Analyse de mon rapport hijackthis

alors j'ai réussi à supprimer seulement le sponsor de messengerplus3 (d'ailleurs qu'est-ce que c'est?).
Il n'y a pas de CIDhelp...
voilà le rapport:
Rapport fait à 14:09:24,70 le 12/03/2007

******************************************
## Répertoires Application Data

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\All Users\Application Data

16/08/2004 17:54 <REP> .
16/08/2004 17:54 <REP> ..
24/12/2006 20:35 <REP> ACD Systems
15/11/2004 07:53 <REP> Adobe
15/11/2004 07:54 <REP> AOL
10/07/2006 20:23 <REP> BOONTY
07/03/2007 21:51 <REP> Clockhidebikestupid
29/10/2006 12:12 <REP> Google
07/03/2007 21:51 <REP> Messenger Plus!
16/08/2004 17:54 <REP> Microsoft
15/11/2004 07:55 <REP> QuickTime
16/08/2004 18:28 <REP> SBSI
15/11/2004 07:58 <REP> Symantec
18/02/2005 11:28 <REP> UDL
15/11/2004 07:55 <REP> Viewpoint
17/08/2006 18:55 <REP> Windows Genuine Advantage
02/04/2006 14:44 <REP> Zylom
16/08/2004 17:55 62 desktop.ini
1 fichier(s) 62 octets
17 R‚p(s) 20ÿ934ÿ070ÿ272 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Default User\Application Data

16/08/2004 17:54 <REP> .
16/08/2004 17:54 <REP> ..
19/12/2004 11:14 <REP> AOL
19/12/2004 11:14 <REP> Identities
16/08/2004 17:54 <REP> Microsoft
19/12/2004 11:14 <REP> Real
19/12/2004 11:14 <REP> Sun
19/12/2004 11:14 <REP> Symantec
19/12/2004 11:14 <REP> You've Got Pictures Screensaver
16/08/2004 17:54 62 desktop.ini
1 fichier(s) 62 octets
9 R‚p(s) 20ÿ934ÿ057ÿ984 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Default User\Local Settings\Application Data

16/08/2004 17:55 <REP> .
16/08/2004 17:55 <REP> ..
19/12/2004 11:14 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
16/08/2004 18:10 <REP> Microsoft
19/12/2004 11:14 <REP> Powercinema
19/12/2004 11:14 6ÿ291ÿ456 IconCache.db
1 fichier(s) 6ÿ291ÿ456 octets
5 R‚p(s) 20ÿ934ÿ057ÿ984 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Invit‚\Application Data

19/12/2004 20:40 <REP> .
19/12/2004 20:40 <REP> ..
19/12/2004 20:40 <REP> AOL
19/12/2004 20:40 <REP> Identities
19/12/2004 20:40 <REP> Microsoft
19/12/2004 20:40 <REP> Real
19/12/2004 20:40 <REP> Sun
19/12/2004 20:40 <REP> Symantec
19/12/2004 20:40 <REP> You've Got Pictures Screensaver
19/12/2004 20:40 62 desktop.ini
1 fichier(s) 62 octets
9 R‚p(s) 20ÿ934ÿ057ÿ984 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Invit‚\Local Settings\Application Data

19/12/2004 20:40 <REP> .
19/12/2004 20:40 <REP> ..
19/12/2004 20:40 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
19/12/2004 20:40 <REP> Microsoft
19/12/2004 20:40 <REP> Powercinema
19/12/2004 20:40 3ÿ783ÿ140 IconCache.db
1 fichier(s) 3ÿ783ÿ140 octets
5 R‚p(s) 20ÿ934ÿ057ÿ984 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Jess\Application Data

