ordinateur infecté par win32 skynet Résolu/Fermé

Question

bonjour à tous
mon ordinateur est infecté par plusieurs virus dont win32synet dont je n'arrive pas à me débarasser avec karspersky
j'ai suivi la méthode préliminaire de désinfection et ai récupérré les rapports mais ceux ci ne rentrent pas dans ces messages
je vous remercie de venir à mon aide, je suis perdu

did71 · Answer

Bonsoir,

télécharge HijackThis:

http://pchelpbordeaux.free.fr/logiciels.html

Tutorial:

http://pchelpbordeaux.free.fr/tuto.html

Démo en image:

http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Fais un scan et poste l'analyse.

a+

regisabine · Answer

*BitDefender Online Scanner - Real Time Virus Report* Generated at: Sat, Feb 24, 2007 - 10:00:19 ------------------------------------------------------------------------ *Scan Info* Scanned Files 374748 Infected Files 584 * * *Virus Detected* Win32.Bagle.M@mm 2 Win32.Bagle.BA@mm 4 Win32.Mydoom.L@mm 20 Win32.Worm.Mytob.BT 1 Win32.Worm.Mytob.BC 1 Trojan.Bagle.BK 4 Win32.Worm.Mytob.BD 2 Win32.Netsky.C@mm.Dam 1 Win32.Bagle.CM@mm 2 Win32.Sober.K@mm 7 MemScan:Win32.Bagle.BA@mm 1 Win32.Netsky.C@mm.Damaged 31 Win32.Bagle.AY@mm 1 Exploit.Iframe.Vulnerability.B 36 Win32.NetSky.AA@mm.dam 14 Win32.Bagle.AG@mm 1 Win32.Netsky.D@mm 231 Win32.Netsky.C@mm 37 Win32.Netsky.B@mm 3 Win32.Bagle.BV@mm 1 Win32.Netsky.AA@mm 56 Win32.Worm.Bagle.FJ 32 Win32.Netsky.P@mm 96 ------------------------------------------------------------------------ This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world. 
Logfile of HijackThis v1.99.1
Scan saved at 20:13:48, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

regisabine · Answer

Logfile of HijackThis v1.99.1
Scan saved at 20:41:33, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

did71 · Answer

re,

peux tu renommer hijackthis.exe en scanner.exe, repasser le scan et poster le rapport de scanner.exe!

a+

regisabine · Answer

j'espere que ma manip est la bonne

j'ai fais aussi un scan avec ccleaner mais le rapport est énorme (23400 détectés dont surtout des cookies mais ...)


Logfile of HijackThis v1.99.1
Scan saved at 20:47:29, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

did71 · Answer

re,

renomme hijackthis.exe en scanner.exe comme je te l'ai demandé plus haut!

a+

regisabine · Answer

resalut
j'espere que c'est mieux:


Logfile of HijackThis v1.99.1
Scan saved at 21:13:38, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

merci de ton aide

did71 · Answer

* Télécharge VundoFix.exe (par Atribune) sur ton Bureau:

http://www.atribune.org/public-beta/VundoFix.exe

* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

a+

regisabine · Answer

resalut

remove vundo a affiché "no files were found, vundofix v6.3.9 will now close"

et hijackthis donne:

Logfile of HijackThis v1.99.1
Scan saved at 21:34:36, on 24/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

a+
merci

did71 · Answer

re,

Télécharge AVG Anti-Spyware: 


https://www.avg.com/en-ww/free-antivirus-download 


Tu l'installes. 
Lance AVG Anti-Spyware et clique sur le bouton Mise à jour. Patiente 

Lance AVG Anti-Spyware 
Clique sur le bouton Analyse (de la barre d'outils) 
Puis sur l'onglets Comment réagir, clique sur Actions recommandées. Sélectionne Quarantaine. 
Reviens à l'onglet Analyse. Clique sur Analyse complète du système. 
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas. 
Clique sur "Enregistrer le rapport". Ceci génère un rapport en fichier texte qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware. 

poste le rapport AVG! 

a+

did71 · Answer

Bonsoir Albert,

je me pose justement la question, j'ai installé la version française pour essayer, je l'ai renommé (sans problème) mais je ne sais pas si ça change quelque chose au rapport hijackthis!

le nom reste le même VERSION TRADUITE ORIGINALE.EXE, mais les rapports donne quoi?

ici, pas de vundo, j'ai quand même lancé l'outil!

a+

regisabine · Answer

rebonsoir

pas tout compris sur message précédent  : ))


ni sur :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	22:46:38 24/02/2007

 + Résultat de l'analyse:	



	Rien à signaler.



Fin du rapport

did71 · Answer

re,

le message précedent était destiné à afideg!

Télécharge Blacklight (de F-Secure), sauvegarde le sur ton Bureau: 

https://europe.f-secure.com/exclude/blacklight/index.shtml 

Double-clique blbeta.exe et accepte la licence ;clique Scan puis Next 

Tu verras une liste de fichiers détectés apparaître. Tu verras également un rapport, sur ton Bureau, nommé fsbl.xxxxxxx.log (les xxxxxxx sont des chiffres). 

Copie et colle le contenu de ce rapport dans ta prochaine réponse!

a+

regisabine · Answer

resalut

voici le rapport demandé :

02/24/07 23:03:56 [Info]: BlackLight Engine 1.0.55 initialized
02/24/07 23:03:56 [Info]: OS: 5.1 build 2600 (Service Pack 2)
02/24/07 23:03:56 [Note]: 7019 4
02/24/07 23:03:56 [Note]: 7005 0
02/24/07 23:04:00 [Note]: 7006 0
02/24/07 23:04:00 [Note]: 7011 924
02/24/07 23:04:00 [Note]: 7026 0
02/24/07 23:04:00 [Note]: 7026 0
02/24/07 23:04:20 [Note]: FSRAW library version 1.7.1021
02/24/07 23:07:11 [Note]: 2000 1012
02/24/07 23:13:27 [Note]: 7007 0

encore merci pour ta patience

did71 · Answer

re,

aucun des outils ne détecte une infection!

Étape 1: 
Télécharge eScan Antivirus Toolkit ici: 

http://www.spywareinfo.dk/download/mwav.exe 

Sauvegarde-le sur ton Bureau. 
Avant de lancer le programme, il faut le mettre à jour tel qu'indiqué à l'étape 2. 

Étape 2: 
Voici comment mettre l'outil à jour : 

1.) Double-clique le fichier mwav.exe qui se trouve sur le Bureau ; dézippe les fichiers dans le nouveau dossier suggéré (C:\Kaspersky). Le programme va se lancer, et tu dois le quitter (clique sur "Exit" puis "Exit"). 

2.) Double-clique sur le Poste de travail, puis double-clique sur le lecteur principal (habituellement C:\), double-clique sur le dossier Kaspersky ; ensuite, double-clique sur le fichier kavupd.exe. Tu verras maintenant une fenêtre DOS apparaître, et la mise à jour se complètera en quelques minutes. 

3.) Lorsque la mise à jour sera complétée, tu verras "Press any key to continue" ; tape sur une clé pour continuer. Deux nouveaux répertoires (dossiers) ont été créés lors de la mise à jour (C:\Bases et C:\Downloads). 

4.) Sélectionne/copie tous les fichiers présents dans le dossier C:\Downloads, puis colle-les dans le dossier C:\Kaspersky. Accepte à l'invite de remplacer les fichiers existants. 

Ne pas lancer le scan tout de suite ! 

Étape 3: 
Redémarre en mode Sans Échec : 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisi la première option : Sans Échec, et valide avec "Entrée" 
5) Choisi ton compte régulier, et non Administrateur 


Étape 4: 
Du mode Sans Échec, voici comment utiliser le programme : 

1.) Pour lancer "eScan Antivirus Toolkit", trouve le fichier mwavscan.com situé dans le dossier C:\Kaspersky 

2.) Double-clique sur mwavscan.com ; l'interface d'eScan va apparaître à l'écran. 

3.) Il est très important de bien cocher ces boîtes sous Scan Option : Memory, Registry, Startup Folders, System Folders, Services. 

4.) Coche la boîte Drive, ce qui donne accès à une nouvelle boîte Drive (bouton rond) juste dessous ; coche ce bouton "Drive" (très important..), et tu verras une nouvelle boîte de navigation apparaître à la droite. Clique sur la petite flèche de cette boîte and choisi la lettre de ton disque dur, habituellement C:\. 

5.) Juste au-dessous, assure-toi que Scan All Files est coché, et non Program Files. 

6.) Clique sur Scan Clean et laisse le tool vérifier tout le disque dur (ça peut être long..). Lorsque terminé, tu verras Scan Completed. Ne pas quitter tout de suite ! 

7.) Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" >> "Programmes" >>"Accessoires" >> "Bloc notes"), puis copie/colle tout le contenu de la fenêtre Virus Log Information (la deuxième, au bas) dans le fichier texte, et sauvegarde le. eScan génère également un rapport complet dans le dossier C:\Kaspersky (nommé mwav.log), mais il est trop lourd pour poster sur le forum. 

