Win 32 TrojanProxy...HELLLLLP! Résolu

Question

Bonjour à tous!!!
Je crois que mon 1er message n'a pas été posté (je suis nouvelle et je ne connais pas bien la marche à suivre pour les forums)
J'ai un pc infecté  par "trojanproxy" malgré mon antivirus NOD32. J'ai essayé pas mal de choses pour m'en débarasser (en lisant vos posts) mais rien à faire..dès que j'allume mon ordi mon antivirus m'envoie des messages d'infection...je ne sais plus quoi faire...J'ai même réinstaller plusieurs  fois windows xp
Si quelqu'un peut m'aider....

merci d'avance!!!!

duflox · Answer

Tout d'abord Bonjour et bienvenue sur le forum d'entraide COMMENT CA MARCHE 


télécharge HijackThis ici: 
https://www.zebulon.fr/telechargements/securite/systeme/hijackthis.html

Dézippe le dans un dossier prévu à cet effet. 
Par exemple C:\hijackthis < Enregistre le bien dans c : ! 
Démo : (Merci a Balltrap34 pour cette réalisation) 
http://pageperso.aol.fr/balltrap34/Hijenr.gif 

renomme hijackthis. en "scan" par exemple 

Lance le puis: 
clique sur "do a system scan and save logfile" (cf démo) 
faire un copier coller du log entier sur le forum 

Démo : (Merci a Balltrap34 pour cette réalisation) 
http://pageperso.aol.fr/balltrap34/demohijack.htm 

Bon courage 
A+

fatoo · Answer

je ne trouve pas le fichier "rqonkh.dll" dans windows

duflox · Answer

copie colle le fichier    C:\WINDOWS\rqonkh.dll
 dans la case et clique sur submit

fatoo · Answer

ce fichier n'existe pas dans mon C:\windows\
il est introuvable...je ne peux le copier coller

duflox · Answer

arrete de faire parcourir et lis bien ce que je t ecris!!!

fait un clic gauche sur le fichier suivant (celui que je t ecris )

C:\WINDOWS\rqonkh.dll 

fais copier et colle le dans la case et clique sur submit

je peux pas etre plus clair!!!!

fatoo · Answer

Salut,

J'ai tenté de faire ce que tu m'as demandé...je peux copier C:\WINDOWS\rqonkh.dll mais quand je vais sur viruscan je ne peux le coller dans la fenêtre (l'option  coller n'apparaît pas quand je clique avec la souris)...j'ai tenté de réécrire directement dans la case C:\WINDOWS\rqonkh.dll mais l'onglet submit n'est pas disponible on ne peut cliquer dessus

duflox · Answer

tu peux par car il dois y avoir trop de monde sur le site!!ca arrive ....alors

Rends toi sur ce site : 
http://www.virustotal.com/xhtml/virustotal_en.html 

Clique sur parcourir et cherche ce fichier :  C:\WINDOWS\rqonkh.dll 

Clique sur send. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse

fatoo · Answer

bonjour,

ce matin en ouvrant mon ordinateur j'ai eu ce message 

RUN DLL "erreur de chargement C:\WINDOWS\rqonkh.dll , le module spécifié est introuvable"
j'ai quand même essayé de faire ce que tu m'as demandé mais sans succès...
Dois-je réinsatller Windows XP pour avoir à nouveau ce module???

duflox · Answer

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

* Double-clique VundoFix.exe afin de le lancer. 
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo 
* Clique sur le bouton Scan for Vundo. 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK 
* Démarre ton PC à nouveau. 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 

Note Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

fatoo · Answer

Salut !

Voici les scans demandé avec Vundofix et Hjackthis

VundoFix V6.5.7

Checking Java version...

Scan started at 11:17:15 19/08/2007

Listing files found while scanning....

C:\WINDOWS\hknoqr.ini
C:\WINDOWSqonkh.dll
C:\WINDOWS\System32	mp91.tmp.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\hknoqr.ini
C:\WINDOWS\hknoqr.ini Has been deleted!