19/12/2004 11:16 <REP> .
19/12/2004 11:16 <REP> ..
24/12/2006 21:40 <REP> ACD Systems
19/12/2004 12:58 <REP> Adobe
12/04/2005 11:16 <REP> AdobeUM
19/12/2004 11:16 <REP> AOL
18/02/2005 13:14 <REP> ArcSoft
19/12/2004 18:01 <REP> CyberLink
18/02/2005 13:16 <REP> EPSON
24/12/2005 11:11 <REP> Google
19/12/2004 11:23 <REP> Help
19/12/2004 11:16 <REP> Identities
19/12/2004 12:58 <REP> InterTrust
10/03/2007 14:34 <REP> Lavasoft
15/05/2005 19:24 <REP> Leadertech
19/12/2004 18:47 <REP> Macromedia
19/12/2004 11:16 <REP> Microsoft
12/04/2005 11:12 <REP> OpenOffice.org1.9.79
19/12/2004 11:16 <REP> Real
08/04/2005 14:27 <REP> Shareaza
18/02/2005 13:11 <REP> Smart Panel
15/05/2005 19:24 <REP> Sonic
19/12/2004 11:16 <REP> Sun
19/12/2004 11:16 <REP> Symantec
19/12/2004 13:20 <REP> Template
19/12/2004 11:16 <REP> You've Got Pictures Screensaver
19/12/2004 11:16 62 desktop.ini
1 fichier(s) 62 octets
26 R‚p(s) 20ÿ934ÿ053ÿ888 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Jess\Local Settings\Application Data

19/12/2004 11:16 <REP> .
19/12/2004 11:16 <REP> ..
19/12/2004 11:16 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
12/04/2005 11:16 <REP> Adobe
29/10/2006 12:24 <REP> Google
19/12/2004 11:23 <REP> Help
11/03/2005 19:59 <REP> Identities
19/12/2004 11:16 <REP> Microsoft
06/12/2006 19:02 <REP> MicroVision Applications
19/12/2004 11:16 <REP> Powercinema
08/04/2005 14:27 <REP> Shareaza
24/12/2006 20:45 <REP> Showtime
19/04/2005 20:09 204ÿ288 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
19/12/2004 13:19 61ÿ120 GDIPFONTCACHEV1.DAT
19/12/2004 11:16 4ÿ813ÿ180 IconCache.db
3 fichier(s) 5ÿ078ÿ588 octets
12 R‚p(s) 20ÿ934ÿ053ÿ888 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\LocalService\Application Data

16/08/2004 18:18 <REP> .
16/08/2004 18:18 <REP> ..
16/08/2004 18:18 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 20ÿ934ÿ053ÿ888 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\LocalService\Local Settings\Application Data

16/08/2004 18:18 <REP> .
16/08/2004 18:18 <REP> ..
16/08/2004 18:18 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 20ÿ934ÿ053ÿ888 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Maman\Application Data

19/12/2004 12:38 <REP> .
19/12/2004 12:38 <REP> ..
25/08/2005 20:09 <REP> Adobe
25/08/2005 20:09 <REP> AdobeUM
19/12/2004 12:38 <REP> AOL
18/02/2005 14:10 <REP> ArcSoft
20/12/2004 11:58 <REP> CyberLink
30/11/2006 17:19 <REP> Google
04/03/2005 19:06 <REP> Help
19/12/2004 12:38 <REP> Identities
17/01/2005 11:09 <REP> Leadertech
05/04/2005 08:19 <REP> Macromedia
19/12/2004 12:38 <REP> Microsoft
19/12/2004 12:38 <REP> Real
19/12/2004 12:38 <REP> Sun
19/12/2004 12:38 <REP> Symantec
19/12/2004 20:35 <REP> Template
19/12/2004 12:38 <REP> You've Got Pictures Screensaver
19/12/2004 12:39 62 desktop.ini
1 fichier(s) 62 octets
18 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Maman\Local Settings\Application Data

19/12/2004 12:38 <REP> .
19/12/2004 12:38 <REP> ..
19/12/2004 12:38 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
25/08/2005 20:09 <REP> Adobe
30/11/2006 17:19 <REP> Google
04/03/2005 19:06 <REP> Help
19/12/2004 12:38 <REP> Microsoft
19/12/2004 12:38 <REP> Powercinema
17/01/2005 11:06 3ÿ584 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
19/12/2004 20:35 58ÿ424 GDIPFONTCACHEV1.DAT
19/12/2004 12:38 3ÿ210ÿ654 IconCache.db
3 fichier(s) 3ÿ272ÿ662 octets
8 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\NetworkService\Application Data

16/08/2004 18:18 <REP> .
16/08/2004 18:18 <REP> ..
16/08/2004 18:18 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\NetworkService\Local Settings\Application Data

16/08/2004 18:18 <REP> .
16/08/2004 18:18 <REP> ..
16/08/2004 18:18 <REP> Microsoft
0 fichier(s) 0 octets
3 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\Propri‚taire\Application Data

