.32.00.01 295029 13.10.2005 16:32:14
AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 08:07:16
AVPACK32.DLL : 6.32.00.02 319528 18.10.2005 11:57:30
AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 18:10:20
AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 18:10:22
AVSched32.EXE : 6.32.00.01 110632 20.09.2005 14:16:24
AVSched32.DLL : 6.30.00.00 122880 01.02.2005 11:24:10
AVREG.DLL : 6.31.00.05 41000 07.09.2005 16:34:50
AVRep.DLL : 6.32.00.120 1454120 01.11.2005 14:58:44
INETUPD.EXE : 6.32.00.52 262203 17.10.2005 15:46:14
INETUPD.DLL : 6.32.00.52 143360 17.10.2005 15:46:14
CTL3D32.DLL : 2.31.000 27136 24.04.2003 12:00:00
MFC42.DLL : 6.00.8665.0 995383 24.04.2003 12:00:00
MSVCRT.DLL : 7.0.2600.1106 (xpsp1.020828-1920
MSVCRT.DLL : 7.0.2600.1106 323072 24.04.2003 12:00:00
CTL3DV2.DLL : No information
Configuration file:
Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
Start path: C:\Program Files\AVPersonal
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[X] All files
[ ] Program files
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[ ] Delete with prompt
[ ] Delete without prompt
[X] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\DOCUME~1\Moi\LOCALS~1\Temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/NT Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: medium
Drives:
C: Hard disk
D: Hard disk
E: CD-ROM
Start of scan: mercredi 2 novembre 2005 11:11
Memory test OK
Master boot record of hard disk HD0 OK
Boot record of drive C: OK
Boot record of drive D: OK
Access denied! Error during file opening!
Error code: 0x0002
C:\
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
WARNING! Access error/file locked!
C:\WINDOWS\system32
BINGOO.EXE.VIR
[DETECTION] Contains signature of the worm WORM/Mytob.KV
C:\WINDOWS\system32\config
system.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
software.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
default.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SYSTEM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SOFTWARE
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
DEFAULT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\D4EBCZJG
xxxxxxxxx[2]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[3]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[5]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[6]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[7]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[8]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[9]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
xxxxxxxxx[10]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\MTX8V9OB
xxxxxxxxx[3]
[DETECTION] Contains signature of the worm WORM/Padobot.Z.8
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
AlexaRelated.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
LSA.zip
ArchiveType: ZIP
NOTE! No files to extract.
LSA1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
LSA2.zip
ArchiveType: ZIP
NOTE! No files to extract.
SmitfraudC.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
SmitfraudC1.zip
ArchiveType: ZIP
NOTE! No files to extract.
SmitfraudC2.zip
ArchiveType: ZIP
NOTE! No files to extract.
C:\Documents and Settings\NetworkService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\LocalService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Moi
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Moi\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Program Files\AVPersonal\INFECTED
HOSTS.VIR
[DETECTION] Is the Trojan horse TR/Qhost.AA
C:\Program Files\WinRAR
rarnew.dat
ArchiveType: RAR
NOTE! The archive is created by multiple volumes
End of scan: mercredi 2 novembre 2005 11:32
Time taken: 21:10 min
1989 directories were scanned
45229 files were scanned
24 warning messages were issued
0 files were deleted
0 files were repaired
11 detections
re,
1/tu as utiliser clean up?
2/rend toi ici
C:\Program Files\AVPersonal\INFECTED <--supprime tout ce qu il y a a l interieur et vide ta corbeille !
3/lance spybot
supprime les sauvegardes et vaccines !
4/Redemarre ton pc
si tu as des fentres d antivir, choisis l option, mettre en quarantaine !
a+
1/tu as utiliser clean up?
2/rend toi ici
C:\Program Files\AVPersonal\INFECTED <--supprime tout ce qu il y a a l interieur et vide ta corbeille !
3/lance spybot
supprime les sauvegardes et vaccines !
4/Redemarre ton pc
si tu as des fentres d antivir, choisis l option, mettre en quarantaine !
a+
rebonjour,
voila ce que j obtiens sur mon 2e ordi pour hijack. Que dois je fixer?
Logfile of HijackThis v1.99.1
Scan saved at 14:26:23, on 02/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\FixMytob.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [CCProxy] C:\Program Files\CCProxy\CCProxy.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2E97F64-C932-40C1-89BA-D5FC8FFBEC2D}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
en ce qui concerne antivir , il n y a pas eu d alertes depuis l allumage de l ordi.
je vais essayer de faire une analyse mais celle ci a du mal a se faire...
a plus tard
voila ce que j obtiens sur mon 2e ordi pour hijack. Que dois je fixer?
Logfile of HijackThis v1.99.1
Scan saved at 14:26:23, on 02/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\FixMytob.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [CCProxy] C:\Program Files\CCProxy\CCProxy.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2E97F64-C932-40C1-89BA-D5FC8FFBEC2D}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
en ce qui concerne antivir , il n y a pas eu d alertes depuis l allumage de l ordi.
je vais essayer de faire une analyse mais celle ci a du mal a se faire...
a plus tard
re
fixe ceci
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
supprime ceci
ALCXMNTR.EXE
et ensuite:
Lance ce scan en ligne:
http://www.bitdefender.com/scan/licence.php
Copie/colle le rapport
a+
fixe ceci
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
supprime ceci
ALCXMNTR.EXE
et ensuite:
Lance ce scan en ligne:
http://www.bitdefender.com/scan/licence.php
Copie/colle le rapport
a+
re
pour le premier ordi cela semble casiment réglé.
mon 2e ordi est sp2 donc le lien de bit defender ne marche pas.
comment faire?
voila le rapport d antivir:
Creation date of the report file: mercredi 2 novembre 2005 14:43
AntiVir®/XP (2000 + NT) PersonalEdition Classic
Build 1111 of 18.10.2005
Mainprogram 6.32.00.50 of 13.10.2005
VDF file 6.32.11.14 (0) of 01.11.2005
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 239807 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149991-WURGE-0001
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
Email ___________________________________________
Platform: Windows NT Workstation
Windows version: 5.1 Build 2600 (Service Pack 2)
Username: Compaq_Propriétaire
Computername: LA_PAILLE
Processor: Pentium
Working memory: 391664 KB free
Version information:
AVWIN.DLL : 6.32.00.50 561192 19.10.2005 15:48:52
AVEWIN32.DLL : 6.32.0.57 954880 24.10.2005 10:55:46
AVGNT.EXE : 6.32.00.02 180327 19.10.2005 15:48:52
AVGUARD.EXE : 6.32.00.12 208424 19.10.2005 15:48:52
GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 10:24:10
AVGCMSG.DLL : 6.32.00.01 295029 19.10.2005 15:48:52
AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 07:07:16
AVPACK32.DLL : 6.32.00.02 319528 19.10.2005 15:48:52
AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 17:10:20
AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 17:10:22
AVSched32.EXE : 6.32.00.01 110632 21.09.2005 10:14:42
AVSched32.DLL : 6.30.00.00 122880 01.02.2005 10:24:10
AVREG.DLL : 6.31.00.05 41000 13.09.2005 10:19:36
AVRep.DLL : 6.32.00.120 1454120 01.11.2005 14:54:22
INETUPD.EXE : 6.32.00.52 262203 19.10.2005 15:48:52
INETUPD.DLL : 6.32.00.52 143360 19.10.2005 15:48:52
CTL3D32.DLL : 2.31.000 27136 05.08.2004 13:00:00
MFC42.DLL : 6.02.4131.0 1028096 05.08.2004 19:00:00
MSVCRT.DLL : 7.0.2600.2180 (xpsp_sp2_rtm.0408
MSVCRT.DLL : 7.0.2600.2180 343040 05.08.2004 19:00:00
CTL3DV2.DLL : No information
Configuration file:
Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
Start path: C:\Program Files\AVPersonal
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[ ] All files
[X] Program files
Extensions: .386 .?HT* .ACM .ADE .ADP .ANI .APP .ASD .ASF .ASP .ASX .AWX .AX .BAS .BAT .BIN .BOO .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CRT .CSH .DLL .DLO .DO? .DRV .EMF .EML .EXE* .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .J2K .JAR .JFF .JFI .JFIF .JIF .JMH .JNG .JP2 .JPE .JPEG .JPG .JS* .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PCD .PDR .PGM .PHP .PIF .PKG .PL* .PNG .POT .PPS .PPT .PRG .RAR .REG .RPL .RTF .SBF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TMP .TSP .TTF .URL .VB? .VCS .VLM .VXD .VXO .WIZ .WLL .WMD .WMS .WMZ .WPC .WSC .WSF .WSH .WWK .XL? .XML .ZIP
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/NT Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: low
Drives:
C: Hard disk
D: Hard disk
E: CD-ROM
G: Floppy drive
H: Floppy drive
I: Floppy drive
J: Floppy drive
Start of scan: mercredi 2 novembre 2005 14:43
Memory test OK
Master boot record of hard disk HD0 OK
Master boot record of hard disk HD1
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD2
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD3
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD4
The record could not be read!