Ferme le programme. Redémarre ton PC en mode Normal. Poste (copie/colle) le rapport que tu as sauvegardé dans ta prochaine réponse.

a+

regisabine · Answer

bonjour
désolé d'avoir tardé
j'ai eu pas mal de difficulté hier soir à faire la manip 
j'ai enfin réussi mais le copié collé sur escan ne marchait pas ni non plus en glissant.
j'ai donc pris des passages dans le mwav.log qui me paraissaient les plus significatifs.

voila donc ce rapport où j'espere que vous trouverez les infos nécéssaires :

Sun Feb 25 00:34:00 2007 => **********************************************************
Sun Feb 25 00:34:00 2007 => eScan AntiVirus Toolkit Utility.
Sun Feb 25 00:34:00 2007 => Copyright © 2003-2004,  MicroWorld Technologies Inc.
Sun Feb 25 00:34:00 2007 => **********************************************************
Sun Feb 25 00:34:00 2007 => Version 4.4.7
Sun Feb 25 00:34:00 2007 => Log File: C:\KASPER~1\mwav.log
Sun Feb 25 00:34:00 2007 => Database Path in KL Key: C:\Program Files\Fichiers communs\KAV Shared Files\Bases.
Sun Feb 25 00:34:01 2007 => Latest Date of files in KL key: 23 Feb 2007  14:31:57.
Sun Feb 25 00:34:04 2007 => Latest Date of files inside MWAV: 25 Feb 2007  00:57:08.
Sun Feb 25 00:34:09 2007 => AV Library Loaded...
Sun Feb 25 00:34:09 2007 => Scanning File C:\KASPER~1\kavss.exe
Sun Feb 25 00:34:09 2007 => Scanning File C:\KASPER~1\Getvlist.exe
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\kavss.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\kavssdi.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\kavssi.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\kavvlg.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\msvlclnt.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\ipc.dll
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\main.avi
Sun Feb 25 00:34:10 2007 => Scanning File C:\KASPER~1\virus.avi
Sun Feb 25 00:34:10 2007 => Virus Database Date: 2007/02/25
Sun Feb 25 00:34:10 2007 => Virus Database Count: 273142
 
Sun Feb 25 00:36:10 2007 => **********************************************************
Sun Feb 25 00:36:10 2007 => eScan AntiVirus Toolkit Utility.
Sun Feb 25 00:36:10 2007 => Copyright © 2003-2004,  MicroWorld Technologies Inc.
Sun Feb 25 00:36:10 2007 => 
Sun Feb 25 00:36:10 2007 => Support: support@mwti.net
Sun Feb 25 00:36:10 2007 => Web: https://www.escanav.com/en/index.asp
Sun Feb 25 00:36:10 2007 => **********************************************************
Sun Feb 25 00:36:10 2007 => Version 4.4.7
Sun Feb 25 00:36:10 2007 => Log File: C:\KASPER~1\mwav.log
Sun Feb 25 00:36:10 2007 => Database Path in KL Key: C:\Program Files\Fichiers communs\KAV Shared Files\Bases.
Sun Feb 25 00:36:10 2007 => Latest Date of files in KL key: 23 Feb 2007  14:31:57.
Sun Feb 25 00:36:10 2007 => Latest Date of files inside MWAV: 25 Feb 2007  00:57:08.
 
Sun Feb 25 00:36:10 2007 => Options Selected by User:
Sun Feb 25 00:36:10 2007 => Memory Check: Enabled
Sun Feb 25 00:36:10 2007 => Registry Check: Enabled
Sun Feb 25 00:36:10 2007 => StartUp Folder Check: Enabled
Sun Feb 25 00:36:10 2007 => System Folder Check: Enabled
Sun Feb 25 00:36:10 2007 => System Area Check: Disabled
Sun Feb 25 00:36:10 2007 => Services Check: Enabled
Sun Feb 25 00:36:10 2007 => Drive Check: Enabled
Sun Feb 25 00:36:10 2007 => All Drive Check :Disabled
Sun Feb 25 00:36:10 2007 => Scanning Type: Scan And Clean
Sun Feb 25 00:36:10 2007 => Drive Selected = C:\
Sun Feb 25 00:36:10 2007 => Folder Check: Disabled
 