19/12/2004 13:42 <REP> .
19/12/2004 13:42 <REP> ..
19/12/2004 13:42 <REP> You've Got Pictures Screensaver
0 fichier(s) 0 octets
3 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\ThibauT\Application Data

27/06/2006 10:29 <REP> .
27/06/2006 10:29 <REP> ..
14/01/2007 12:38 <REP> ACD Systems
27/06/2006 10:29 <REP> AOL
31/10/2006 10:50 <REP> Google
27/06/2006 10:29 <REP> Identities
02/09/2006 13:02 <REP> Macromedia
27/06/2006 10:29 <REP> Microsoft
27/06/2006 10:29 <REP> Real
27/06/2006 10:29 <REP> Sun
27/06/2006 10:29 <REP> Symantec
27/06/2006 10:29 <REP> You've Got Pictures Screensaver
27/06/2006 10:29 62 desktop.ini
1 fichier(s) 62 octets
12 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Documents and Settings\ThibauT\Local Settings\Application Data

27/06/2006 10:29 <REP> .
27/06/2006 10:29 <REP> ..
27/06/2006 10:29 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
31/10/2006 10:50 <REP> Google
27/06/2006 10:29 <REP> Microsoft
27/06/2006 10:29 <REP> Powercinema
27/06/2006 10:29 3ÿ776ÿ544 IconCache.db
1 fichier(s) 3ÿ776ÿ544 octets
6 R‚p(s) 20ÿ934ÿ049ÿ792 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Application Data

16/08/2004 18:16 <REP> .
16/08/2004 18:16 <REP> ..
19/12/2004 11:15 <REP> AOL
19/12/2004 11:15 <REP> Identities
16/08/2004 18:16 <REP> Microsoft
19/12/2004 11:15 <REP> Real
19/12/2004 11:15 <REP> Sun
19/12/2004 11:15 <REP> Symantec
19/12/2004 11:15 <REP> You've Got Pictures Screensaver
16/08/2004 18:16 62 desktop.ini
1 fichier(s) 62 octets
9 R‚p(s) 20ÿ934ÿ045ÿ696 octets libres
Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data

16/08/2004 18:16 <REP> .
16/08/2004 18:16 <REP> ..
19/12/2004 11:15 <REP> {7148F0A6-6813-11D6-A77B-00B0D0142050}
16/08/2004 18:16 <REP> Microsoft
19/12/2004 11:15 <REP> Powercinema
19/12/2004 11:15 6ÿ291ÿ456 IconCache.db
1 fichier(s) 6ÿ291ÿ456 octets
5 R‚p(s) 20ÿ934ÿ045ÿ696 octets libres

******************************************
Recherche des taches planifiées dans C:\WINDOWS\tasks

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\WINDOWS\Tasks

19/12/2004 11:15 258 Rappel d'enregistrement 2.job
16/08/2004 18:18 6 SA.DAT
16/08/2004 18:06 <REP> ..
16/08/2004 18:06 <REP> .
16/08/2004 17:40 65 desktop.ini
3 fichier(s) 329 octets
2 R‚p(s) 20ÿ934ÿ045ÿ696 octets libres

******************************************
## Répertoires de C:\Program Files

Le volume dans le lecteur C s'appelle HDD
Le num‚ro de s‚rie du volume est 508F-51A7