Error code: 0x0015
Boot record of drive C: OK
Boot record of drive D: OK
Access denied! Error during file opening!
Error code: 0x0002
C:\
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
WARNING! Access error/file locked!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
BackWeblite.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite10.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite11.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite12.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite13.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite14.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite15.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite16.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite17.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite18.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite19.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite20.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite21.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite22.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite23.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite24.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite25.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite26.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite27.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite28.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite29.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite3.zip
ArchiveType: ZIP
NOTE! No files to extract.
BackWeblite30.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite31.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite32.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite33.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite34.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite35.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite36.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite37.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite38.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite39.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite4.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite40.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite41.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite42.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite43.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite44.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite45.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite46.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite47.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite48.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite49.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite5.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite50.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite51.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite52.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite53.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite54.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite55.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite56.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite57.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite58.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite6.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite7.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite8.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite9.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
Error! Could not change directory: System Volume Information
C:\WINDOWS\SoftwareDistribution\EventCache
{974CC7BE-5E94-4A40-820A-EAC3D363FC85}.bin
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
C:\WINDOWS\system32
WARNING! Access error/file locked!
C:\WINDOWS\system32\config
default
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
software
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
system
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
End of scan: mercredi 2 novembre 2005 15:39
Time taken: 55:38 min
3708 directories were scanned
93219 files were scanned
9 warning messages were issued
0 files were deleted
0 files were repaired
0 detections
pour le premier ordi cela semble casiment réglé.
mon 2e ordi est sp2 donc le lien de bit defender ne marche pas.
comment faire?
voila le rapport d antivir:
Creation date of the report file: mercredi 2 novembre 2005 14:43
AntiVir®/XP (2000 + NT) PersonalEdition Classic
Build 1111 of 18.10.2005
Mainprogram 6.32.00.50 of 13.10.2005
VDF file 6.32.11.14 (0) of 01.11.2005
This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
Scanning for 239807 virus strains and unwanted programs.
Licensed for: AntiVir Personal Edition
Serial number: 0000149991-WURGE-0001
Please enter the workstation and
contact name with phone number in this form:
Name ___________________________________________
Street ___________________________________________
Town ___________________________________________
Phone/Fax ___________________________________________
Email ___________________________________________
Platform: Windows NT Workstation
Windows version: 5.1 Build 2600 (Service Pack 2)
Username: Compaq_Propriétaire
Computername: LA_PAILLE
Processor: Pentium
Working memory: 391664 KB free
Version information:
AVWIN.DLL : 6.32.00.50 561192 19.10.2005 15:48:52
AVEWIN32.DLL : 6.32.0.57 954880 24.10.2005 10:55:46
AVGNT.EXE : 6.32.00.02 180327 19.10.2005 15:48:52
AVGUARD.EXE : 6.32.00.12 208424 19.10.2005 15:48:52
GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 10:24:10
AVGCMSG.DLL : 6.32.00.01 295029 19.10.2005 15:48:52
AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 07:07:16
AVPACK32.DLL : 6.32.00.02 319528 19.10.2005 15:48:52
AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 17:10:20
AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 17:10:22
AVSched32.EXE : 6.32.00.01 110632 21.09.2005 10:14:42
AVSched32.DLL : 6.30.00.00 122880 01.02.2005 10:24:10
AVREG.DLL : 6.31.00.05 41000 13.09.2005 10:19:36
AVRep.DLL : 6.32.00.120 1454120 01.11.2005 14:54:22
INETUPD.EXE : 6.32.00.52 262203 19.10.2005 15:48:52
INETUPD.DLL : 6.32.00.52 143360 19.10.2005 15:48:52
CTL3D32.DLL : 2.31.000 27136 05.08.2004 13:00:00
MFC42.DLL : 6.02.4131.0 1028096 05.08.2004 19:00:00
MSVCRT.DLL : 7.0.2600.2180 (xpsp_sp2_rtm.0408
MSVCRT.DLL : 7.0.2600.2180 343040 05.08.2004 19:00:00
CTL3DV2.DLL : No information
Configuration file:
Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
Start path: C:\Program Files\AVPersonal
Command line:
Start mode: unknown
Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report
Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information
Abridge report file:
[ ] Abridge report file
Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged
Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100
Where to search:
[X] Memory
[X] Boot record of selected drives
[ ] Report unknown boot sectors
[ ] All files
[X] Program files
Extensions: .386 .?HT* .ACM .ADE .ADP .ANI .APP .ASD .ASF .ASP .ASX .AWX .AX .BAS .BAT .BIN .BOO .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CRT .CSH .DLL .DLO .DO? .DRV .EMF .EML .EXE* .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .J2K .JAR .JFF .JFI .JFIF .JIF .JMH .JNG .JP2 .JPE .JPEG .JPG .JS* .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PCD .PDR .PGM .PHP .PIF .PKG .PL* .PNG .POT .PPS .PPT .PRG .RAR .REG .RPL .RTF .SBF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TMP .TSP .TTF .URL .VB? .VCS .VLM .VXD .VXO .WIZ .WLL .WMD .WMS .WMZ .WPC .WSC .WSF .WSH .WWK .XL? .XML .ZIP
Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm
Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore
Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date
Drag&drop settings:
[X] Scan subdirectories
Profile settings:
[X] Scan subdirectories
Archive options
[X] Search archive
[X] All archive types
Miscellaneous options:
Temporary path: %TEMP% -> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[X] Load AVWin®/NT Guard on System start
General settings:
[X] Save options on exiting AntiVir
Priority: low
Drives:
C: Hard disk
D: Hard disk
E: CD-ROM
G: Floppy drive
H: Floppy drive
I: Floppy drive
J: Floppy drive
Start of scan: mercredi 2 novembre 2005 14:43
Memory test OK
Master boot record of hard disk HD0 OK
Master boot record of hard disk HD1
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD2
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD3
The record could not be read!