Sun Feb 25 01:09:15 2007 => Scanning File C:\Program Files\NetMeeting\TestSnd.wav
Sun Feb 25 01:09:15 2007 => Scanning File C:\Program Files\NetMeeting\wb32.exe
Sun Feb 25 01:09:15 2007 => Scanning Folder: C:\Program Files\Norton SystemWorks\*.*
Sun Feb 25 01:09:15 2007 => Scanning Folder: C:\Program Files\Norton SystemWorks\Norton AntiVirus\*.*
Sun Feb 25 01:09:16 2007 => Scanning Folder: C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\*.*
Sun Feb 25 01:09:16 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\00D962C8.tmp
Sun Feb 25 01:09:16 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\00D962C8.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:16 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01422255.tmp
Sun Feb 25 01:09:16 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01422255.tmp infected by "Email-Worm.Win32.NetSky.c" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:16 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01836A0D.tmp
Sun Feb 25 01:09:16 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01836A0D.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01B709D3.tmp
Sun Feb 25 01:09:17 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01B709D3.tmp infected by "Email-Worm.Win32.NetSky.b" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01C431C5.tmp
Sun Feb 25 01:09:17 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01C431C5.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\01E87F9D.tmp
Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\023851D0.tmp
Sun Feb 25 01:09:17 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\023851D0.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\061A5540.tmp
Sun Feb 25 01:09:17 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\061A5540.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:17 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\08767713.tmp
Sun Feb 25 01:09:18 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\08767713.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:18 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\09D84D8E.tmp
Sun Feb 25 01:09:18 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\09D84D8E.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:18 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E5E7D38.tmp
Sun Feb 25 01:09:18 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E5E7D38.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:18 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E9432F9.tmp
Sun Feb 25 01:09:18 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E9432F9.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:18 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E9E30EE.tmp
Sun Feb 25 01:09:19 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0E9E30EE.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0EA15AEA.tmp
Sun Feb 25 01:09:19 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0EA15AEA.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F0F5876.tmp
Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F1C0067.tmp
Sun Feb 25 01:09:19 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F1C0067.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F1F2A64.tmp
Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F292859.tmp
Sun Feb 25 01:09:19 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F292859.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:19 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F2C5255.tmp
Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F2F7C52.tmp
Sun Feb 25 01:09:20 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F2F7C52.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F33264E.tmp
Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F562DEA.tmp
Sun Feb 25 01:09:20 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F562DEA.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F814FBB.tmp
Sun Feb 25 01:09:20 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F814FBB.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0F944BA6.tmp
Sun Feb 25 01:09:20 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0FA27398.tmp
Sun Feb 25 01:09:21 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\0FA27398.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:21 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\16C87996.tmp
Sun Feb 25 01:09:21 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\16C87996.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:21 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1789473F.tmp
Sun Feb 25 01:09:21 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1789473F.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:21 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\190311BB.tmp
Sun Feb 25 01:09:21 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\190311BB.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:21 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\191039AD.tmp
Sun Feb 25 01:09:22 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\191039AD.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:22 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1AF77BF6.tmp
Sun Feb 25 01:09:22 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1AF77BF6.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:22 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C7B3A62.tmp
Sun Feb 25 01:09:22 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C7B3A62.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:22 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C9F0B05.tmp
Sun Feb 25 01:09:22 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1C9F0B05.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:22 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1CC92CD6.tmp
Sun Feb 25 01:09:22 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1CE052BD.tmp
Sun Feb 25 01:09:23 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1CE052BD.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:23 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1CE726B6.tmp
Sun Feb 25 01:09:23 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D017699.tmp
Sun Feb 25 01:09:23 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D074A92.tmp
Sun Feb 25 01:09:23 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D074A92.tmp infected by "Email-Worm.Win32.NetSky.c" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:23 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D114887.tmp
Sun Feb 25 01:09:23 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D114887.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:23 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D1E7079.tmp
Sun Feb 25 01:09:24 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D1E7079.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:24 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D286E6E.tmp
Sun Feb 25 01:09:24 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D286E6E.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:24 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D2E4267.tmp
Sun Feb 25 01:09:24 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D2E4267.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:24 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D596438.tmp
Sun Feb 25 01:09:24 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D596438.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:24 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D693626.tmp
Sun Feb 25 01:09:24 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8220B6.tmp
Sun Feb 25 01:09:25 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8220B6.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:25 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8874AF.tmp
Sun Feb 25 01:09:25 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8874AF.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:25 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8F48A8.tmp
Sun Feb 25 01:09:25 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1D8F48A8.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:25 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1DE5719D.tmp
Sun Feb 25 01:09:25 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1DE5719D.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:25 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1DF2198F.tmp
Sun Feb 25 01:09:25 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E036B7D.tmp
Sun Feb 25 01:09:26 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E036B7D.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E133D6B.tmp
Sun Feb 25 01:09:26 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E133D6B.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E273956.tmp
Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E30374B.tmp
Sun Feb 25 01:09:26 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E30374B.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E3A3540.tmp
Sun Feb 25 01:09:26 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E3A3540.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E4A072E.tmp
Sun Feb 25 01:09:26 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E540523.tmp
Sun Feb 25 01:09:27 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E540523.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:27 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E612D15.tmp
Sun Feb 25 01:09:27 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E6B2B0A.tmp
Sun Feb 25 01:09:27 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E6B2B0A.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:27 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E727F03.tmp
Sun Feb 25 01:09:27 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E727F03.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:27 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E7B7CF8.tmp
Sun Feb 25 01:09:27 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E7B7CF8.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:27 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E857AED.tmp
Sun Feb 25 01:09:28 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E857AED.tmp infected by "Email-Worm.Win32.NetSky.c" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:28 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E8C4EE6.tmp
Sun Feb 25 01:09:28 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E8C4EE6.tmp infected by "Email-Worm.Win32.NetSky.c" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:28 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E9222DF.tmp
Sun Feb 25 01:09:28 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\1E9222DF.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:28 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20A349DB.tmp
Sun Feb 25 01:09:28 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20A349DB.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:28 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20B31BC9.tmp
Sun Feb 25 01:09:29 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20B31BC9.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:29 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20E16796.tmp
Sun Feb 25 01:09:29 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\20E16796.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:29 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\240667D5.tmp
Sun Feb 25 01:09:29 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\240667D5.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:29 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24306E17.tmp
Sun Feb 25 01:09:29 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24306E17.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:29 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24404005.tmp
Sun Feb 25 01:09:30 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24404005.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:30 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24543BEF.tmp
Sun Feb 25 01:09:30 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24543BEF.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:30 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\246163E1.tmp
Sun Feb 25 01:09:30 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\246163E1.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:30 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\246A61D6.tmp
Sun Feb 25 01:09:31 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\246A61D6.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:31 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24745FCB.tmp
Sun Feb 25 01:09:31 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24745FCB.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:31 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\247B33C4.tmp
Sun Feb 25 01:09:31 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\247B33C4.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:31 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24982DA4.tmp
Sun Feb 25 01:09:31 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24982DA4.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:31 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24D635CD
Sun Feb 25 01:09:34 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\24D635CD infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:34 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\28540D80.tmp
Sun Feb 25 01:09:34 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\28540D80.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:34 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29B34941.tmp
Sun Feb 25 01:09:35 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29B34941.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:35 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C07132.tmp
Sun Feb 25 01:09:35 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C07132.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:35 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C31B2F.tmp
Sun Feb 25 01:09:35 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C31B2F.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:35 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C6452B.tmp
Sun Feb 25 01:09:35 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C6452B.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:35 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C74013.tmp
Sun Feb 25 01:09:35 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29C74013.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:35 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29D13E08.tmp
Sun Feb 25 01:09:36 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\29D13E08.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:36 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2AB46685.tmp
Sun Feb 25 01:09:36 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2AB46685.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:36 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2DC87D4B.tmp
Sun Feb 25 01:09:36 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2DC87D4B.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:36 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2E171287.tmp
Sun Feb 25 01:09:36 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2E171287.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:36 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F7375C0.tmp
Sun Feb 25 01:09:37 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\2F7375C0.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:37 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\31235A6D
Sun Feb 25 01:09:37 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\31235A6D infected by "Email-Worm.Win32.Bagle.cs" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:37 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\317C480C
Sun Feb 25 01:09:37 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\317C480C infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:37 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35951E5A.tmp
Sun Feb 25 01:09:38 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35951E5A.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:38 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35984856.tmp
Sun Feb 25 01:09:38 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\35984856.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:38 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\359C7253.tmp
Sun Feb 25 01:09:38 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\359C7253.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:38 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\36AA5A7C.tmp
Sun Feb 25 01:09:39 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\36AA5A7C.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:39 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\37462DA9.tmp
Sun Feb 25 01:09:39 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\392C2A0F.tmp
Sun Feb 25 01:09:39 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\392C2A0F.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:39 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\39337E08.tmp
Sun Feb 25 01:09:39 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\39337E08.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:39 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3A846373
Sun Feb 25 01:09:42 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3A846373 infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:42 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3A9004A1
Sun Feb 25 01:09:42 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3A9004A1 infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:42 2007 => *** File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3D3F5668 having Size Restriction ***
Sun Feb 25 01:09:42 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\3D3F5668 [**]
Sun Feb 25 01:09:42 2007 => *** File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\40CA507A having Size Restriction ***
Sun Feb 25 01:09:42 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\40CA507A [**]
Sun Feb 25 01:09:42 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\42A956C2.tmp
Sun Feb 25 01:09:42 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43A63ECE.tmp
Sun Feb 25 01:09:43 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43A63ECE.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:43 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43CF69BE.tmp
Sun Feb 25 01:09:43 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43CF69BE.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:43 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43DB4DC1.tmp
Sun Feb 25 01:09:43 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\43DB4DC1.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:43 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44AA0FE8.tmp
Sun Feb 25 01:09:44 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44AA0FE8.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:44 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44C71CBE.tmp
Sun Feb 25 01:09:44 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44C71CBE.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:44 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44E4169E.tmp
Sun Feb 25 01:09:44 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44E4169E.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:44 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44E82B81.tmp
Sun Feb 25 01:09:44 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44E82B81.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:44 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\44FF5168.tmp
Sun Feb 25 01:09:45 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\47FF150E
Sun Feb 25 01:09:45 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\47FF150E infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:45 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48007D53.tmp
Sun Feb 25 01:09:45 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48007D53.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:45 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48081303
Sun Feb 25 01:09:46 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48081303 infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:46 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48287528.tmp
Sun Feb 25 01:09:46 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48287528.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:46 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\482E4921.tmp
Sun Feb 25 01:09:46 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\482E4921.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:46 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48351D1A.tmp
Sun Feb 25 01:09:46 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48351D1A.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:46 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\483B7112.tmp
Sun Feb 25 01:09:47 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\483B7112.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:47 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4842450B.tmp
Sun Feb 25 01:09:47 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4842450B.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:47 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\484B4300.tmp
Sun Feb 25 01:09:47 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\484B4300.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:47 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485216F9.tmp
Sun Feb 25 01:09:47 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485216F9.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:47 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485540F6.tmp
Sun Feb 25 01:09:47 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\485540F6.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:47 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48693CE0.tmp
Sun Feb 25 01:09:48 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\48693CE0.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4CE2689E.tmp
Sun Feb 25 01:09:48 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4CE2689E.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D135E68.tmp
Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D243056.tmp
Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D2A044F.tmp
Sun Feb 25 01:09:48 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D2A044F.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D315848.tmp
Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D3E003A.tmp
Sun Feb 25 01:09:48 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D3E003A.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:48 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D445433.tmp
Sun Feb 25 01:09:49 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D445433.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:49 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D4B282B.tmp
Sun Feb 25 01:09:49 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D4B282B.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:49 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D552621.tmp
Sun Feb 25 01:09:49 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D552621.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:49 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D5B7A19.tmp
Sun Feb 25 01:09:50 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D5B7A19.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D624E12.tmp
Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D722000.tmp
Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D7C1DF5.tmp
Sun Feb 25 01:09:50 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D7C1DF5.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D8945E7.tmp
Sun Feb 25 01:09:50 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D8945E7.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D8F19E0.tmp
Sun Feb 25 01:09:50 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D9343DC.tmp
Sun Feb 25 01:09:51 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4D9343DC.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:51 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DA315CA.tmp
Sun Feb 25 01:09:51 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DA315CA.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:51 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DAA69C3.tmp
Sun Feb 25 01:09:51 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DAA69C3.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:51 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DB711B5.tmp
Sun Feb 25 01:09:51 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\4DB711B5.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:51 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50890F49.tmp
Sun Feb 25 01:09:52 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50890F49.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\509C0B34.tmp
Sun Feb 25 01:09:52 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\509C0B34.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50AD5D22.tmp
Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50CE020E.tmp
Sun Feb 25 01:09:52 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50CE020E.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50EF25EA.tmp
Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50F578D3.tmp
Sun Feb 25 01:09:52 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\50F578D3.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\510220C4.tmp
Sun Feb 25 01:09:52 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\510B1EBA.tmp
Sun Feb 25 01:09:53 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\510B1EBA.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51266E9D.tmp
Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51843035.tmp
Sun Feb 25 01:09:53 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51843035.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\519E0018.tmp
Sun Feb 25 01:09:53 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\519E0018.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51B27C02.tmp
Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51ED6FC2.tmp
Sun Feb 25 01:09:53 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51ED6FC2.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:53 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\51FD41B0.tmp
Sun Feb 25 01:09:54 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\522A3FB7.tmp
Sun Feb 25 01:09:54 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\522A3FB7.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:54 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\52343DAC.tmp
Sun Feb 25 01:09:54 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\52343DAC.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:54 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\534F6FF6.tmp
Sun Feb 25 01:09:55 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\534F6FF6.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\53E74B16.tmp
Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\53F47308.tmp
Sun Feb 25 01:09:55 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\53F47308.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:55 2007 => *** File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\55E9225F having Size Restriction ***
Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\55E9225F [**]
Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56B67E31.tmp
Sun Feb 25 01:09:55 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56B67E31.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56C6501F.tmp
Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56EA1DF8.tmp
Sun Feb 25 01:09:55 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56EA1DF8.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56ED47F4.tmp
Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56F745E9.tmp
Sun Feb 25 01:09:55 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56F745E9.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:55 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\56FA6FE6.tmp
Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\58EA1E05.tmp
Sun Feb 25 01:09:56 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\58EA1E05.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\58FA6FF3.tmp
Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\590D6BDD.tmp
Sun Feb 25 01:09:56 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\590D6BDD.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\591769D3.tmp
Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\592167C8.tmp
Sun Feb 25 01:09:56 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\592167C8.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59283BC1.tmp
Sun Feb 25 01:09:56 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\593E61A7.tmp
Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\594B0999.tmp
Sun Feb 25 01:09:57 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\594B0999.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5959318B.tmp
Sun Feb 25 01:09:57 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5959318B.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\595C5B87.tmp
Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59622F80.tmp
Sun Feb 25 01:09:57 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59622F80.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5966597C.tmp
Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59690379.tmp
Sun Feb 25 01:09:57 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59690379.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:57 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\596C2D75.tmp
Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59762B6A.tmp
Sun Feb 25 01:09:58 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59762B6A.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59795567.tmp
Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5983535C.tmp
Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59A47738.tmp
Sun Feb 25 01:09:58 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59A47738.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59B11F2A.tmp
Sun Feb 25 01:09:58 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59B11F2A.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59B77322.tmp
Sun Feb 25 01:09:58 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59B77322.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:58 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59BE471B.tmp
Sun Feb 25 01:09:59 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59BE471B.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:59 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59C17118.tmp
Sun Feb 25 01:09:59 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59CB6F0D.tmp
Sun Feb 25 01:09:59 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59CB6F0D.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:09:59 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59D14306.tmp
Sun Feb 25 01:09:59 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59D14306.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:09:59 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59D56D02.tmp
Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DA0001.tmp
Sun Feb 25 01:10:00 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DA0001.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DB40FB.tmp
Sun Feb 25 01:10:00 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DB40FB.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59DE6AF7.tmp
Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59E53EF0.tmp
Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59EF3CE5.tmp
Sun Feb 25 01:10:00 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\59EF3CE5.tmp infected by "Exploit.HTML.Iframe.FileDownload" Virus. Action Taken: File Renamed.

Sun Feb 25 01:10:00 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A144051.tmp
Sun Feb 25 01:10:01 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A144051.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:01 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A3C6B95.tmp
Sun Feb 25 01:10:01 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A3C6B95.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:01 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5A912F37.tmp
Sun Feb 25 01:10:01 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5ADC74E5.tmp
Sun Feb 25 01:10:01 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5ADC74E5.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:01 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B72003F.tmp
Sun Feb 25 01:10:01 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B72003F.tmp infected by "Email-Worm.Win32.NetSky.d" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:01 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7453D9.tmp
Sun Feb 25 01:10:02 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7453D9.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:02 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B777DD6.tmp
Sun Feb 25 01:10:02 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B777DD6.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:02 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7A27D2.tmp
Sun Feb 25 01:10:02 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7A27D2.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:02 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7E51CE.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B7E51CE.tmp infected by "Email-Worm.Win32.NetSky.q" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B892626.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5B892626.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5BC16FE9.tmp
Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5BD141D7.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5BD141D7.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C0C3597.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C0C3597.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C365768.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C365768.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C9F16F5.tmp
Sun Feb 25 01:10:03 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5C9F16F5.tmp infected by "Email-Worm.Win32.NetSky.aa" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:03 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5CA56AEE.tmp
Sun Feb 25 01:10:04 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D6A5C18.tmp
Sun Feb 25 01:10:04 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D6A5C18.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

Sun Feb 25 01:10:04 2007 => Scanning File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D6D0615.tmp
Sun Feb 25 01:10:04 2007 => File C:\Program Files\Norton SystemWorks\Norton AntiVirus\Quarantine\5D6D0615.tmp infected by "Email-Worm.Win32.Mydoom.l" Virus. Action Taken: File Deleted.

did71 · Answer

bonjour,

toutes les saletés sont contenues dans la quarantaine de norton, tu peux la vider!