R‚pertoire de C:\Program Files

12/03/2007 14:07 <REP> .
12/03/2007 14:07 <REP> ..
24/12/2006 20:35 <REP> ACD Systems
19/12/2004 12:58 <REP> Adobe
07/03/2007 21:50 <REP> Adverts
17/08/2006 18:31 <REP> Alwil Software
15/11/2004 07:46 <REP> Analog Devices
18/02/2005 11:26 <REP> ArcSoft
15/11/2004 07:47 <REP> ATI Technologies
16/08/2004 18:05 <REP> ComPlus Applications
15/11/2004 08:02 <REP> CyberLink
18/04/2005 10:15 <REP> DivX
15/11/2004 08:01 <REP> Dynamic Toolbar
11/03/2007 16:33 <REP> eMule
18/02/2005 11:30 <REP> EPSON
24/12/2006 20:34 <REP> Fichiers communs
15/12/2006 10:50 <REP> Fisher-Price
28/01/2007 11:55 <REP> Google
18/02/2007 03:02 <REP> Internet Explorer
15/11/2004 07:47 <REP> Java
08/04/2005 11:31 <REP> Kit ADSL
19/12/2004 16:44 <REP> Kodak
10/03/2007 14:34 <REP> Lavasoft
15/11/2004 07:55 <REP> Learn2.com
27/08/2006 18:21 <REP> Masta
05/09/2005 08:36 <REP> Matroska Pack
01/02/2005 11:08 <REP> Maxis
14/02/2005 21:07 <REP> Messenger
07/03/2007 21:50 <REP> MessengerPlus! 3
16/08/2004 18:11 <REP> microsoft frontpage
24/09/2005 09:15 <REP> microsoft office
27/08/2006 18:24 <REP> Microsoft Works
15/11/2004 08:08 <REP> Microsoft.NET
25/09/2006 10:45 <REP> Mindscape
08/04/2005 18:34 <REP> minitel
04/02/2007 09:59 <REP> MinitelADSL
16/08/2004 18:06 <REP> Movie Maker
20/12/2004 12:04 <REP> MSN
16/08/2004 18:03 <REP> MSN Gaming Zone
23/12/2006 18:26 <REP> MSN Messenger
17/11/2006 22:31 <REP> MSXML 4.0
16/08/2004 18:06 <REP> NetMeeting
16/08/2004 18:03 <REP> Online Services
07/07/2005 14:42 <REP> OpenOffice.org 1.9.79
24/12/2006 20:26 <REP> Optio 50L Digital Camera
17/12/2006 00:21 <REP> Outlook Express
18/04/2005 09:50 <REP> QuickTime
15/11/2004 07:55 <REP> Real
16/08/2004 18:07 <REP> Services en ligne
06/02/2006 14:56 <REP> Shareaza
26/09/2005 17:42 <REP> Smart Panel
15/11/2004 08:10 <REP> Sonic
16/12/2006 17:49 <REP> Steam
11/03/2006 19:33 <REP> TLC-Edusoft
04/02/2007 10:39 <REP> TomTom HOME
30/12/2006 17:54 <REP> Valve
15/11/2004 07:55 <REP> Viewpoint
19/04/2005 11:25 <REP> Winamp
12/12/2006 10:01 <REP> Windows Media Connect 2
12/12/2006 10:01 <REP> Windows Media Player
24/09/2005 09:12 <REP> Windows Messaging
16/08/2004 18:03 <REP> Windows NT
16/08/2004 18:11 <REP> xerox
0 fichier(s) 0 octets
63 R‚p(s) 20ÿ934ÿ041ÿ600 octets libres

******************************************
## Popups autorisées

* Internet Explorer

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow
www.packardbell.com REG_NONE
www.packardbell.co.uk REG_NONE
www.packardbell.at REG_NONE
www.packardbell.dk REG_NONE
www.packardbell.fi REG_NONE
www.packardbell.fr REG_NONE
www.packardbell.de REG_NONE
www.packardbell.it REG_NONE
www.packardbell.no REG_NONE
www.packardbell.es REG_NONE
www.packardbell.se REG_NONE
www.packardbell.ch REG_NONE
www.cfpb.fr REG_BINARY
*.zylom.com REG_BINARY 00000000
*.zylomgames.com REG_BINARY 00000000

* Mozilla Firefox (1 autorisé 2 interdit)

******************************************
## Registre

* [HKEY_CURRENT_USER\\Software\Microsoft\Internet Explorer\Main]
Search Bar REG_SZ http://www.google.com/toolbar/ie8/sidebar.html

******************************************
## Zones de sécurité

* HKCU Domains (4)

* P3P History (5)

******************************************
## Recherche C:\WINDOWS\*.htm, "C:\WINDOWS\*.gif"


*************** Fin du rapport ****************

est-ce que c'est ça le rapport moveit?
C:\Documents and Settings\All Users\Application Data\Clockhidebikestupid moved successfully.
C:\Program Files\Adverts moved successfully.
C:\Program Files\Fichiers communs\BOONTY Shared\Service moved successfully.
C:\Program Files\Fichiers communs\BOONTY Shared moved successfully.