Error code: 0x0015
Master boot record of hard disk HD4
The record could not be read!
Error code: 0x0015
Boot record of drive C: OK
Boot record of drive D: OK
Access denied! Error during file opening!
Error code: 0x0002
C:\
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
WARNING! Access error/file locked!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
BackWeblite.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite10.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite11.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite12.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite13.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite14.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite15.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite16.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite17.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite18.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite19.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite20.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite21.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite22.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite23.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite24.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite25.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite26.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite27.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite28.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite29.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite3.zip
ArchiveType: ZIP
NOTE! No files to extract.
BackWeblite30.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite31.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite32.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite33.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite34.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite35.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite36.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite37.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite38.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite39.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite4.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite40.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite41.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite42.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite43.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite44.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite45.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite46.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite47.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite48.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite49.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite5.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite50.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite51.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite52.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite53.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite54.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite55.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite56.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite57.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite58.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite6.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite7.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite8.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
BackWeblite9.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
Error! Could not change directory: System Volume Information
C:\WINDOWS\SoftwareDistribution\EventCache
{974CC7BE-5E94-4A40-820A-EAC3D363FC85}.bin
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
Access denied! Error during file opening!
Error code: 0x0002
C:\WINDOWS\system32
WARNING! Access error/file locked!
C:\WINDOWS\system32\config
default
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
software
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
system
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
End of scan: mercredi 2 novembre 2005 15:39
Time taken: 55:38 min
3708 directories were scanned
93219 files were scanned
9 warning messages were issued
0 files were deleted
0 files were repaired
0 detections
salut
meme avec le sp2, cela fonctionne, il faut que tu acceptes les active x quand il te le demande...
***
Lance spybot, clik sur sauvegardes, coches tous et purge
vaccine egalement
a+
meme avec le sp2, cela fonctionne, il faut que tu acceptes les active x quand il te le demande...
***
Lance spybot, clik sur sauvegardes, coches tous et purge
vaccine egalement
a+
désolé, j avais pas fait gaffe la fenee avait été bloquée. bit defender a trouvé deux fichiers infectés et ils ont été supprimés.
Juste une derniere petite question pratique: comment cela se fait que j ai autant de "lignes" sur le 2e ordi en executant hijack?
N y aurait il pas des trucs inutiles?
Logfile of HijackThis v1.99.1
Scan saved at 17:51:16, on 02/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\CCProxy\CCProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [CCProxy] C:\Program Files\CCProxy\CCProxy.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2E97F64-C932-40C1-89BA-D5FC8FFBEC2D}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
Je te remercie,encore une fois, pour ton aide précieuse.
a bientot (j espere pas mais bon... ce fut une aide appréciable!)
;)
Juste une derniere petite question pratique: comment cela se fait que j ai autant de "lignes" sur le 2e ordi en executant hijack?
N y aurait il pas des trucs inutiles?
Logfile of HijackThis v1.99.1
Scan saved at 17:51:16, on 02/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\CCProxy\CCProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Compaq_Propriétaire\Mes documents\outils\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.free.fr/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lequipe.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/ie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q305&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [CCProxy] C:\Program Files\CCProxy\CCProxy.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2E97F64-C932-40C1-89BA-D5FC8FFBEC2D}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
Je te remercie,encore une fois, pour ton aide précieuse.
a bientot (j espere pas mais bon... ce fut une aide appréciable!)
;)
salut
autant de lignes ou? sur la globalite du log hijack this ?
a+
PS: Ce fut un plaisir de vous aider en tout cas
autant de lignes ou? sur la globalite du log hijack this ?
a+
PS: Ce fut un plaisir de vous aider en tout cas
re,
les processus, non, c est raisonable
tu peux eventuellement acceler le demarrage ton pc en retirant les programmes inutiles du demarrage..(ms,+; ta cam...)
Pour cela
demarer<executer<tape msconfig
onglet demarrage et coche les cases devant les lignes correspondant aux logiciels que tu ne veuix pas lancer au demarrage et valide
accepte le redemarrage selectif
a+
les processus, non, c est raisonable
tu peux eventuellement acceler le demarrage ton pc en retirant les programmes inutiles du demarrage..(ms,+; ta cam...)
Pour cela
demarer<executer<tape msconfig
onglet demarrage et coche les cases devant les lignes correspondant aux logiciels que tu ne veuix pas lancer au demarrage et valide
accepte le redemarrage selectif
a+
Bonjour,
Effectivement, il n'y a rien d'excessif, sauf peut-être dans la zone de démarrage [04]. le démarrage du PC s'en trouverait grandement amélioré. Inutile de désactiver, encore moins supprimer, les logiciels non utilisés temporairement.
Lorsqu'on fixe les clés dans la zone 04, ces logiciels ne démarre plus.
On peut les remettre en fonction via la fonction backup. Par conséquent, je conseille la démarche suivante:
1° S'informer sur les processus via windows ou google en cas de doute.
2° La plupart des logiciels n'ont pas à se trouver dans zone 04, sans votre autorisation. Je fais une exception pour l'antivrus et le firewall.
3° Fixe d'abord les clés dont tu peux te passer avec certitute. Supprimer un clé au démarrage ne veut pas dire que le logiciel sera inutilisable. Par exemple, Nero n'a rien à faire dans la zone 04. Ensuite fixe poste par poste si tu es incertain. C'est plus facile de restaurer (fonction backup en bas à droite: clique sur config).
Voici un lien pour un tuto sur HijackThis:
http://forum.hardware.fr/hardwarefr/WindowsSoftwareReseaux/Tutoriel-R-HijackThis-sujet-171913-1.htm
Nestor
Effectivement, il n'y a rien d'excessif, sauf peut-être dans la zone de démarrage [04]. le démarrage du PC s'en trouverait grandement amélioré. Inutile de désactiver, encore moins supprimer, les logiciels non utilisés temporairement.
Lorsqu'on fixe les clés dans la zone 04, ces logiciels ne démarre plus.
On peut les remettre en fonction via la fonction backup. Par conséquent, je conseille la démarche suivante:
1° S'informer sur les processus via windows ou google en cas de doute.
2° La plupart des logiciels n'ont pas à se trouver dans zone 04, sans votre autorisation. Je fais une exception pour l'antivrus et le firewall.
3° Fixe d'abord les clés dont tu peux te passer avec certitute. Supprimer un clé au démarrage ne veut pas dire que le logiciel sera inutilisable. Par exemple, Nero n'a rien à faire dans la zone 04. Ensuite fixe poste par poste si tu es incertain. C'est plus facile de restaurer (fonction backup en bas à droite: clique sur config).
Voici un lien pour un tuto sur HijackThis:
http://forum.hardware.fr/hardwarefr/WindowsSoftwareReseaux/Tutoriel-R-HijackThis-sujet-171913-1.htm
Nestor
Bonjour,
j ai toujours des alertes avec antivir comme le montre le log ci apres.
en suivant le bilan de hijack
02/11/2005,11:01:32 [INFO] Stop Filter Device.
02/11/2005,11:01:33 AVGuard service has been stopped!
02/11/2005,11:02:19 ---------------------------------------------------------
02/11/2005,11:02:19 [INIT] The AVGuard Service is starting.
02/11/2005,11:02:23 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,11:02:26 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:02:27 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa392e.