Ensuite repasse le scan bitdefender en ligne et poste le rapport!

a+

regisabine · Answer

salut did
j'ai fais une erreur : j'ai ouvert une autre question avec le meme sujet et je m'en excuse aupres de toi qui m'a aidé depuis hier et aupres de tous les lecteurs.
je viens de lancer bitdefend
mais kaspersky en trouve toujours (testé ce matin) mais je ne suis pas arrivé à le lancer en mode sans échec
a+

did71 · Answer

Salut,

Pas grave, mais faut savoir que l'on a une vie en dehors de l'aide que l'on apporte sur les différents forums, je ne peux pas être 24h/24h devant mon PC!

j'attends le rapport bitdefender!

a+

regisabine · Answer

salut
désolé j'ai été long 
problème de déconnection adsl par free comme très souvent en soirée :((

voici le rapport

BitDefender Online Scanner
	

 
	

 

Scan report generated at: Mon, Feb 26, 2007 - 13:20:08

 
	

 
	

 

Scan path: A:\;C:\;D:\;E:\;F:\;
	

 
	

 

 
	

 
	

 

Statistics

Time
	

01:17:30

Files
	

365796

Folders
	

4047

Boot Sectors
	

3

Archives
	

19400

Packed Files
	

36086
	

 
	

 

Results

Identified Viruses
	

1

Infected Files
	

1

Suspect Files
	

0

Warnings
	

0

Disinfected
	

0

Deleted Files
	

1
	

 
	

 

Engines Info

Virus Definitions
	

393526

Engine build
	

AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

Scan plugins
	

14

Archive plugins
	

38

Unpack plugins
	

6

E-mail plugins
	

6

System plugins
	

1
	

 
	

 

Scan Settings

First Action
	

Disinfect

Second Action
	

Delete

Heuristics
	

Yes

Enable Warnings
	

Yes

Scanned Extensions
	

*;

Exclude Extensions
	

 

Scan Emails
	

Yes

Scan Archives
	

Yes

Scan Packed
	

Yes

Scan Files
	

Yes

Scan Boot
	

Yes
	

 
	

 
 

Scanned File
	

 Status

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected\Inbox=>(message 7)=>[Subject: moin][Date: Wed, 26 Jan 2005 17:59:28 +0100]=>(MIME part)=>(base64)=>archstored:nothing_old_photos.doc.com
	

Infected with: Win32.Netsky.C@mm.Damaged

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected\Inbox=>(message 7)=>[Subject: moin][Date: Wed, 26 Jan 2005 17:59:28 +0100]=>(MIME part)=>(base64)=>archstored:nothing_old_photos.doc.com
	

Disinfection failed

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected\Inbox=>(message 7)=>[Subject: moin][Date: Wed, 26 Jan 2005 17:59:28 +0100]=>(MIME part)=>(base64)=>archstored:nothing_old_photos.doc.com
	

Deleted

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Infected\Inbox=>(message 7)=>[Subject: moin][Date: Wed, 26 Jan 2005 17:59:28 +0100]=>(MIME part)=>(base64)
	

Update failed
	


pour info, j'ai relancé Karspersky AV control qui tourne en ce moment et qui a trouvé 95 occurences de virus
cela expliquerait le très net ralentissemnent de mon pc

 a+

did71 · Answer

Bonjour,

Pour le rapport bitdefender, c'est ok!

Faudra aussi virer la quarantaine de kaspersky!

tu utilises encore Norton?

Si oui, 2 antivirus foutent le bazard!

a+

did71 · Answer

re,

ce n'est pas très important ce sont des fichiers temporaires!

1) Télécharge ATF-Cleaner (par Atribune) de ce lien : 

http://www.atribune.org/ccount/click.php?id=1 

sauvegarde-le sur ton Bureau.

redémarre en mode sans échec!

Double-clique ATF-Cleaner.exe qui est sur le Bureau, afin de lancer le programme. 
Sous l'onglet Main, choisis : Select All 
Clique sur le bouton Empty Selected. Clique Ok, puis Exit

2) Télécharge clean.zip 

http://www2.malekal.com/download/clean.zip 

Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean. 
Ouvre le dossier Clean qui se trouve sur ton bureau. 
Double-clic sur clean.cmd. 
Une fenêtre noire va apparaître, choisis l'option 1. 

Poste le rapport qui se trouve ici C:\rapport_clean.txt 


a+

afideg · Answer

Bonsoir Did

Excuse-moi, mais :

Remarque: 

Si vous possédez Firefox ( ou Opera ) comme navigateur, pensez à choisir votre navigateur en haut à gauche avant de sélectionner " Unselect All" et "Empty Selected" 
Puis répondez "NON" au message qui s'affiche, si vous ne souhaitez pas perdre vos mots de passe. 

À faire en plus de "Main"

Al
;)

did71 · Answer

Salut Al, 

je ne l'ai pas spécifié, c'est exact!

je pense que l'utilisateur s'en rendra compte tout seul!

a+

regisabine · Answer

bonjour
je vous joint enfin le rapport demandé:

Rapport clean par Malekal_morte - http://www.malekal.com 
Option 1, executee le 27/02/2007 a 12:36:14,29 
 
*** Recherche de fichiers sur C: 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
"C:\Program Files\Viewpoint\" FOUND 
*** Fin du rapport ! 

a+

afideg · Answer

Salut regisabine 

OK

Surtout ne fais rien pour le moment avec "clean" !!

Attends le retour de Did71

Merci
Al

did71 · Answer

Bonjour regisabine, salut Al,

Télécharge le script "Silent Runners"

clic droit > "enregistrer sous" (et non pas clic gauche) sur le lien suivant :
https://www.silentrunners.org/Silent%20Runners.vbs
clique ensuite 2 fois sur "yes"
Laisse lui le temps de faire son analyse (compte une minute, montre en main)

poste le rapport généré qui se trouve dans le meme dossier que Silent Runners...

Si ton antivirus s'affole, autorise ce script. Ou au pire, désactive-le juste le temps du téléchargement et du scan. Ce script n'est pas dangereux. 

a+

afideg · Answer

Salut regisabine Pour tenter de faire avancer le topic , as-tu bien fait comme ceci : clic droit > sur le lien suivant : https://www.silentrunners.org/Silent%20Runners.vbs "enregistrer la cible sous" choisir le « bureau Double clic gauche sur l’icône SilentRunners.vbs du bureau [ouvrir] clic sur Yes puis sur OK ( clique ensuite 2 fois sur "yes" ) Laisse lui le temps de faire son analyse (compte une minute, montre en main) À la fin, tu obtiens ce message < http://img130.imageshack.us/img130/1323/screenshot247yd1.gif > poste le rapport généré " Startup Programs " qui se trouve dans le même dossier que Silent Runners... ( mais il est déjà sur ton bureau ainsi < http://img266.imageshack.us/img266/6684/screenshot248hr2.gif > Si ton antivirus s'affole, autorise ce script. Ou au pire, désactive-le juste le temps du téléchargement et du scan. Ce script n'est pas dangereux. Al.

did71 · Answer

bonsoir regisabine,Al,

Télécharge DiagHelp.zip sur ton bureau :

http://www.malekal.com/download/DiagHelp.zip

Ne double-clic pas dessus !! Fais un clic droit sur le fichier et extraire tout 
Un nouveau dossier chercher va être créé DiagHelp 
Ouvre le et double-clic sur go.cmd (le .cmd peut ne pas apparaître) 
Une fenêtre va s'ouvrir, choisis l'option 1 
 L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande!

poste le rapport ensuite!