Created on 03/12/2007 15:10:10

sinon je vois pas ce que c'est...

alors, non ils ne sont pas dans ma corbeille et non je n'ai pas du redémarrer l'ordi... c'est bizarre non?
et là j'attends toujours la rapport de bitdefender... y'en a encore pour une demi-heure...

voilà le rapprt bitdefender:


BitDefender Online Scanner



Scan report generated at: Mon, Mar 12, 2007 - 16:47:19





Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;







Statistics

Time
01:30:33

Files
402068

Folders
5873

Boot Sectors
3

Archives
7652

Packed Files
41132




Results

Identified Viruses
1

Infected Files
7

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
7




Engines Info

Virus Definitions
404351

Engine build
AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)

Scan plugins
14

Archive plugins
38

Unpack plugins
6

E-mail plugins
6

System plugins
1




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Documents and Settings\Jess\Local Settings\Temp\bisFF.exe
Infected with: Trojan.FatObfus.Gen

C:\Documents and Settings\Jess\Local Settings\Temp\bisFF.exe
Disinfection failed

C:\Documents and Settings\Jess\Local Settings\Temp\bisFF.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074061.exe
Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074061.exe
Disinfection failed

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074061.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074062.exe
Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074062.exe
Disinfection failed

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074062.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074063.exe
Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074063.exe
Disinfection failed

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074063.exe
Deleted

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074064.exe
Infected with: Trojan.FatObfus.Gen

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074064.exe
Disinfection failed

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP407\A0074064.exe
Deleted

C:\_OTMoveIt\MovedFiles\Documents and Settings\All Users\Application Data\Clockhidebikestupid\Delete cdrom.exe
Infected with: Trojan.FatObfus.Gen

C:\_OTMoveIt\MovedFiles\Documents and Settings\All Users\Application Data\Clockhidebikestupid\Delete cdrom.exe
Disinfection failed

C:\_OTMoveIt\MovedFiles\Documents and Settings\All Users\Application Data\Clockhidebikestupid\Delete cdrom.exe
Deleted

C:\_OTMoveIt\MovedFiles\Program Files\Adverts\uninst.exe
Infected with: Trojan.FatObfus.Gen

C:\_OTMoveIt\MovedFiles\Program Files\Adverts\uninst.exe
Disinfection failed

C:\_OTMoveIt\MovedFiles\Program Files\Adverts\uninst.exe
Deleted

ok, alors voilà le rapport:

Logfile of HijackThis v1.99.1
Scan saved at 17:54:51, on 12/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\microsoft office\Office\OSA.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\microsoft office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\microsoft office\Office\FINDFAST.EXE
O4 - Startup: TomTom HOME.lnk = C:\Program Files\TomTom HOME\TomTomHOME.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46C2E9CD-17D7-4EDB-915F-CD80203EBBAD}: NameServer = 84.103.237.146 86.64.145.146
O17 - HKLM\System\CS1\Services\Tcpip\..\{46C2E9CD-17D7-4EDB-915F-CD80203EBBAD}: NameServer = 84.103.237.146 86.64.145.146
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

liliane, évite de poster partout
Cela n'ira pas plus vite


Suis les recommandations ==> piratage possible besoin d aide urgent#2007 03 12%2017%3A37%3A39

si je comprends bien, j'avais des virus dans moveit, c'est pas possible, vu que je venais de le télécharger... et c'est quoi system volume information?

non c'est bon, plus de fenêtres intempestives!
merci beaucoup!

voilà.. je télécharge kerio + tard..


Logfile of HijackThis v1.99.1
Scan saved at 16:49:54, on 18/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\microsoft office\Office\OSA.EXE
C:\Program Files\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB002" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Device Detector] "C:\Program Files\Fichiers communs\ACD Systems\FR\DevDetect.exe" -autorun
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\microsoft office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\microsoft office\Office\FINDFAST.EXE
O4 - Startup: TomTom HOME.lnk = C:\Program Files\TomTom HOME\TomTomHOME.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{46C2E9CD-17D7-4EDB-915F-CD80203EBBAD}: NameServer = 86.64.145.146 84.103.237.146
O17 - HKLM\System\CS1\Services\Tcpip\..\{46C2E9CD-17D7-4EDB-915F-CD80203EBBAD}: NameServer = 86.64.145.146 84.103.237.146
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MysqlInventime - Unknown owner - c:\mysql\bin\mysqld-nt.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

ok et je configure kerio comment?