Performing Repairs to the registry.
Done!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:52, on 19/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset
od32kui.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\System32\svchost.exe
D:\Logiciels\Reader\Reader_sl.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Digital Imaging\bin\hpqtra08.exe
D:\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c96cc99d-ced3-45da-adef-4c0e01f16c2d} - C:\WINDOWS\system32\syspui.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] "D:\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Logiciels\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = D:\Office\OSA9.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = D:\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Ouvrir l'image dans &Microsoft PhotoDraw - res://D:\Office\1036\phdintl.dll/phdContext.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - AppInit_DLLs: c:\windows\system32\awtsqpm.dll
O20 - Winlogon Notify: crypt - crypts.dll (file missing)
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32pcc.dll
O20 - Winlogon Notify: syspui - syspui.dll (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

duflox · Answer

le rapport de vundofix n est pas complet alors relance et copie colle le rapport complet ici

merci

fatoo · Answer

VundoFix V6.5.7

Checking Java version...

Scan started at 11:17:15 19/08/2007

Listing files found while scanning....

C:\WINDOWS\hknoqr.ini
C:\WINDOWSqonkh.dll
C:\WINDOWS\System32	mp91.tmp.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\hknoqr.ini
C:\WINDOWS\hknoqr.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version...

Scan started at 14:43:06 19/08/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.5.7

Checking Java version...

Scan started at 14:47:59 19/08/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

duflox · Answer

ok alors

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 


Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

fatoo · Answer

Je  double clique sur SDfix.exe sur mon bureau...mais j'ai un message qui me dit que ce n'est pas une application Win32 valide

fatoo · Answer

J'ai réessayé..j'ai un autre message qui me dit que le dossier n'existe pas et qu'il a été déplacé renommé...depuis le téléchargement...?

duflox · Answer

alors il y a 2 possibilités:

1)tu n as pas telecharger le fichier sur le bureau et a la place dans la fenetre de telechargement tu as mis executé

2) tu n as pas demarrer ton pc en mode sans echec

fatoo · Answer

IL DOIT Y AVOIR UN COUAC...
Je clique sur ton lien (msg 19)..
Une fenêtre apparaît qui dit que j'ai choisi d'ouvrir SDFIX.exe et qui me demande si je souhaite enregistrer le fichier..
Je clique sur enregistrer fichier..un msg erreur de téléchargement apparaît "le fichier ne pourra être enregistré une erreur est survenue"... ensuite on me demande d'enregistrer le fichier ailleurs je clique sur ok..
La fenêtre de téléchargement me dit après quelques secondes que le telechargement vers le bureau est terminé..
l'icône apparaît un cours instant et disparaît je ne peux cliquer dessus

J'essaie de recrhercher le fichier dans mon C: mais il n'existe pas

duflox · Answer

ok fait ceci avant alors

Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

Double-clic sur combofix il vas te demander une question répond oui touche y puis attends que combofix soit fini il vas générer un rapport 

Poste le sur le forum dans ta réponse


puis


Télécharge « clean.zip » 
http://www.malekal.com/download/clean.zip 


•- Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier dénommé "clean ". 

•- Redémarre en mode sans échec. ( note bien ce que tu as à faire ). 
•- Ouvre le dossier « clean » qui se trouve sur ton bureau. 
•- Double-clic sur « clean.cmd ». 
Une fenêtre noire va apparaître, choisis l’option 2. 

Clean va travailler. 
•- Redémarre normalement 
•- Poste qui se trouve ici C:\rapport_clean.txt.