a+

regisabine · Answer

bonsoir did71 voila le rapport : C:\WINDOWS\System32\d3d8caps.dat -->25/02/2007 00:57:51 C:\WINDOWS\System32\PerfStringBackup.INI -->24/02/2007 06:19:57 C:\WINDOWS\System32\perfh00C.dat -->24/02/2007 06:19:57 C:\WINDOWS\System32\perfh009.dat -->24/02/2007 06:19:57 C:\WINDOWS\System32\perfc00C.dat -->24/02/2007 06:19:57 C:\WINDOWS\System32\perfc009.dat -->24/02/2007 06:19:57 C:\WINDOWS\System32\wpa.dbl -->24/02/2007 06:12:47 C:\WINDOWS\System32\spupdwxp.log -->24/02/2007 06:10:24 C:\WINDOWS\System32\FNTCACHE.DAT -->24/02/2007 06:09:28 C:\WINDOWS\System32\vsconfig.xml -->01/12/2006 09:35:19 C:\WINDOWS\System32\fwapi.dll -->03/11/2006 18:21:02 C:\WINDOWS\System32\LuResult.txt -->31/10/2006 20:47:01 C:\WINDOWS\System32\QuickTimeVR.qtx -->25/10/2006 19:15:06 C:\WINDOWS\System32\QuickTime.qts -->25/10/2006 19:15:00 C:\WINDOWS\System32\GEARAspi.dll -->19/09/2006 15:43:58 C:\WINDOWS\System32\sirenacm.dll -->29/07/2006 19:32:50 C:\WINDOWS\System32\d3dx9_28.dll -->05/12/2005 18:09:18 C:\WINDOWS\System32\dxdllreg.exe -->05/12/2005 18:07:30 C:\WINDOWS\System32\divxdec.ax -->09/08/2005 23:14:00 C:\WINDOWS\System32\divxsm.tlb -->09/08/2005 23:13:59 C:\WINDOWS\System32\DivXsm.exe -->09/08/2005 23:13:59 C:\WINDOWS\System32\DivX.dll -->09/08/2005 23:13:59 C:\WINDOWS\System32\dsm_ja.qm -->09/08/2005 23:13:52 C:\WINDOWS\System32\dsm_fr.qm -->09/08/2005 23:13:52 C:\WINDOWS\System32\dsm_de.qm -->09/08/2005 23:13:52 C:\WINDOWS\0.log -->28/02/2007 15:04:31 C:\WINDOWS\wiadebug.log -->28/02/2007 15:03:47 C:\WINDOWS\WindowsUpdate.log -->28/02/2007 15:03:37 C:\WINDOWS\wiaservc.log -->28/02/2007 15:03:35 C:\WINDOWS\bootstat.dat -->28/02/2007 15:03:31 C:\WINDOWS\SchedLgU.Txt -->28/02/2007 07:47:14 C:\WINDOWS\wmsetup.log -->27/02/2007 15:41:50 C:\WINDOWS tbtlog.txt -->26/02/2007 20:59:15 C:\WINDOWS\setupapi.log -->24/02/2007 07:09:58 C:\WINDOWS\OEWABLog.txt -->24/02/2007 06:16:28 C:\WINDOWS\spupdsvc.log -->24/02/2007 06:14:30 C:\WINDOWS\DtcInstall.log -->24/02/2007 06:14:20 C:\WINDOWS\WMSysPr9.prx -->24/02/2007 06:13:37 C:\WINDOWS\iis6.log -->24/02/2007 06:12:53 C:\WINDOWS\comsetup.log -->24/02/2007 06:12:52 C:\WINDOWS\alcrmv.exe |23/01/2005 18:04:26 C:\WINDOWS\alcupd.exe |23/01/2005 18:04:26 C:\WINDOWS\bdoscandel.exe |25/05/2006 01:22:06 C:\WINDOWS\IsUn040c.exe |24/01/2005 15:29:37 C:\WINDOWS\IsUninst.exe |23/01/2005 17:56:49 C:\WINDOWS\PLAY32.EXE |26/08/1996 01:12:00 C:\WINDOWS\QT32INST.EXE |26/08/1996 01:12:00 C:\WINDOWS\QTW32DEL.EXE |26/08/1996 01:12:00 C:\WINDOWS\slrundll.exe |23/02/2007 20:24:01 C:\WINDOWS\SOUNDMAN.EXE |23/01/2005 18:04:33 C:\WINDOWS wunk_16.exe |28/09/2001 13:00:00 C:\WINDOWS wunk_32.exe |28/09/2001 13:00:00 C:\WINDOWS\uinst001.exe |07/08/2005 09:15:58 C:\WINDOWS\unin040c.exe |03/11/2006 18:17:41 C:\WINDOWS\UninstallFirefox.exe |20/03/2005 09:35:25 C:\WINDOWS\UninstallThunderbird.exe |23/05/2005 08:22:20 C:\WINDOWS\UNNeroBackItUp.exe |14/07/2006 17:29:44 C:\WINDOWS\UNNeroMediaHome.exe |14/07/2006 17:29:44 C:\WINDOWS\UNNeroShowTime.exe |14/07/2006 17:29:44 C:\WINDOWS\UNNeroSipps.exe |04/01/2007 08:24:31 C:\WINDOWS\UNNeroVision.exe |14/07/2006 17:29:44 C:\WINDOWS\UNRecode.exe |14/07/2006 17:29:44 C:\WINDOWS\VIEW32.EXE |26/08/1996 01:12:00 C:\WINDOWS\PalmDevC.dll |14/10/2003 10:54:40 C:\WINDOWS\pcdlib32.dll |26/01/2005 18:36:43 C:\WINDOWS wain.dll |28/09/2001 13:00:00 C:\WINDOWS wain_32.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\append.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\ati2evxx.exe |24/11/2004 15:12:36 C:\WINDOWS\system32\Ati2mdxx.exe |24/11/2004 15:14:46 C:\WINDOWS\system32\ati2sgag.exe |23/01/2005 18:13:09 C:\WINDOWS\system32\ChCfg.exe |23/01/2005 18:04:32 C:\WINDOWS\system32\debug.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\DivXsm.exe |09/08/2005 23:13:59 C:\WINDOWS\system32\dosx.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\dvdplay.exe |23/08/2001 18:47:34 C:\WINDOWS\system32\edlin.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\exe2bin.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\fastopen.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\InstMed.exe |26/01/2005 15:06:29 C:\WINDOWS\system32\java.exe |26/01/2005 14:32:38 C:\WINDOWS\system32\javaw.exe |26/01/2005 14:32:38 C:\WINDOWS\system32\javaws.exe |26/01/2005 14:32:38 C:\WINDOWS\system32\LVCOMSX.EXE |08/10/2004 11:52:32 C:\WINDOWS\system32\mem.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\mscdexnt.exe |28/09/2001 13:00:00 C:\WINDOWS\system32 lsfunc.exe |28/09/2001 13:00:00 C:\WINDOWS\system32 w16.exe |28/09/2001 13:00:00 C:\WINDOWS\system32 edir.exe |23/01/2005 18:44:33 C:\WINDOWS\system32\RTLCPL.EXE |23/01/2005 18:04:36 C:\WINDOWS\system32\setver.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\share.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\slrundll.exe |23/02/2007 20:24:05 C:\WINDOWS\system32\slserv.exe |23/02/2007 20:24:05 C:\WINDOWS\system32\usrmlnka.exe |23/08/2001 18:47:48 C:\WINDOWS\system32\usrprbda.exe |23/08/2001 18:47:48 C:\WINDOWS\system32\usrshuta.exe |23/08/2001 18:47:48 C:\WINDOWS\system32\vwipxspx.exe |28/09/2001 13:00:00 C:\WINDOWS\system32\amstream.dll |23/01/2005 18:15:57 C:\WINDOWS\system32\ati2cqag.dll |24/11/2004 14:33:58 C:\WINDOWS\system32\ati2dvaa.dll |23/01/2005 18:47:22 C:\WINDOWS\system32\ati2dvag.dll |24/11/2004 15:20:16 C:\WINDOWS\system32\ati2edxx.dll |24/11/2004 15:14:38 C:\WINDOWS\system32\ati2evxx.dll |24/11/2004 15:14:22 C:\WINDOWS\system32\ati3d1ag.dll |23/01/2005 18:47:22 C:\WINDOWS\system32\ati3d2ag.dll |23/01/2005 18:47:22 C:\WINDOWS\system32\ati3duag.dll |24/11/2004 14:58:28 C:\WINDOWS\system32\ATIDDC.DLL |24/11/2004 15:12:06 C:\WINDOWS\system32\ATIDEMGR.dll |24/11/2004 17:26:20 C:\WINDOWS\system32\atiiiexx.dll |23/01/2005 18:13:06 C:\WINDOWS\system32\atioglxx.dll |24/11/2004 15:45:02 C:\WINDOWS\system32\atipdlxx.dll |24/11/2004 15:15:12 C:\WINDOWS\system32\atitvo32.dll |24/11/2004 14:42:22 C:\WINDOWS\system32\ativcoxx.dll |09/11/2001 04:01:04 C:\WINDOWS\system32\ativtmxx.dll |23/02/2007 20:24:13 C:\WINDOWS\system32\ativvaxx.dll |24/11/2004 14:52:40 C:\WINDOWS\system32\atmfd.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\atmlib.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\CMGR32.DLL |26/08/1996 01:12:00 C:\WINDOWS\system32\CNQU70.DLL |26/01/2005 18:34:26 C:\WINDOWS\system32\compatui.dll |23/01/2005 18:45:08 C:\WINDOWS\system32\dgrpsetu.dll |23/01/2005 17:26:38 C:\WINDOWS\system32\dgsetup.dll |23/01/2005 17:26:38 C:\WINDOWS\system32\DivX.dll |09/08/2005 23:13:59 C:\WINDOWS\system32\divx_xx07.dll |09/08/2005 23:13:52 C:\WINDOWS\system32\divx_xx0c.dll |09/08/2005 23:13:51 C:\WINDOWS\system32\divx_xx11.dll |09/08/2005 23:13:51 C:\WINDOWS\system32\DOCOBJ.DLL |19/11/1996 00:00:00 C:\WINDOWS\system32\dpl100.dll |09/08/2005 23:12:28 C:\WINDOWS\system32\dpu11.dll |09/08/2005 23:12:27 C:\WINDOWS\system32\dpuGUI11.dll |09/08/2005 23:12:28 C:\WINDOWS\system32\dpus11.dll |09/08/2005 23:12:27 C:\WINDOWS\system32\dpv11.dll |09/08/2005 23:12:27 C:\WINDOWS\system32\dtu100.dll |09/08/2005 23:12:28 C:\WINDOWS\system32\encdec.dll |23/01/2005 18:47:22 C:\WINDOWS\system32\EqnClass.Dll |23/01/2005 17:26:37 C:\WINDOWS\system32\fwapi.dll |03/11/2006 18:21:02 C:\WINDOWS\system32\GEARAspi.dll |19/09/2006 15:43:58 C:\WINDOWS\system32\HLINKPRX.DLL |19/11/1996 00:00:00 C:\WINDOWS\system32\HNDLR32.DLL |26/08/1996 01:12:00 C:\WINDOWS\system32\hsfcisp2.dll |23/02/2007 20:24:11 C:\WINDOWS\system32\hticons.dll |23/01/2005 17:36:49 C:\WINDOWS\system32\hypertrm.dll |23/01/2005 17:36:49 C:\WINDOWS\system32\iccvid.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ieencode.dll |23/02/2007 20:24:10 C:\WINDOWS\system32\imagr5.dll |17/12/2006 09:41:34 C:\WINDOWS\system32\imagx5.dll |17/12/2006 09:41:34 C:\WINDOWS\system32\imagX7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\ImagXpr5.dll |17/12/2006 09:41:34 C:\WINDOWS\system32\imagXpr7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\imagXR7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\imagXRA7.dll |26/07/2004 17:16:10 C:\WINDOWS\system32\Inetwh32.dll |03/02/2005 10:02:34 C:\WINDOWS\system32\ir32_32.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ir41_qc.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ir41_qcx.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ir50_32.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ir50_qc.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\ir50_qcx.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\isrdbg32.dll |23/01/2005 17:39:00 C:\WINDOWS\system32\jgaw400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\jgdw400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\jgmd400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\jgpl400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\jgsd400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\jgsh400.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\LCamCpl.dll |26/01/2005 15:06:03 C:\WINDOWS\system32\lfbmp12n.dll |26/01/2005 15:05:55 C:\WINDOWS\system32\LFCMP12n.DLL |26/01/2005 15:05:56 C:\WINDOWS\system32\lffax12n.dll |26/01/2005 15:05:56 C:\WINDOWS\system32\lftif12n.dll |26/01/2005 15:05:56 C:\WINDOWS\system32\libeay32.dll |09/08/2005 23:13:31 C:\WINDOWS\system32\LQCUI2.dll |26/01/2005 15:05:52 C:\WINDOWS\system32\LTDIS12n.dll |26/01/2005 15:05:57 C:\WINDOWS\system32\ltefx12n.dll |26/01/2005 15:05:57 C:\WINDOWS\system32\ltfil12n.DLL |26/01/2005 15:05:57 C:\WINDOWS\system32\ltimg12n.dll |26/01/2005 15:05:57 C:\WINDOWS\system32\ltkrn12n.dll |26/01/2005 15:05:58 C:\WINDOWS\system32\Ltwvc12n.dll |26/01/2005 15:05:58 C:\WINDOWS\system32\LVCOMCX.dll |08/10/2004 11:55:36 C:\WINDOWS\system32\Lvkrn12n.dll |26/01/2005 15:06:03 C:\WINDOWS\system32\LVMAENUM.dll |08/10/2004 11:52:58 C:\WINDOWS\system32\mdmxsdk.dll |23/02/2007 20:24:08 C:\WINDOWS\system32\mdwmdmsp.dll |23/08/2001 18:47:06 C:\WINDOWS\system32\msdmo.dll |23/01/2005 18:15:57 C:\WINDOWS\system32\msencode.