02/11/2005,11:02:45 [INFO] Start Filter Device.
02/11/2005,11:02:45 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,11:02:45 AVGuard has been started successfully!
02/11/2005,11:39:38 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
02/11/2005,11:39:42 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
02/11/2005,11:44:39 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:44:39 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaa8d93be.
02/11/2005,11:45:48 [INFO] Stop Filter Device.
02/11/2005,11:45:51 AVGuard service has been stopped!
02/11/2005,11:46:37 ---------------------------------------------------------
02/11/2005,11:46:37 [INIT] The AVGuard Service is starting.
02/11/2005,11:46:52 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,11:46:55 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:46:55 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa1769.
02/11/2005,11:47:15 [INFO] Start Filter Device.
02/11/2005,11:47:15 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,11:47:15 AVGuard has been started successfully!
02/11/2005,11:48:15 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
02/11/2005,11:47:50 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
02/11/2005,16:19:29 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
File has been moved to quarantine directory!
02/11/2005,16:19:35 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
File has been moved to quarantine directory!
02/11/2005,16:19:42 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
02/11/2005,16:19:42 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
02/11/2005,16:21:12 [INFO] Stop Filter Device.
02/11/2005,16:21:14 AVGuard service has been stopped!
02/11/2005,16:22:01 ---------------------------------------------------------
02/11/2005,16:22:01 [INIT] The AVGuard Service is starting.
02/11/2005,16:22:08 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,16:22:16 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,16:22:17 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa04ce.
02/11/2005,16:22:28 [INFO] Start Filter Device.
02/11/2005,16:22:28 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,16:22:28 AVGuard has been started successfully!
02/11/2005,16:55:24 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,16:55:25 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaab5ac77.
02/11/2005,22:33:10 [INFO] Stop Filter Device.
02/11/2005,22:33:14 AVGuard service has been stopped!
03/11/2005,08:09:35 ---------------------------------------------------------
03/11/2005,08:09:35 [INIT] The AVGuard Service is starting.
03/11/2005,08:09:39 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,08:09:41 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,08:09:41 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa2b57.
03/11/2005,08:09:53 [INFO] Start Filter Device.
03/11/2005,08:09:53 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
03/11/2005,08:09:53 AVGuard has been started successfully!
03/11/2005,09:54:50 [INFO] Stop Filter Device.
03/11/2005,09:54:51 AVGuard service has been stopped!
03/11/2005,09:54:54 ---------------------------------------------------------
03/11/2005,09:54:54 [INIT] The AVGuard Service is starting.
03/11/2005,09:54:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,09:54:56 [INFO] Start Filter Device.
03/11/2005,09:54:56 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
03/11/2005,09:54:56 AVGuard has been started successfully!
03/11/2005,09:54:57 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,09:54:57 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaca4b2f.
03/11/2005,10:33:19 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SPA3G1YR\COMPOSITIONDESGROUPES[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,12:21:16 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
03/11/2005,12:20:50 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
03/11/2005,16:46:24 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\WTEJ41AN\2005FLASHEXPRESS07OCTUSA[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,16:46:34 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\WTEJ41AN\2005FLASHEXPRESS07OCTUSA[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,21:57:34 [INFO] Stop Filter Device.
03/11/2005,21:57:38 AVGuard service has been stopped!
03/11/2005,21:58:27 ---------------------------------------------------------
03/11/2005,21:58:27 [INIT] The AVGuard Service is starting.
03/11/2005,21:58:34 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,21:58:37 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,21:58:37 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3318.
03/11/2005,21:58:51 [INFO] Start Filter Device.
03/11/2005,21:58:51 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
03/11/2005,21:58:51 AVGuard has been started successfully!
03/11/2005,21:59:52 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\WINDOWS\SYSTEM32\ENBIEI.EXE
File has been moved to quarantine directory!
03/11/2005,22:03:11 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
File has been deleted!
03/11/2005,22:57:22 [INFO] Stop Filter Device.
03/11/2005,22:57:24 AVGuard service has been stopped!
04/11/2005,07:24:30 ---------------------------------------------------------
04/11/2005,07:24:30 [INIT] The AVGuard Service is starting.
04/11/2005,07:24:35 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
04/11/2005,07:24:41 [LOGON] Connection request by remote computer. Establishing secure communication channel.
04/11/2005,07:24:41 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa33b6.
04/11/2005,07:24:55 [INFO] Start Filter Device.
04/11/2005,07:24:55 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
04/11/2005,07:24:55 AVGuard has been started successfully!
04/11/2005,07:28:07 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CXGTI3OD\TPSAIGEPGPE2005_2006[1].DOC
ATTENTION: This OLE document is possibly damaged!
04/11/2005,07:53:34 [INFO] Stop Filter Device.
04/11/2005,07:53:35 AVGuard service has been stopped!
04/11/2005,12:24:53 ---------------------------------------------------------
04/11/2005,12:24:53 [INIT] The AVGuard Service is starting.
04/11/2005,12:25:01 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
04/11/2005,12:25:05 [LOGON] Connection request by remote computer. Establishing secure communication channel.
04/11/2005,12:25:06 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa0873.
04/11/2005,12:25:22 [INFO] Start Filter Device.
04/11/2005,12:25:22 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
04/11/2005,12:25:22 AVGuard has been started successfully!
04/11/2005,12:27:52 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7EOR7P4X\10MECS1[1].PPS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,12:32:38 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SXQ3416N\LESFEMMES[1].PPS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,18:01:38 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7EOR7P4X\ADRESSES[1].XLS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,20:32:35 [INFO] Stop Filter Device.
04/11/2005,20:32:38 AVGuard service has been stopped!
05/11/2005,12:18:09 ---------------------------------------------------------
05/11/2005,12:18:09 [INIT] The AVGuard Service is starting.
05/11/2005,12:18:13 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
05/11/2005,12:18:18 [LOGON] Connection request by remote computer. Establishing secure communication channel.
05/11/2005,12:18:18 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3cf5.
05/11/2005,12:18:35 [INFO] Start Filter Device.
05/11/2005,12:18:35 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
05/11/2005,12:18:35 AVGuard has been started successfully!
05/11/2005,17:08:46 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
05/11/2005,20:23:56 [INFO] Stop Filter Device.
05/11/2005,20:23:59 AVGuard service has been stopped!
06/11/2005,12:00:34 ---------------------------------------------------------
06/11/2005,12:00:34 [INIT] The AVGuard Service is starting.
06/11/2005,12:00:38 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
06/11/2005,12:00:43 [LOGON] Connection request by remote computer. Establishing secure communication channel.
06/11/2005,12:00:43 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3f51.
06/11/2005,12:00:58 [INFO] Start Filter Device.
06/11/2005,12:00:58 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
06/11/2005,12:00:58 AVGuard has been started successfully!
06/11/2005,22:57:32 [INFO] Stop Filter Device.
06/11/2005,22:57:33 AVGuard service has been stopped!
07/11/2005,09:23:57 ---------------------------------------------------------
07/11/2005,09:23:57 [INIT] The AVGuard Service is starting.
07/11/2005,09:24:03 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,09:24:06 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,09:24:06 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa30a8.
07/11/2005,09:24:19 [INFO] Start Filter Device.
07/11/2005,09:24:19 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
07/11/2005,09:24:19 AVGuard has been started successfully!
07/11/2005,14:02:34 [INFO] Stop Filter Device.
07/11/2005,14:02:35 AVGuard service has been stopped!