(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

fatoo · Answer

ComboFix 07-08-14.4 - "FATSEB" 2007-08-19 17:26:16.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.239 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\g32.txt C:\WINDOWS\s32.txt C:\WINDOWS\system32\6_exception.nls C:\WINDOWS\system32 pcc.dll C:\WINDOWS\ws386.ini ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_ASPI113210 -------\LEGACY_RUNTIME -------\Runtime ((((((((((((((((((((((((( Files Created from 2007-07-19 to 2007-08-19 ))))))))))))))))))))))))))))))) 2007-08-19 17:25 51,200 --a------ C:\WINDOWS ircmd.exe 2007-08-19 12:10 3,350 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat 2007-08-19 12:08 13,000 --a------ C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Music Converter.dat 2007-08-19 12:08 10,884,472 --a------ C:\WINDOWS\system32\SpoonUninstall.exe 2007-08-19 11:17 d-------- C:\VundoFix Backups 2007-08-13 18:00 d-------- C:\WINDOWS\BDOSCAN8 2007-08-13 17:40 15,942,656 --a------ C:\Program Files\IE7Setup.exe 2007-08-13 09:02 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys 2007-08-13 09:02 36,224 --a------ C:\WINDOWS\system32\dllcache\isapnp.sys 2007-08-13 08:53 d-------- C:\hijackthis 2007-08-12 13:47 50,688 --a------ C:\WINDOWS\system32\dllcache\usbhub.sys 2007-08-12 13:47 123,264 --a------ C:\WINDOWS\system32\dllcache\usbport.sys 2007-08-12 13:30 70,144 --a------ C:\WINDOWS\system32\dllcache\usbui.dll 2007-08-12 13:02 73,600 -ra------ C:\WINDOWS\system32\drivers\viamraid.sys 2007-08-12 12:35 d-------- C:\DOCUME~1\FATSEB\WINDOWS 2007-08-12 11:45 33,792 --a------ C:\WINDOWS\system32\drivers\AmdTools.sys 2007-08-12 11:45 180,096 --a------ C:\WINDOWS\system32\drivers\acpi.sys 2007-08-12 11:45 180,096 --a------ C:\WINDOWS\system32\dllcache\acpi.sys 2007-08-12 11:45 14,336 --a------ C:\WINDOWS\system32\drivers\amdacpi.sys 2007-08-12 11:45 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-08-12 11:44 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-08-12 11:41 d-------- C:\WINDOWS\Downloaded Installations 2007-08-09 15:13 d--hs---- C:\FOUND.009 2007-08-03 14:02 0 --a------ C:\WINDOWS\system32 ewxertbtsr.exe 2007-07-31 09:43 d--hs---- C:\FOUND.008 2007-07-30 19:21 d--hs---- C:\FOUND.007 2007-07-29 10:58 d--hs---- C:\FOUND.006 2007-07-28 09:30 d--hs---- C:\FOUND.005 2007-07-26 17:37 d--hs---- C:\FOUND.004 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-15 16:16 31232 --a------ C:\WINDOWS\system32\16475772ld.exe 2007-07-11 19:46 --------- d-------- C:\Program Files\Fichiers communs\Nokia 2007-07-11 19:45 --------- d-------- C:\Program Files\PC Connectivity Solution 2007-07-11 19:45 --------- d-------- C:\Program Files\Nokia 2007-07-11 19:13 --------- d-------- C:\DOCUME~1\FATSEB\APPLIC~1\Leadertech 2007-06-06 11:01 298104 --a------ C:\WINDOWS\system32\imon.dll 2007-05-24 08:30 0 --a------ C:\WINDOWS\system32\MSNGR32.com 2001-11-23 06:08 712704 -ra------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c96cc99d-ced3-45da-adef-4c0e01f16c2d}] C:\WINDOWS\system32\syspui.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-06-06 11:01] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-07-12 10:50] "nwiz"="nwiz.exe" [2004-07-12 10:50 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-07-12 10:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "HP Software Update"="D:\HP Software Update\HPWuSchd2.exe" [] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18] "Cmaudio"="cmicnfg.cpl" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "Adobe Reader Speed Launcher"="D:\Logiciels\Reader\Reader_sl.exe" [2007-05-11 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 12:00] [HKEY_USERS\.default\software\microsoft\windows\currentversion un] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Microsoft Office.lnk - D:\Office\OSA9.EXE [2000-01-21 10:15:56] HP Digital Imaging Monitor.lnk - D:\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38] D‚marrage rapide du logiciel HP Image Zone.lnk - D:\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\syspui] syspui.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=c:\windows\system32\awtsqpm.dll R0 AmdAcpi;AmdAcpi Bus Filter Driver;C:\WINDOWS\System32\DRIVERS\AmdAcpi.sys R0 viamraid;viamraid;C:\WINDOWS\System32\DRIVERS\viamraid.sys R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\System32\DRIVERS\AmdTools.sys R3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys S3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\System32\DRIVERS\AmdLLD.sys Contents of the 'Scheduled Tasks' folder 2007-08-19 14:35:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-19 17:27:54 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-19 17:28:42 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-19 17:28 --- E O F ---

fatoo · Answer

voici le rapport de clean


Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 19/08/2007 a 17:37:48,35 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
tentative de suppression de C:\WINDOWS\system32\MSNGR32.com 
tentative de suppression de C:\WINDOWS\system32\SpoonUninstall.exe 
 