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\MSO97V.DLL |26/10/1998 23:00:00 C:\WINDOWS\system32\MSORFS.DLL |26/10/1998 23:00:00 C:\WINDOWS\system32\mtxparhd.dll |23/02/2007 20:24:07 C:\WINDOWS\system32\N124UFW.dll |26/01/2005 18:34:26 C:\WINDOWS\system32\NeroCo.dll |16/02/2005 15:18:04 C:\WINDOWS\system32 v4_disp.dll |23/01/2005 18:30:54 C:\WINDOWS\system32\Oemdspif.dll |24/11/2004 15:14:56 C:\WINDOWS\system32\paqsp.dll |23/08/2001 18:47:16 C:\WINDOWS\system32\PCDLIB32.DLL |26/01/2005 18:36:03 C:\WINDOWS\system32\pncrt.dll |03/02/2005 10:03:30 C:\WINDOWS\system32\pndx5016.dll |03/02/2005 10:03:30 C:\WINDOWS\system32\pndx5032.dll |03/02/2005 10:03:30 C:\WINDOWS\system32\psisdecd.dll |23/01/2005 18:15:58 C:\WINDOWS\system32\QCUI2.dll |26/01/2005 15:05:58 C:\WINDOWS\system32\qedwipes.dll |23/01/2005 18:15:58 C:\WINDOWS\system32\qt-dx331.dll |09/08/2005 23:12:28 C:\WINDOWS\system32\QTIM32.DLL |26/08/1996 01:12:00 C:\WINDOWS\system32\QTOLE32.DLL |26/08/1996 01:12:00 C:\WINDOWS\system32\QTWMCI32.DLL |26/08/1996 01:12:00 C:\WINDOWS\system32 moc3260.dll |03/02/2005 10:03:34 C:\WINDOWS\system32 oboex32.dll |03/02/2005 10:02:34 C:\WINDOWS\system32\RTLCPAPI.dll |23/01/2005 18:04:33 C:\WINDOWS\system32\s3gnb.dll |23/02/2007 20:24:06 C:\WINDOWS\system32\sbe.dll |23/01/2005 18:47:21 C:\WINDOWS\system32\scriptpw.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\slbcsp.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\slbiop.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\slbrccsp.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\slcoinst.dll |23/02/2007 20:24:05 C:\WINDOWS\system32\slextspk.dll |23/02/2007 20:24:05 C:\WINDOWS\system32\slgen.dll |23/02/2007 20:24:05 C:\WINDOWS\system32\spnike.dll |23/08/2001 18:47:18 C:\WINDOWS\system32\sprio600.dll |23/08/2001 18:47:18 C:\WINDOWS\system32\sprio800.dll |23/08/2001 18:47:18 C:\WINDOWS\system32\spxcoins.dll |23/01/2005 17:26:37 C:\WINDOWS\system32\ssleay32.dll |09/08/2005 23:13:31 C:\WINDOWS\system32 sd32.dll |28/09/2001 13:00:00 C:\WINDOWS\system32\TWAIN_32.DLL |26/01/2005 18:36:03 C:\WINDOWS\system32\TwnLib4.dll |09/07/2004 09:43:56 C:\WINDOWS\system32\UCS32P.DLL |26/01/2005 18:34:27 C:\WINDOWS\system32\usrcntra.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrcoina.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrdpa.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrdtea.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrfaxa.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrlbva.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrrtosa.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrsdpia.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrsvpia.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrv42a.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrv80a.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrvoica.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\usrvpa.dll |23/08/2001 18:47:20 C:\WINDOWS\system32\vidx16.dll |26/01/2005 18:48:22 C:\WINDOWS\system32\vsdata.dll |23/01/2005 19:15:14 C:\WINDOWS\system32\vsinit.dll |23/01/2005 19:15:14 C:\WINDOWS\system32\vsmonapi.dll |23/01/2005 19:16:03 C:\WINDOWS\system32\vspubapi.dll |23/01/2005 19:16:03 C:\WINDOWS\system32\vsutil.dll |23/01/2005 19:15:14 C:\WINDOWS\system32\vsutil_loc040C.dll |23/01/2005 19:16:05 C:\WINDOWS\system32\vsxml.dll |23/01/2005 19:16:03 C:\WINDOWS\system32\win87em.dll |28/09/2001 13:00:00 Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\WINDOWS\system32 19/08/2004 16:09 6 144 csrss.exe 1 fichier(s) 6 144 octets 0 Rép(s) 35 708 342 272 octets libres Contenu de Downloaded Program Files Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\WINDOWS\Downloaded Program Files 23/02/2007 16:04 . 23/02/2007 16:04 .. 07/02/2007 08:35 300 680 arclib.dll 07/12/2004 16:07 32 bdcore.dll 01/03/2005 14:08 118 784 bdupd.dll 23/01/2005 17:40 65 desktop.ini 25/07/2002 16:13 24 576 dwusplay.dll 25/07/2002 16:13 196 608 dwusplay.exe 01/03/2005 14:08 53 248 ipsupd.dll 25/07/2002 16:05 172 032 isusweb.dll 09/03/2005 15:42 6 742 lang.ini 07/12/2004 16:07 32 libfn.dll 18/02/2005 16:22 126 live.ini 20/01/2000 15:25 1 162 Microsoft XML Parser for Java.osd 29/01/2005 21:55 32 768 MsnChat40fr-fr.dll 24/10/2003 14:01 278 MsnChat45.inf 27/10/2003 11:35 510 552 MSNChat45.ocx 01/06/2006 02:57 1 331 oscan8.inf 01/06/2006 02:54 471 040 oscan8.ocx 31/05/2006 04:15 10 oscan81.ocx_x 09/03/2005 15:43 6 828 scanoptions.tsi 02/12/2005 10:55 5 101 swflash.inf 23/02/2007 05:03 1 184 774 vet.da1 24/07/2006 08:12 4 349 432 vet.dat 02/10/2006 08:17 1 021 504 vete.dll 20/11/2006 12:02 180 282 webscan.dll 21/07/2006 12:55 477 webscan.inf 30/06/2003 22:41 1 689 WMV9VCM.inf 26 fichier(s) 8 640 153 octets Total des fichiers listés : 26 fichier(s) 8 640 153 octets 2 Rép(s) 35 708 342 272 octets libres Recherche de rootkit! (Merci S!Ri) Recherche d'infections connues Liste des programmes installes Adobe Acrobat 5.0 Adobe Photoshop 7.0 Adobe Premiere 6.0 AIM Archiveur WinRAR ArcSoft Camera Suite ArcSoft PhotoBase 3 ArcSoft PhotoStudio 5 ATI - Utilitaire de désinstallation du logiciel ATI Control Panel ATI Display Driver ATI HYDRAVISION AutoUpdate AVG Anti-Spyware 7.5 Bibliothèques GTK+ 2.4.13 rev a (supprimer uniquement) Camera Window Canon Internet Library for ZoomBrowser EX Canon PhotoRecord Canon Utilities File Viewer Utility 1.2 Canon Utilities PhotoStitch 3.1 Canon Utilities RemoteCapture 2.7 Canon Utilities ZoomBrowser EX CanoScan Toolbox 4.1 CCleaner (remove only) CIG Codeur Windows Media Série 9 Codeur Windows Media Série 9 Core Center DivX DivX Player eMule Fenêtre d'appareil photo Canon pour ZoomBrowser EX File Viewer Utility 1.2.2 Google Earth HijackThis 1.99.1 Hijackthis Version Française iTunes J2SE Runtime Environment 5.0 Update 1 Kaspersky(TM) Anti-Virus Personal Pro 4.5 Learn2 Player (Uninstall Only) Logiciel QuickCam de Logitech Logitech Gaming Software Look 'n' Stop 2.05p2 Macromedia Flash Player 8 Microsoft .NET Framework 1.1 Microsoft Midtown Madness 2 Microsoft Money 2001 Microsoft Office XP Professional avec FrontPage Microsoft PowerPoint Viewer 97 Mozilla Firefox (2.0.0.2) Mozilla Thunderbird (1.0.2) muvee autoProducer 3.1 - CE Nero 7 Premium Nero Sipps OmniPage SE Palm VersaMail(tm) PhotoStitch Programme de gestion Camera de Logitech® QuickTime RealPlayer Basic Realtek AC'97 Audio RemoteCapture 2.7.2 Viewpoint Media Player WebFldrs XP WildTangent Web Driver Windows Live Messenger Windows Media Format Runtime Windows XP Service Pack 2 Yahoo! Extras Yahoo! Messenger Yahoo! Toolbar Yahoo! Toolbar avec bloqueur de fenêtres pop-up ZoneAlarm Pro Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\Program Files 24/02/2007 11:05 . 24/02/2007 11:05 .. 03/11/2006 18:18 Adobe 04/01/2007 07:13 Ahead 01/06/2005 17:55 AIM 26/01/2005 18:47 ArcSoft 23/01/2005 18:13 ATI Technologies 26/01/2005 18:39 Canon 23/02/2007 14:38 CCleaner 24/01/2005 16:36 Common Files 10/01/2007 18:11 DivX 24/02/2007 06:56 eMule 30/12/2006 11:29 Executive Software 04/01/2007 08:12 Fichiers communs 05/06/2006 16:58 Google 23/02/2007 14:53 Grisoft 25/02/2007 10:05 Hijackthis Version Française 07/05/2005 18:05 IncrediMail 23/02/2007 20:23 Internet Explorer 02/01/2007 09:39 iPod 02/01/2007 09:39 iTunes 26/01/2005 14:32 Java 26/01/2005 16:45 Kaspersky Lab 03/02/2005 10:05 Learn2.com 26/01/2005 15:05 Logitech 23/02/2007 20:24 Messenger 23/01/2005 17:42 microsoft frontpage 26/01/2005 15:29 Microsoft Games 24/01/2005 14:30 Microsoft Money 03/11/2006 17:01 Microsoft Office 23/02/2007 20:24 Movie Maker 28/02/2007 17:31 Mozilla Firefox 10/01/2007 18:11 Mozilla Thunderbird 24/01/2005 15:51 mozilla.org 23/01/2005 18:09 MSI 20/01/2007 20:11 MSN 23/01/2005 17:37 MSN Gaming Zone 20/01/2007 20:29 MSN Messenger 12/08/2005 18:02 muvee Technologies 04/01/2007 08:23 Nero 23/02/2007 20:19 NetMeeting 31/10/2006 23:14 Norton SystemWorks 28/02/2007 15:42 OpenOffice.org1.1.4 23/02/2007 20:19 Outlook Express 10/01/2007 18:11 Palm 19/07/2006 14:56 PDF2W 23/01/2007 19:53 Pinnacle 03/11/2006 17:01 PowerPoint Viewer 10/01/2007 18:11 QuickTime 03/02/2005 10:03 Real 26/01/2005 18:38 ScanSoft 23/01/2005 17:40 Services en ligne 03/11/2006 18:21 Soft4Ever 27/01/2005 17:35 Ubi Soft 10/02/2005 18:40 ViaMichelin 03/02/2005 10:05 Viewpoint 26/01/2005 15:09 WildTangent 12/08/2005 17:57 Windows Media Components 23/02/2007 20:27 Windows Media Player 23/02/2007 20:19 Windows NT 23/02/2007 15:42 WinRAR 23/01/2005 17:42 xerox 27/07/2006 15:23 Yahoo! 23/01/2005 19:16 Zone Labs 0 fichier(s) 0 octets 64 Rép(s) 35 708 731 392 octets libres Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\Program Files\fichiers communs 04/01/2007 08:12 . 04/01/2007 08:12 .. 10/01/2007 18:11 Adobe 17/12/2005 11:16 Adobe Systems Shared 04/01/2007 08:23 Ahead 10/01/2007 18:11 AOL 03/02/2005 10:06 aolback 03/11/2006 17:02 Designer 12/08/2005 17:56 InstallShield 26/01/2005 14:30 Java 22/02/2007 19:03 KAV Shared Files 26/01/2005 18:58 Logitech 27/11/2005 10:20 Micro Application Shared 03/11/2006 17:02 Microsoft Shared 23/01/2005 17:38 MSSoap 12/08/2005 18:03 muvee Technologies 03/02/2005 10:04 Nullsoft 23/01/2005 17:27 ODBC 03/02/2005 10:03 Real 18/02/2005 15:31 ScanSoft Shared 23/01/2005 17:38 Services 23/01/2005 17:26 SpeechEngines 31/10/2006 23:16 Symantec Shared 24/02/2007 06:09 System 0 fichier(s) 0 octets 24 Rép(s) 35 708 731 392 octets libres Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\Program Files\fichiers communs\Microsoft Shared\Web Folders 03/11/2006 17:02 . 03/11/2006 17:02 .. 03/11/2006 17:02 1033 03/11/2006 17:02 1036 15/02/2001 05:45 1 318 912 MSONSEXT.DLL 13/02/2001 08:23 58 784 MSOSV.DLL 03/06/1999 14:09 122 937 MSOWS409.DLL 07/03/2001 09:00 127 033 MSOWS40c.DLL 06/08/2000 09:04 401 462 MSVCP60.DLL 22/01/2001 03:25 69 632 PKMAXCTL.DLL 22/01/2001 03:25 872 448 PKMCDO.DLL 22/01/2001 03:25 159 744 PKMCORE.DLL 07/02/2001 09:59 106 496 PKMFORMS.DLL 12/02/2001 04:03 684 032 PKMRES.DLL 22/01/2001 03:25 28 672 PKMSSTLB.DLL 22/01/2001 03:25 40 960 PKMTEMPL.DLL 22/01/2001 03:25 24 576 PKMTRACE.DLL 22/01/2001 03:25 86 016 PKMWS.DLL 22/01/2001 03:25 237 568 PROMDEMO.DLL 22/01/2001 03:25 184 320 SECMGR.DLL 22/01/2001 03:25 323 584 VAIDDMGR.DLL 22/01/2001 03:25 32 768 VAIMEM.DLL 18 fichier(s) 4 879 944 octets 4 Rép(s) 35 708 731 392 octets libres Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\Program Files\common files 24/01/2005 16:36 . 24/01/2005 16:36 .. 24/01/2005 16:36 GTK 0 fichier(s) 0 octets 3 Rép(s) 35 708 731 392 octets libres Le volume dans le lecteur C s'appelle Système Le numéro de série du volume est C8A0-E5E8 Répertoire de C:\ 11/11/2001 00:00 68 096 diff.exe 27/08/2006 14:10 103 424 grep.exe 2 fichier(s) 171 520 octets 0 Rép(s) 35 708 731 392 octets libres c:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\ARPPRODUCTICON.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\NewShortcut1.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\NewShortcut1_1.