07/11/2005,14:02:38 ---------------------------------------------------------
07/11/2005,14:02:38 [INIT] The AVGuard Service is starting.
07/11/2005,14:02:39 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,14:02:39 [INFO] Start Filter Device.
07/11/2005,14:02:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.15
07/11/2005,14:02:39 AVGuard has been started successfully!
07/11/2005,14:02:43 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,14:02:43 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaa550663.
07/11/2005,14:02:51 [INFO] Stop Filter Device.
07/11/2005,14:02:51 AVGuard service has been stopped!
07/11/2005,14:03:01 ---------------------------------------------------------
07/11/2005,14:03:01 [INIT] The AVGuard Service is starting.
07/11/2005,14:03:03 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,14:03:04 [INFO] Start Filter Device.
07/11/2005,14:03:04 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.15
07/11/2005,14:03:04 AVGuard has been started successfully!
07/11/2005,14:03:07 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,14:03:07 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xabaaa0da.
07/11/2005,22:54:49 [INFO] Stop Filter Device.
07/11/2005,22:54:51 AVGuard service has been stopped!
07/11/2005,22:54:55 ---------------------------------------------------------
07/11/2005,22:54:55 [INIT] The AVGuard Service is starting.
07/11/2005,22:54:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,22:54:57 [INFO] Start Filter Device.
07/11/2005,22:54:57 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
07/11/2005,22:54:57 AVGuard has been started successfully!
07/11/2005,22:54:57 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,22:54:57 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xa84c5fd3.
07/11/2005,23:06:11 [INFO] Stop Filter Device.
07/11/2005,23:06:13 AVGuard service has been stopped!
08/11/2005,07:21:39 ---------------------------------------------------------
08/11/2005,07:21:39 [INIT] The AVGuard Service is starting.
08/11/2005,07:21:43 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
08/11/2005,07:21:49 [LOGON] Connection request by remote computer. Establishing secure communication channel.
08/11/2005,07:21:49 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa320e.
08/11/2005,07:21:59 [INFO] Start Filter Device.
08/11/2005,07:21:59 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
08/11/2005,07:21:59 AVGuard has been started successfully!
08/11/2005,13:05:31 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
08/11/2005,13:05:24 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
08/11/2005,13:19:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,13:19:29 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[1].EXE
File has been deleted!
08/11/2005,13:19:40 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[2].EXE
File has been moved to quarantine directory!
08/11/2005,13:19:44 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[3].EXE
File has been moved to quarantine directory!
08/11/2005,13:19:47 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:22 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:31 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:30 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:39 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:22:04 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,13:22:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,23:12:52 [INFO] Stop Filter Device.
08/11/2005,23:12:56 AVGuard service has been stopped!
09/11/2005,08:06:53 ---------------------------------------------------------
09/11/2005,08:06:53 [INIT] The AVGuard Service is starting.
09/11/2005,08:06:58 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
09/11/2005,08:07:01 [LOGON] Connection request by remote computer. Establishing secure communication channel.
09/11/2005,08:07:01 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3c69.
09/11/2005,08:07:19 [INFO] Start Filter Device.
09/11/2005,08:07:19 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
09/11/2005,08:07:19 AVGuard has been started successfully!
09/11/2005,08:08:22 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
File has been moved to quarantine directory!
09/11/2005,08:08:03 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
09/11/2005,08:07:57 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
File has been moved to quarantine directory!
09/11/2005,08:08:44 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\HELLMSN.EXE
File has been moved to quarantine directory!
09/11/2005,08:24:33 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
File has been moved to quarantine directory!
09/11/2005,10:04:15 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been moved to quarantine directory!
09/11/2005,10:04:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
File has been moved to quarantine directory!
09/11/2005,10:12:55 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\TASKGMR.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:50 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
09/11/2005,10:23:51 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HELLMSN.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:54 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\X[4].EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:59 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\BINGOO.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:24:03 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\NETHELL.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,12:10:00 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,12:09:34 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,10:33:18 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP2\A0000061.EXE
09/11/2005,14:21:47 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000258.SCR
File has been moved to quarantine directory!
09/11/2005,14:21:57 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000259.SCR
File has been moved to quarantine directory!
09/11/2005,14:22:02 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000260.SCR
09/11/2005,14:22:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000261.EXE
09/11/2005,14:22:05 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000262.EXE
09/11/2005,14:22:06 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000268.EXE
09/11/2005,14:22:08 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP6\A0000288.EXE
09/11/2005,14:22:27 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP6\A0000289.EXE
09/11/2005,14:22:28 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\FUNNY_PIC.SCR
09/11/2005,14:22:31 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SEE_THIS!!.SCR
09/11/2005,14:22:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\MY_PHOTO2005.SCR
09/11/2005,14:25:52 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[1].EXE
09/11/2005,14:29:48 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,20:15:30 [INFO] Stop Filter Device.
09/11/2005,20:15:34 AVGuard service has been stopped!
10/11/2005,16:12:31 ---------------------------------------------------------
10/11/2005,16:12:31 [INIT] The AVGuard Service is starting.
10/11/2005,16:12:43 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,16:12:45 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,16:12:45 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa1a4f.
10/11/2005,16:13:10 [INFO] Start Filter Device.
10/11/2005,16:13:10 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,16:13:10 AVGuard has been started successfully!
10/11/2005,18:36:22 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
10/11/2005,18:38:58 [INFO] Stop Filter Device.
10/11/2005,18:39:50 ---------------------------------------------------------
10/11/2005,18:39:50 [INIT] The AVGuard Service is starting.
10/11/2005,18:39:55 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,18:40:02 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,18:40:03 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa0d91.
10/11/2005,18:40:20 [INFO] Start Filter Device.
10/11/2005,18:40:20 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,18:40:20 AVGuard has been started successfully!
10/11/2005,20:31:18 [INFO] Stop Filter Device.
10/11/2005,20:31:18 AVGuard service has been stopped!
10/11/2005,20:32:06 ---------------------------------------------------------
10/11/2005,20:32:06 [INIT] The AVGuard Service is starting.
10/11/2005,20:32:09 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,20:32:11 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,20:32:11 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa27de.
10/11/2005,20:32:21 [INFO] Start Filter Device.
10/11/2005,20:32:21 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,20:32:21 AVGuard has been started successfully!
11/11/2005,05:21:59 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
11/11/2005,03:08:41 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
11/11/2005,14:59:32 [INFO] Stop Filter Device.
11/11/2005,14:59:33 AVGuard service has been stopped!
11/11/2005,14:59:36 ---------------------------------------------------------
11/11/2005,14:59:36 [INIT] The AVGuard Service is starting.
11/11/2005,14:59:38 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
11/11/2005,14:59:38 [LOGON] Connection request by remote computer. Establishing secure communication channel.
11/11/2005,14:59:39 [INFO] Start Filter Device.
11/11/2005,14:59:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
11/11/2005,14:59:39 AVGuard has been started successfully!
11/11/2005,14:59:39 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xa95cdc92.
11/11/2005,15:26:33 [INFO] Stop Filter Device.
11/11/2005,15:26:35 AVGuard service has been stopped!
13/11/2005,23:55:15 ---------------------------------------------------------
13/11/2005,23:55:15 [INIT] The AVGuard Service is starting.
13/11/2005,23:55:20 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
13/11/2005,23:55:22 [LOGON] Connection request by remote computer. Establishing secure communication channel.
13/11/2005,23:55:22 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3bcd.
13/11/2005,23:55:27 [INFO] Start Filter Device.