*** Suppression des fichiers dans C:\Program Files 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

duflox · Answer

maintenant essaye de relancer SDfix

fatoo · Answer

là l'icone apparaît sur mon bureau (même si je dois m'y reprendre à 2 fois pour le télécharger car il me dit encore qu'une erreur est survenue lors du telechargement)je double clique dessus Il me met la même chose que la 1ere fois "SDFIX.exe nest pas une application win32 valide "

duflox · Answer

en mode sans echec tu essaye de l ouvir j espere......

fatoo · Answer

ooopsss!!!

fatoo · Answer

J'ai tenté le mode sans echec...il me dit que le fichier introuvable...c'est comme si j'avais l'icône sur le bureau mais qu'il était vide...j'ai regardé les propriétés du fichier SDFIX.exe se trouvant sur le bureau, il y a 0 octets!! est-ce normal...

fatoo · Answer

Maintenant quand j'ouvre ma session j'ai le message suivant
ecrit en gros :
LaunchApplication.exe est introuvable
ConAPI.DLL est introuvable

duflox · Answer

non ce n est pas normal:

supprime sdfix puis vide ta corbeille

ensuite retelecharge le mais ne l ouvre pas 

puis redemarre en mode sans echec! et lance sdfix

fatoo · Answer

Salut...!

Mon antivirus n'arrêtait pas de m'envoyer des messages d'intrusions...mon pc arrêtait pas de déconner...j'ai donc réinstaller windows xp...et fais un rapport hijak que je te poste

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:39, on 21/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system\smss.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\Isass.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\algs.exe
C:\Program Files\Eset
od32kui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4C187C5A-B122-4878-8475-2B45A62E66B5} - C:\WINDOWS\System32\jkhhe.dll
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\qommjjj.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O20 - AppInit_DLLs: c:\windows\system32\vtstttt.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhe - C:\WINDOWS\System32\jkhhe.dll
O20 - Winlogon Notify: qommjjj - C:\WINDOWS\SYSTEM32\qommjjj.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe

duflox · Answer

ce n est pas en formatant et en reinstallant windows que tu n a plus de souci!!

ps: tu as encore les memes problemes!!!!!!....................

alors reprenons et ne formate plus et ne fais pas de restauration systeme sans mon accord!!!

merci

alors

Télécharge VundoFix.exe (par Atribune) sur ton Bureau. 
http://www.atribune.org/ccount/click.php?id=4 

* Double-clique VundoFix.exe afin de le lancer. 
* Lorsque l'outil se lance à nouveau, clique sur le bouton Scan for Vundo 
* Clique sur le bouton Scan for Vundo. 
* Lorsque le scan est complété, clique sur le bouton Remove Vundo 
* Une invite te demandera si tu veux supprimer les fichiers, clique YES 
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers. 
* Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown"); clique OK 
* Démarre ton PC à nouveau. 
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

fatoo · Answer

ok!

voici ce que tu m'as demandé


VundoFix V6.5.7

Checking Java version...

Scan started at 19:49:32 21/08/2007

Listing files found while scanning....

C:\WINDOWS\System32\ehhkj.bak1
C:\WINDOWS\System32\ehhkj.bak2
C:\WINDOWS\System32\ehhkj.ini
C:\windows\system32\jcnjssol.exe
C:\WINDOWS\System32\jkhhe.dll
C:\windows\system32\vtstttt.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\System32\ehhkj.bak1
C:\WINDOWS\System32\ehhkj.bak1 Has been deleted!

 Attempting to delete C:\WINDOWS\System32\ehhkj.bak2
C:\WINDOWS\System32\ehhkj.bak2 Has been deleted!

 Attempting to delete C:\WINDOWS\System32\ehhkj.ini
C:\WINDOWS\System32\ehhkj.ini Has been deleted!

 Attempting to delete C:\windows\system32\jcnjssol.exe
C:\windows\system32\jcnjssol.exe Has been deleted!

 Attempting to delete C:\WINDOWS\System32\jkhhe.dll
C:\WINDOWS\System32\jkhhe.dll Has been deleted!

 Attempting to delete C:\windows\system32\vtstttt.dll
C:\windows\system32\vtstttt.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version...