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupB.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupE.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupF.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupG.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupI.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{7B0ADD54-01D9-45E7-964A-B4A334F12034}\VersaMailSetupS.exe c:\Documents and Settings\Regisabine\Application Data\Microsoft\Installer\{D085A1B6-90A4-11D3-82B7-00C04FA309DE}\MnyIco.exe c:\Documents and Settings\Regisabine\Bureau\-AntiSpy3F.EXE c:\Documents and Settings\Regisabine\Bureau\ATF-Cleaner.exe c:\Documents and Settings\Regisabine\Bureau\CPU ID.exe c:\Documents and Settings\Regisabine\Bureau\mwav.exe c:\Documents and Settings\Regisabine\Bureau\scanner.exe c:\Documents and Settings\Regisabine\Bureau\VundoFix.exe c:\Documents and Settings\Regisabine\Bureau\clean\pskill.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\diff.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\FilesInfoCmd.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\Fport.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\grep.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\LFiles.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\LISTDLLS.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\pslist.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\streams.exe c:\Documents and Settings\Regisabine\Bureau\DiagHelp\DiagHelp\swreg.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\admin.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\author.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\autochk.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\cfgwiz.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fp98sadm.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fp98swin.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fpadmcgi.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fpcount.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fpremadm.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\fpsrvadm.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\msjavx86.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\msmsgs.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\msmsgsin.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 etsetup.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 tkrnlpa.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 tkrpamp.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 egedit.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\shtml.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\spuninst.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\stub_fpsrvadm.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\stub_fpsrvwin.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 cptest.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 elnet.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\winnt.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\winnt32.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\drw\dwwin.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 oot\ic\setup.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1 oot\ip\setup.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\system32\smss.exe c:\Documents and Settings\Regisabine\Bureau\Windows XP SP1\update\update.exe c:\Documents and Settings\Regisabine\Bureau\Winrar 3.11 fr\wrar311fr.exe c:\Documents and Settings\Regisabine\Local Settings\Temp\ICD1.tmp\bdoscandel.exe c:\Documents and Settings\Regisabine\pioneer\DVRFlash.exe c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\ppcrlconfig.dll c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll c:\Documents and Settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll Liste des drivers... < Service Pack 2 2 28 2007 19:39:43.500 < Pilote charg' \WINDOWS\system32 toskrnl.exe < Pilote charg' \WINDOWS\system32\hal.dll < Pilote charg' \WINDOWS\system32\KDCOM.DLL < Pilote charg' \WINDOWS\system32\BOOTVID.dll < Pilote charg' ACPI.sys < Pilote charg' \WINDOWS\System32\DRIVERS\WMILIB.SYS < Pilote charg' pci.sys < Pilote charg' isapnp.sys < Pilote charg' viaidexp.sys < Pilote charg' \WINDOWS\System32\DRIVERS\PCIIDEX.SYS < Pilote charg' MountMgr.sys < Pilote charg' ftdisk.sys < Pilote charg' dmload.sys < Pilote charg' dmio.sys < Pilote charg' PartMgr.sys < Pilote charg' VolSnap.sys < Pilote charg' atapi.sys < Pilote charg' disk.sys < Pilote charg' \WINDOWS\System32\DRIVERS\CLASSPNP.SYS < Pilote charg' fltmgr.sys < Pilote charg' sr.sys < Pilote charg' KSecDD.sys < Pilote charg' Ntfs.sys < Pilote charg' NDIS.sys < Pilote charg' viaagp1.sys < Pilote charg' ohci1394.sys < Pilote charg' \WINDOWS\System32\DRIVERS\1394BUS.SYS < Pilote charg' Mup.sys < Pilote charg' \SystemRoot\System32\DRIVERS ic1394.sys < Pilote charg' \SystemRoot\System32\DRIVERS\amdk7.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ati2mtag.sys < Pilote charg' \SystemRoot\System32\DRIVERS\imapi.sys < Pilote charg' \SystemRoot\System32\DRIVERS\cdrom.sys < Pilote charg' \SystemRoot\System32\DRIVERS edbook.sys < Pilote charg' \SystemRoot\System32\Drivers\GEARAspiWDM.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbuhci.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbehci.sys < Pilote charg' \SystemRoot\System32\DRIVERS\i8042prt.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mouclass.sys < Pilote charg' \SystemRoot\System32\DRIVERS\kbdclass.sys < Pilote charg' \SystemRoot\System32\DRIVERS\fdc.sys < Pilote charg' \SystemRoot\System32\DRIVERS\serial.sys < Pilote charg' \SystemRoot\System32\DRIVERS\serenum.sys < Pilote charg' \SystemRoot\System32\DRIVERS\parport.sys < Pilote charg' \SystemRoot\system32\drivers\ALCXWDM.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\audstub.sys < Pilote charg' \SystemRoot\System32\DRIVERS\bridge.sys < Pilote charg' \SystemRoot\System32\DRIVERS asl2tp.sys < Pilote charg' \SystemRoot\System32\DRIVERS distapi.sys < Pilote charg' \SystemRoot\System32\DRIVERS diswan.sys < Pilote charg' \SystemRoot\System32\DRIVERS aspppoe.sys < Pilote charg' \SystemRoot\System32\DRIVERS aspptp.sys < Pilote charg' \SystemRoot\System32\DRIVERS\msgpc.sys < Pilote charg' \SystemRoot\System32\DRIVERS\psched.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ptilink.sys < Pilote charg' \SystemRoot\System32\DRIVERS aspti.sys < Pilote charg' \SystemRoot\System32\DRIVERS dpdr.sys < Pilote charg' \SystemRoot\System32\DRIVERS ermdd.sys < Pilote charg' \SystemRoot\System32\DRIVERS\lnsfw.sys < Pilote charg' \SystemRoot\System32\DRIVERS\swenum.sys < Pilote charg' \SystemRoot\System32\DRIVERS\update.sys < Pilote charg' \SystemRoot\system32\drivers\WmBEnum.sys < Pilote charg' \SystemRoot\system32\drivers\WmXlCore.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mssmbios.sys < Pilote charg' \SystemRoot\System32\Drivers\NDProxy.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\NDProxy.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\usbhub.sys < Pilote charg' \SystemRoot\System32\DRIVERS\flpydisk.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\lbrtfdc.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Sfloppy.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\i2omgmt.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Changer.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Cdaudio.SYS < Pilote charg' \SystemRoot\System32\Drivers\Fs_Rec.SYS < Pilote charg' \SystemRoot\System32\Drivers\Null.SYS < Pilote charg' \SystemRoot\System32\Drivers\Beep.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\AvgAsCln.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\kbdhid.sys < Pilote charg' \SystemRoot\System32\drivers\vga.sys < Pilote charg' \SystemRoot\System32\Drivers\mnmdd.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\RDPCDD.sys < Pilote charg' \SystemRoot\System32\Drivers\Msfs.SYS < Pilote charg' \SystemRoot\System32\Drivers\Npfs.SYS < Pilote charg' \SystemRoot\System32\DRIVERS asacd.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ipsec.sys < Pilote charg' \SystemRoot\System32\DRIVERS cpip.sys < Pilote charg' \SystemRoot\System32\Drivers\lnsfw1.SYS < Pilote charg' \SystemRoot\System32\DRIVERS etbt.sys < Pilote charg' \SystemRoot\System32\drivers\afd.sys < Pilote charg' \SystemRoot\System32\DRIVERS etbios.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\processr.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\PCIDump.SYS < Le pilote n'a pas 't' charg' \SystemRoot\system32\drivers\wdmaud.sys < Pilote charg' \SystemRoot\System32\DRIVERS dbss.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mrxsmb.sys < Le pilote n'a pas 't' charg' \SystemRoot\system32\drivers\OVSound2.sys < Pilote charg' \??\C:\WINDOWS\System32\Drivers\klif.sys < Pilote charg' \SystemRoot\System32\DRIVERS\ipnat.sys < Pilote charg' \SystemRoot\System32\DRIVERS\wanarp.sys < Pilote charg' \SystemRoot\System32\DRIVERS\arp1394.sys < Pilote charg' \SystemRoot\System32\Drivers\Fips.SYS < Pilote charg' \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbscan.sys < Pilote charg' \SystemRoot\System32\Drivers\Cdfs.SYS < Pilote charg' \SystemRoot\System32\DRIVERS\fbxusb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\usbccgp.sys < Pilote charg' \SystemRoot\System32\DRIVERS\OVCE.sys < Pilote charg' \SystemRoot\system32\drivers\OVSound2.sys < Pilote charg' \SystemRoot\System32\DRIVERS disuio.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS dbss.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\mrxsmb.sys < Pilote charg' \SystemRoot\System32\DRIVERS\mrxdav.sys < Pilote charg' \SystemRoot\System32\Drivers\ParVdm.SYS < Pilote charg' \SystemRoot\System32\Drivers\ASCTRM.SYS < Le pilote n'a pas 't' charg' \SystemRoot\System32\Drivers\Aspi32.SYS < Pilote charg' \SystemRoot\System32\Drivers\HTTP.sys < Pilote charg' \SystemRoot\System32\DRIVERS\secdrv.sys < Pilote charg' \SystemRoot\System32\DRIVERS\srv.sys < Le pilote n'a pas 't' charg' \SystemRoot\System32\DRIVERS\ipnat.sys < Pilote charg' \SystemRoot\system32\drivers\wdmaud.sys < Pilote charg' \SystemRoot\system32\drivers\sysaudio.sys < Pilote charg' \SystemRoot\system32\drivers\splitter.sys < Pilote charg' \SystemRoot\system32\drivers\aec.sys < Pilote charg' \SystemRoot\system32\drivers\swmidi.sys < Pilote charg' \SystemRoot\system32\drivers\DMusic.sys < Pilote charg' \SystemRoot\system32\drivers\kmixer.sys < Pilote charg' \SystemRoot\system32\drivers\drmkaud.sys a+