13/11/2005,23:55:27 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
13/11/2005,23:55:27 AVGuard has been started successfully!
13/11/2005,23:59:14 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been deleted!
14/11/2005,00:13:42 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been deleted!
14/11/2005,00:57:32 [INFO] Stop Filter Device.
14/11/2005,00:57:32 AVGuard service has been stopped!
14/11/2005,10:10:25 ---------------------------------------------------------
14/11/2005,10:10:25 [INIT] The AVGuard Service is starting.
14/11/2005,10:10:29 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
14/11/2005,10:10:32 [LOGON] Connection request by remote computer. Establishing secure communication channel.
14/11/2005,10:10:33 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa25ae.
14/11/2005,10:10:39 [INFO] Start Filter Device.
14/11/2005,10:10:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
14/11/2005,10:10:39 AVGuard has been started successfully!
14/11/2005,11:16:43 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\WINDOWS\SYSTEM32\TFTP736
File has been deleted!
14/11/2005,11:23:24 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[1].EXE
File has been deleted!
14/11/2005,11:24:05 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[2].EXE
File has been deleted!
14/11/2005,11:24:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[3].EXE
File has been deleted!
-------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 11:33:19, on 14/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Documents and Settings\Moi\Local Settings\Temporary Internet Files\Content.IE5\M1RHG5T7\FixBlast[1].exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
merci de me donner qq conseils pour eviter cela...
j ai toujours des alertes avec antivir comme le montre le log ci apres.
en suivant le bilan de hijack
02/11/2005,11:01:32 [INFO] Stop Filter Device.
02/11/2005,11:01:33 AVGuard service has been stopped!
02/11/2005,11:02:19 ---------------------------------------------------------
02/11/2005,11:02:19 [INIT] The AVGuard Service is starting.
02/11/2005,11:02:23 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,11:02:26 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:02:27 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa392e.
02/11/2005,11:02:45 [INFO] Start Filter Device.
02/11/2005,11:02:45 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,11:02:45 AVGuard has been started successfully!
02/11/2005,11:39:38 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
02/11/2005,11:39:42 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
02/11/2005,11:44:39 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:44:39 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaa8d93be.
02/11/2005,11:45:48 [INFO] Stop Filter Device.
02/11/2005,11:45:51 AVGuard service has been stopped!
02/11/2005,11:46:37 ---------------------------------------------------------
02/11/2005,11:46:37 [INIT] The AVGuard Service is starting.
02/11/2005,11:46:52 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,11:46:55 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,11:46:55 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa1769.
02/11/2005,11:47:15 [INFO] Start Filter Device.
02/11/2005,11:47:15 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,11:47:15 AVGuard has been started successfully!
02/11/2005,11:48:15 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
02/11/2005,11:47:50 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
02/11/2005,16:19:29 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
File has been moved to quarantine directory!
02/11/2005,16:19:35 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
File has been moved to quarantine directory!
02/11/2005,16:19:42 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
02/11/2005,16:19:42 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.VIR
02/11/2005,16:21:12 [INFO] Stop Filter Device.
02/11/2005,16:21:14 AVGuard service has been stopped!
02/11/2005,16:22:01 ---------------------------------------------------------
02/11/2005,16:22:01 [INIT] The AVGuard Service is starting.
02/11/2005,16:22:08 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,16:22:16 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,16:22:17 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa04ce.
02/11/2005,16:22:28 [INFO] Start Filter Device.
02/11/2005,16:22:28 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
02/11/2005,16:22:28 AVGuard has been started successfully!
02/11/2005,16:55:24 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,16:55:25 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaab5ac77.
02/11/2005,22:33:10 [INFO] Stop Filter Device.
02/11/2005,22:33:14 AVGuard service has been stopped!
03/11/2005,08:09:35 ---------------------------------------------------------
03/11/2005,08:09:35 [INIT] The AVGuard Service is starting.
03/11/2005,08:09:39 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,08:09:41 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,08:09:41 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa2b57.
03/11/2005,08:09:53 [INFO] Start Filter Device.
03/11/2005,08:09:53 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.11.14
03/11/2005,08:09:53 AVGuard has been started successfully!
03/11/2005,09:54:50 [INFO] Stop Filter Device.
03/11/2005,09:54:51 AVGuard service has been stopped!
03/11/2005,09:54:54 ---------------------------------------------------------
03/11/2005,09:54:54 [INIT] The AVGuard Service is starting.
03/11/2005,09:54:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,09:54:56 [INFO] Start Filter Device.
03/11/2005,09:54:56 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
03/11/2005,09:54:56 AVGuard has been started successfully!
03/11/2005,09:54:57 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,09:54:57 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaca4b2f.
03/11/2005,10:33:19 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SPA3G1YR\COMPOSITIONDESGROUPES[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,12:21:16 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
03/11/2005,12:20:50 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
03/11/2005,16:46:24 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\WTEJ41AN\2005FLASHEXPRESS07OCTUSA[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,16:46:34 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\WTEJ41AN\2005FLASHEXPRESS07OCTUSA[1].DOC
ATTENTION: This OLE document is possibly damaged!
03/11/2005,21:57:34 [INFO] Stop Filter Device.
03/11/2005,21:57:38 AVGuard service has been stopped!
03/11/2005,21:58:27 ---------------------------------------------------------
03/11/2005,21:58:27 [INIT] The AVGuard Service is starting.
03/11/2005,21:58:34 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
03/11/2005,21:58:37 [LOGON] Connection request by remote computer. Establishing secure communication channel.
03/11/2005,21:58:37 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3318.
03/11/2005,21:58:51 [INFO] Start Filter Device.
03/11/2005,21:58:51 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
03/11/2005,21:58:51 AVGuard has been started successfully!
03/11/2005,21:59:52 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\WINDOWS\SYSTEM32\ENBIEI.EXE
File has been moved to quarantine directory!
03/11/2005,22:03:11 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
File has been deleted!
03/11/2005,22:57:22 [INFO] Stop Filter Device.
03/11/2005,22:57:24 AVGuard service has been stopped!
04/11/2005,07:24:30 ---------------------------------------------------------
04/11/2005,07:24:30 [INIT] The AVGuard Service is starting.
04/11/2005,07:24:35 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
04/11/2005,07:24:41 [LOGON] Connection request by remote computer. Establishing secure communication channel.
04/11/2005,07:24:41 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa33b6.
04/11/2005,07:24:55 [INFO] Start Filter Device.
04/11/2005,07:24:55 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
04/11/2005,07:24:55 AVGuard has been started successfully!
04/11/2005,07:28:07 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\CXGTI3OD\TPSAIGEPGPE2005_2006[1].DOC
ATTENTION: This OLE document is possibly damaged!
04/11/2005,07:53:34 [INFO] Stop Filter Device.
04/11/2005,07:53:35 AVGuard service has been stopped!
04/11/2005,12:24:53 ---------------------------------------------------------
04/11/2005,12:24:53 [INIT] The AVGuard Service is starting.
04/11/2005,12:25:01 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
04/11/2005,12:25:05 [LOGON] Connection request by remote computer. Establishing secure communication channel.
04/11/2005,12:25:06 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa0873.
04/11/2005,12:25:22 [INFO] Start Filter Device.
04/11/2005,12:25:22 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
04/11/2005,12:25:22 AVGuard has been started successfully!
04/11/2005,12:27:52 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7EOR7P4X\10MECS1[1].PPS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,12:32:38 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\SXQ3416N\LESFEMMES[1].PPS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,18:01:38 WARNING: AVGuard detected a problem in the file
C:\DOCUMENTS AND SETTINGS\MOI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7EOR7P4X\ADRESSES[1].XLS
ATTENTION: This OLE document is possibly damaged!
04/11/2005,20:32:35 [INFO] Stop Filter Device.
04/11/2005,20:32:38 AVGuard service has been stopped!
05/11/2005,12:18:09 ---------------------------------------------------------
05/11/2005,12:18:09 [INIT] The AVGuard Service is starting.
05/11/2005,12:18:13 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
05/11/2005,12:18:18 [LOGON] Connection request by remote computer. Establishing secure communication channel.
05/11/2005,12:18:18 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3cf5.
05/11/2005,12:18:35 [INFO] Start Filter Device.
05/11/2005,12:18:35 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
05/11/2005,12:18:35 AVGuard has been started successfully!
05/11/2005,17:08:46 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
05/11/2005,20:23:56 [INFO] Stop Filter Device.
05/11/2005,20:23:59 AVGuard service has been stopped!
06/11/2005,12:00:34 ---------------------------------------------------------
06/11/2005,12:00:34 [INIT] The AVGuard Service is starting.
06/11/2005,12:00:38 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
06/11/2005,12:00:43 [LOGON] Connection request by remote computer. Establishing secure communication channel.
06/11/2005,12:00:43 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3f51.
06/11/2005,12:00:58 [INFO] Start Filter Device.
06/11/2005,12:00:58 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
06/11/2005,12:00:58 AVGuard has been started successfully!
06/11/2005,22:57:32 [INFO] Stop Filter Device.
06/11/2005,22:57:33 AVGuard service has been stopped!
07/11/2005,09:23:57 ---------------------------------------------------------
07/11/2005,09:23:57 [INIT] The AVGuard Service is starting.
07/11/2005,09:24:03 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,09:24:06 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,09:24:06 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa30a8.
07/11/2005,09:24:19 [INFO] Start Filter Device.
07/11/2005,09:24:19 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.1
07/11/2005,09:24:19 AVGuard has been started successfully!
07/11/2005,14:02:34 [INFO] Stop Filter Device.
07/11/2005,14:02:35 AVGuard service has been stopped!
07/11/2005,14:02:38 ---------------------------------------------------------
07/11/2005,14:02:38 [INIT] The AVGuard Service is starting.
07/11/2005,14:02:39 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,14:02:39 [INFO] Start Filter Device.
07/11/2005,14:02:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.15
07/11/2005,14:02:39 AVGuard has been started successfully!
07/11/2005,14:02:43 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,14:02:43 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaa550663.
07/11/2005,14:02:51 [INFO] Stop Filter Device.
07/11/2005,14:02:51 AVGuard service has been stopped!
07/11/2005,14:03:01 ---------------------------------------------------------
07/11/2005,14:03:01 [INIT] The AVGuard Service is starting.
07/11/2005,14:03:03 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,14:03:04 [INFO] Start Filter Device.
07/11/2005,14:03:04 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.15
07/11/2005,14:03:04 AVGuard has been started successfully!
07/11/2005,14:03:07 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,14:03:07 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xabaaa0da.
07/11/2005,22:54:49 [INFO] Stop Filter Device.
07/11/2005,22:54:51 AVGuard service has been stopped!
07/11/2005,22:54:55 ---------------------------------------------------------
07/11/2005,22:54:55 [INIT] The AVGuard Service is starting.
07/11/2005,22:54:56 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
07/11/2005,22:54:57 [INFO] Start Filter Device.
07/11/2005,22:54:57 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
07/11/2005,22:54:57 AVGuard has been started successfully!
07/11/2005,22:54:57 [LOGON] Connection request by remote computer. Establishing secure communication channel.
07/11/2005,22:54:57 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xa84c5fd3.
07/11/2005,23:06:11 [INFO] Stop Filter Device.
07/11/2005,23:06:13 AVGuard service has been stopped!
08/11/2005,07:21:39 ---------------------------------------------------------
08/11/2005,07:21:39 [INIT] The AVGuard Service is starting.
08/11/2005,07:21:43 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
08/11/2005,07:21:49 [LOGON] Connection request by remote computer. Establishing secure communication channel.
08/11/2005,07:21:49 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa320e.
08/11/2005,07:21:59 [INFO] Start Filter Device.
08/11/2005,07:21:59 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
08/11/2005,07:21:59 AVGuard has been started successfully!
08/11/2005,13:05:31 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
08/11/2005,13:05:24 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
08/11/2005,13:19:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,13:19:29 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[1].EXE
File has been deleted!
08/11/2005,13:19:40 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[2].EXE
File has been moved to quarantine directory!
08/11/2005,13:19:44 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[3].EXE
File has been moved to quarantine directory!
08/11/2005,13:19:47 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:22 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:31 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:30 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:21:39 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
Unable to move the file to the quarantine directory:
0x00000020 - Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus.
08/11/2005,13:22:04 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,13:22:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\FTPUPD.EXE.001
08/11/2005,23:12:52 [INFO] Stop Filter Device.
08/11/2005,23:12:56 AVGuard service has been stopped!
09/11/2005,08:06:53 ---------------------------------------------------------
09/11/2005,08:06:53 [INIT] The AVGuard Service is starting.
09/11/2005,08:06:58 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
09/11/2005,08:07:01 [LOGON] Connection request by remote computer. Establishing secure communication channel.
09/11/2005,08:07:01 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3c69.
09/11/2005,08:07:19 [INFO] Start Filter Device.
09/11/2005,08:07:19 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
09/11/2005,08:07:19 AVGuard has been started successfully!
09/11/2005,08:08:22 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
File has been moved to quarantine directory!
09/11/2005,08:08:03 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
Unable to move the file to the quarantine directory:
0x00000002 - Le fichier spécifié est introuvable.
09/11/2005,08:07:57 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
File has been moved to quarantine directory!
09/11/2005,08:08:44 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\HELLMSN.EXE
File has been moved to quarantine directory!
09/11/2005,08:24:33 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\C5UN4LEZ\X[4].EXE
File has been moved to quarantine directory!
09/11/2005,10:04:15 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been moved to quarantine directory!
09/11/2005,10:04:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
File has been moved to quarantine directory!
09/11/2005,10:12:55 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\TASKGMR.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:50 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HOSTS.VIR
09/11/2005,10:23:51 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\HELLMSN.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:54 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\X[4].EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:23:59 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\BINGOO.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,10:24:03 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\PROGRAM FILES\AVPERSONAL\INFECTED\NETHELL.EXE.VIR
File has been moved to quarantine directory!
09/11/2005,12:10:00 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,12:09:34 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,10:33:18 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP2\A0000061.EXE
09/11/2005,14:21:47 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000258.SCR
File has been moved to quarantine directory!
09/11/2005,14:21:57 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000259.SCR
File has been moved to quarantine directory!
09/11/2005,14:22:02 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000260.SCR
09/11/2005,14:22:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000261.EXE
09/11/2005,14:22:05 WARNING: Contains signature of the worm WORM/Mytob.F.1!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000262.EXE
09/11/2005,14:22:06 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP5\A0000268.EXE
09/11/2005,14:22:08 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP6\A0000288.EXE
09/11/2005,14:22:27 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SYSTEM VOLUME INFORMATION\_RESTORE{55C43280-EB61-47CB-9151-2B2ACEA5AFE1}\RP6\A0000289.EXE
09/11/2005,14:22:28 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\FUNNY_PIC.SCR
09/11/2005,14:22:31 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\SEE_THIS!!.SCR
09/11/2005,14:22:32 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\MY_PHOTO2005.SCR
09/11/2005,14:25:52 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[1].EXE
09/11/2005,14:29:48 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
09/11/2005,20:15:30 [INFO] Stop Filter Device.