did71 · Answer

re,

pour moi, c'est propre!

Quels sont tes problèmes?

a+

regisabine · Answer

re

faut il que je réessaie silentrunner?

tu penses que je n'ai plus de pb de virus?

a+

did71 · Answer

re,

silentrunners et dialhelp font le même boulot!

ton pc est clean

a+

regisabine · Answer

ok

faut il que je nettoie les fichiers temp ou kespersky a trouvé les virus?
(ils y sont tjrs)

a+

did71 · Answer

re,

tu peux nettoyer les fichiers temporaires mais tu en auras toujours, c'est normal!

tu peux passer par le menu démarrer> rechercher> tu choisis tous les fichiers > tu écris dans une partie ou l'ensemble du nom de fichier *.tmp > à la fin de la recherche, tu sélectionne tout et tu supprimes!

a+

regisabine · Answer

re' 
c'est fait
effectivement cela a suffit pour les enlever.

puis je te demander si les "processus" dans mon gestionnaire de taches sont normaux.
j'y trouve en effet par exemple plusieurs fois 'svchost.exe'

je trouve que l'ordi rame et cela vient peut etre de là?

a+

did71 · Answer

re,

c'est tout à fait normal d'avoir plusieurs svchost.exe!

Défragmente ton DD, ça ramènerai de la vitesse!

a+

regisabine · Answer

c'est déjà fait
j'ai tout défragmenté la semaine dernière
puis je supprimmer  certains processus?
a+

did71 · Answer

re,

non! tout est propre!

pour vérifier je te fais passer encore un outil mais il n'y a pas d'infection!

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau: 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
Redémarre ton ordinateur 
Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

a+

regisabine · Answer

re'

rapport 
SDFix: Version 1.68

Run by Regisabine - 28/02/2007 @ 22:55:39,40

Microsoft Windows XP [version 5.1.2600]

Running From: C:\Documents and Settings\Regisabine\Bureau\SDFix

Safe Mode:
Checking Services: 

Name:

Path:


Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found...




ADS Check:

C:\WINDOWS\system32
No streams found.


                                 Final Check:

Remaining Services:
------------------


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Kaspersky\kavupd.exe"="C:\Kaspersky\kavupd.exe:*:Enabled:kavupd"
"C:\Program Files\Fichiers communs\KAV Shared Files\avpupd.exe"="C:\Program Files\Fichiers communs\KAV Shared Files\avpupd.exe:*:Enabled:AVP Updater"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:
---------------



Checking For Files with Hidden Attributes :


Add/Remove Programs List:

Adobe Acrobat 5.0
Adobe Photoshop 7.0
Adobe Premiere 6.0
AIM
ATI - Utilitaire de d‚sinstallation du logiciel
ATI Display Driver
AVG Anti-Spyware 7.5
CCleaner (remove only)
Core Center
eMule
BibliothŠques GTK+ 2.4.13 rev a (supprimer uniquement)
HijackThis 1.99.1
Hijackthis Version Fran‡aise
Fenˆtre d'appareil photo Canon pour ZoomBrowser EX
Canon Utilities File Viewer Utility 1.2
Canon Internet Library for ZoomBrowser EX
Canon Utilities RemoteCapture 2.7
Canon Utilities PhotoStitch 3.1
Look 'n' Stop 2.05p2
Microsoft Midtown Madness 2
Mozilla Firefox (2.0.0.2)
Mozilla Thunderbird (1.0.2)
Nero Sipps
Canon PhotoRecord
Microsoft PowerPoint Viewer 97
Programme de gestion Camera de Logitech©
RealPlayer Basic
Macromedia Flash Player 8
Learn2 Player (Uninstall Only)
Viewpoint Media Player
WildTangent Web Driver
Codeur Windows Media S‚rie 9
Windows XP Service Pack 2
Archiveur WinRAR
Yahoo! Toolbar avec bloqueur de fenˆtres pop-up
Yahoo! Extras
Yahoo! Messenger
Yahoo! Toolbar
ZoneAlarm Pro
ArcSoft PhotoStudio 5
ATI HYDRAVISION
ATI Control Panel
Nero 7 Premium
AutoUpdate
J2SE Runtime Environment 5.0 Update 1
Google Earth
iTunes
muvee autoProducer 3.1 - CE
QuickTime
Camera Window
OmniPage SE
File Viewer Utility 1.2.2
Palm VersaMail(tm)
DivX
Kaspersky(TM) Anti-Virus Personal Pro 4.5 
DivX Player
Microsoft Office XP Professional avec FrontPage
Logitech Gaming Software
CIG
RemoteCapture 2.7.2
ArcSoft Camera Suite
CanoScan Toolbox 4.1
ArcSoft PhotoBase 3
Canon Utilities ZoomBrowser EX
Logiciel QuickCam de Logitech
Microsoft .NET Framework 1.1
Microsoft Money 2001
Windows Live Messenger
Codeur Windows Media S‚rie 9
PhotoStitch
Realtek AC'97 Audio

                                 Finished


et 


Logfile of HijackThis v1.99.1
Scan saved at 23:02:58, on 28/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesfr.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/fr/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

a+

did71 · Answer

re, 

tu le vois comme moi, il n'y a aucune infection sur ton pc!

tout est propre!

la vitesse reviendra peu à peu!

a+

regisabine · Answer

je te remercie didier non seulement de ta compétence mais aussi de ta patience et de ta disponibilité.
à un jour prochain peut etre
a+ et encore merci

did71 · Answer

re,

je t'en prie!

bon surf!

Comment sais tu que je m'appelle didier?

a+

regisabine · Answer

salut
pour le prénom c'est albert qui t'a appelé par ton prénom au message 11.
je n'ai rien inventé :)

merci encore

afideg · Answer

Bonjour regisabine

En attendant Did71, il faut déjà supprimer ces outils de travail:

VundoFix et ses composants
clean.zip et ses composants
SDFix et ses composants
DiagHelp.zip et ses composants
Blacklight (de F-Secure),
eScan Antivirus Toolkit 
le script "Silent Runners"

Bonne journée.
Al.

did71 · Answer

bonjour vous deux,

tu supprimes tout ce qu'afideg a mentionné!

a+

Ordinateur infecté par win32 skynet

46 réponses

Discussions similaires