09/11/2005,20:15:34 AVGuard service has been stopped!
10/11/2005,16:12:31 ---------------------------------------------------------
10/11/2005,16:12:31 [INIT] The AVGuard Service is starting.
10/11/2005,16:12:43 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,16:12:45 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,16:12:45 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa1a4f.
10/11/2005,16:13:10 [INFO] Start Filter Device.
10/11/2005,16:13:10 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,16:13:10 AVGuard has been started successfully!
10/11/2005,18:36:22 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
10/11/2005,18:38:58 [INFO] Stop Filter Device.
10/11/2005,18:39:50 ---------------------------------------------------------
10/11/2005,18:39:50 [INIT] The AVGuard Service is starting.
10/11/2005,18:39:55 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,18:40:02 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,18:40:03 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa0d91.
10/11/2005,18:40:20 [INFO] Start Filter Device.
10/11/2005,18:40:20 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,18:40:20 AVGuard has been started successfully!
10/11/2005,20:31:18 [INFO] Stop Filter Device.
10/11/2005,20:31:18 AVGuard service has been stopped!
10/11/2005,20:32:06 ---------------------------------------------------------
10/11/2005,20:32:06 [INIT] The AVGuard Service is starting.
10/11/2005,20:32:09 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
10/11/2005,20:32:11 [LOGON] Connection request by remote computer. Establishing secure communication channel.
10/11/2005,20:32:11 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa27de.
10/11/2005,20:32:21 [INFO] Start Filter Device.
10/11/2005,20:32:21 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.14.17
10/11/2005,20:32:21 AVGuard has been started successfully!
11/11/2005,05:21:59 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
11/11/2005,03:08:41 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\FTPUPD.EXE
File has been moved to quarantine directory!
11/11/2005,14:59:32 [INFO] Stop Filter Device.
11/11/2005,14:59:33 AVGuard service has been stopped!
11/11/2005,14:59:36 ---------------------------------------------------------
11/11/2005,14:59:36 [INIT] The AVGuard Service is starting.
11/11/2005,14:59:38 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
11/11/2005,14:59:38 [LOGON] Connection request by remote computer. Establishing secure communication channel.
11/11/2005,14:59:39 [INFO] Start Filter Device.
11/11/2005,14:59:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
11/11/2005,14:59:39 AVGuard has been started successfully!
11/11/2005,14:59:39 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xa95cdc92.
11/11/2005,15:26:33 [INFO] Stop Filter Device.
11/11/2005,15:26:35 AVGuard service has been stopped!
13/11/2005,23:55:15 ---------------------------------------------------------
13/11/2005,23:55:15 [INIT] The AVGuard Service is starting.
13/11/2005,23:55:20 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
13/11/2005,23:55:22 [LOGON] Connection request by remote computer. Establishing secure communication channel.
13/11/2005,23:55:22 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3bcd.
13/11/2005,23:55:27 [INFO] Start Filter Device.
13/11/2005,23:55:27 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
13/11/2005,23:55:27 AVGuard has been started successfully!
13/11/2005,23:59:14 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been deleted!
14/11/2005,00:13:42 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
File has been deleted!
14/11/2005,00:57:32 [INFO] Stop Filter Device.
14/11/2005,00:57:32 AVGuard service has been stopped!
14/11/2005,10:10:25 ---------------------------------------------------------
14/11/2005,10:10:25 [INIT] The AVGuard Service is starting.
14/11/2005,10:10:29 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
14/11/2005,10:10:32 [LOGON] Connection request by remote computer. Establishing secure communication channel.
14/11/2005,10:10:33 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa25ae.
14/11/2005,10:10:39 [INFO] Start Filter Device.
14/11/2005,10:10:39 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.15.16
14/11/2005,10:10:39 AVGuard has been started successfully!
14/11/2005,11:16:43 WARNING: Contains signature of the worm WORM/Lovsan.F.2!
C:\WINDOWS\SYSTEM32\TFTP736
File has been deleted!
14/11/2005,11:23:24 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[1].EXE
File has been deleted!
14/11/2005,11:24:05 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[2].EXE
File has been deleted!
14/11/2005,11:24:08 WARNING: Contains signature of the worm WORM/Korgo.U!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\KK8HRWHU\X[3].EXE
File has been deleted!
-------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 11:33:19, on 14/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AVPersonal\AVSched32.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Documents and Settings\Moi\Local Settings\Temporary Internet Files\Content.IE5\M1RHG5T7\FixBlast[1].exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Moi\Mes documents\outils\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.203.15.25:808
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Barre d'outils Texto Web - {4E7BD74F-2B8D-469E-C0FF-FD63A08DBF29} - C:\WINDOWS\DOWNLO~1\textobar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A8D59CC-9BFC-44D8-9578-F2D9C7D09269}: NameServer = 10.200.1.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
merci de me donner qq conseils pour eviter cela...
01/11/2005,23:18:38 [INFO] Stop Filter Device.
01/11/2005,23:18:41 AVGuard service has been stopped!
02/11/2005,07:50:22 ---------------------------------------------------------
02/11/2005,07:50:22 [INIT] The AVGuard Service is starting.
02/11/2005,07:50:27 [INIT] Keyfile contains a valid license. The AVGuard service will run as a fully functional version!
02/11/2005,07:50:29 [LOGON] Connection request by remote computer. Establishing secure communication channel.
02/11/2005,07:50:29 [LOGON] Connection to computer 127.0.0.1 established successfully. Session ID = 0xaaaa3e1a.
02/11/2005,07:51:10 [INFO] Start Filter Device.
02/11/2005,07:51:10 AntiVirService Version: 6.32.00.12 AVE Version 6.32.0.57 VDF Version: 6.32.0.127
02/11/2005,07:51:10 AVGuard has been started successfully!
02/11/2005,07:51:46 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:57 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:56 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:56 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:54 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:28 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
02/11/2005,07:52:01 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:00 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:00 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:51:59 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:04 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:15 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:14 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:14 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:17 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:18 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:20 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:20 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:20 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:20 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:23 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:34 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:23 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:23 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:22 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:42 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:52:56 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:53:02 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE
02/11/2005,07:54:47 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[2]
02/11/2005,07:55:13 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[3]
02/11/2005,07:55:18 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[5]
02/11/2005,07:55:22 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[6]
02/11/2005,07:55:24 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[7]
02/11/2005,07:55:26 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[8]
02/11/2005,07:55:28 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[9]
02/11/2005,07:55:30 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\D4EBCZJG\XXXXXXXXX[10]
02/11/2005,07:55:32 WARNING: Contains signature of the worm WORM/Padobot.Z.8!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\MTX8V9OB\XXXXXXXXX[3]
02/11/2005,07:55:45 WARNING: Is the Trojan horse TR/Qhost.AA!
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
02/11/2005,07:59:40 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\NETHELL.EXE
02/11/2005,07:59:44 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE.VIR
02/11/2005,07:59:46 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\BINGOO.EXE
02/11/2005,07:59:46 WARNING: Contains signature of the worm WORM/Mytob.KV!
C:\WINDOWS\SYSTEM32\TASKGMR.EXE