Scan started at 19:54:41 21/08/2007

Listing files found while scanning....

C:\windows\system32\vtstttt.dll

Beginning removal...

 Attempting to delete C:\windows\system32\vtstttt.dll
C:\windows\system32\vtstttt.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version...

Scan started at 19:57:36 21/08/2007

Listing files found while scanning....

C:\windows\system32\vtstttt.dll

Beginning removal...

 Attempting to delete C:\windows\system32\vtstttt.dll
C:\windows\system32\vtstttt.dll Could not be deleted.

Performing Repairs to the registry.
Done!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:03:22, on 21/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\system\smss.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\Isass.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\algs.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\qommjjj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O20 - AppInit_DLLs: c:\windows\system32\vtstttt.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: qommjjj - C:\WINDOWS\SYSTEM32\qommjjj.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe

duflox · Answer

Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

fatoo · Answer

[08/21/2007, 20:12:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\fatseb\Bureau\VirtumundoBeGone.exe" )
[08/21/2007, 20:12:33] - Detected System Information:
[08/21/2007, 20:12:34] -  Windows Version: 5.1.2600, 
[08/21/2007, 20:12:34] -  Current Username: fatseb (Admin)
[08/21/2007, 20:12:34] -  Windows is in NORMAL mode.
[08/21/2007, 20:12:34] - Searching for Browser Helper Objects:
[08/21/2007, 20:12:34] -  BHO 1: {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} ()
[08/21/2007, 20:12:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/21/2007, 20:12:34] -  Checking for HKLM\...\Winlogon\Notify\qommjjj
[08/21/2007, 20:12:34] -  Found: HKLM\...\Winlogon\Notify\qommjjj - This is probably Virtumundo.
[08/21/2007, 20:12:34] -  Assigning {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} MSEvents Object
[08/21/2007, 20:12:34] - BHO list has been changed! Starting over...
[08/21/2007, 20:12:34] -  BHO 1: {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} (MSEvents Object)
[08/21/2007, 20:12:34] - ALERT: Found MSEvents Object!
[08/21/2007, 20:12:34] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/21/2007, 20:12:34] -  BHO 3: {7A36E311-8B3B-4B66-B249-55C587493974} ()
[08/21/2007, 20:12:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/21/2007, 20:12:34] -  Checking for HKLM\...\Winlogon\Notify\mljjh
[08/21/2007, 20:12:34] -  Found: HKLM\...\Winlogon\Notify\mljjh - This is probably Virtumundo.
[08/21/2007, 20:12:34] -  Assigning {7A36E311-8B3B-4B66-B249-55C587493974} MSEvents Object
[08/21/2007, 20:12:34] - BHO list has been changed! Starting over...
[08/21/2007, 20:12:34] -  BHO 1: {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} (MSEvents Object)
[08/21/2007, 20:12:34] - ALERT: Found MSEvents Object!
[08/21/2007, 20:12:34] -  BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/21/2007, 20:12:34] -  BHO 3: {7A36E311-8B3B-4B66-B249-55C587493974} (MSEvents Object)
[08/21/2007, 20:12:34] - ALERT: Found MSEvents Object!
[08/21/2007, 20:12:34] -  BHO 4: {ED9F3366-E24B-4E97-95F3-C64A4B267039} ()
[08/21/2007, 20:12:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/21/2007, 20:12:34] -  Checking for HKLM\...\Winlogon\Notify\jkhhe
[08/21/2007, 20:12:34] -  Key not found: HKLM\...\Winlogon\Notify\jkhhe, continuing.
[08/21/2007, 20:12:34] - Finished Searching Browser Helper Objects
[08/21/2007, 20:12:34] - *** Detected MSEvents Object
[08/21/2007, 20:12:34] - Trying to remove MSEvents Object...
[08/21/2007, 20:12:35] -    Terminating Process: IEXPLORE.EXE
[08/21/2007, 20:12:35] -    Terminating Process: RUNDLL32.EXE
[08/21/2007, 20:12:35] -    Disabling Automatic Shell Restart
[08/21/2007, 20:12:35] -    Terminating Process: EXPLORER.EXE
[08/21/2007, 20:12:35] -    Suspending the NT Session Manager System Service
[08/21/2007, 20:12:35] -    Terminating Windows NT Logon/Logoff Manager
[08/21/2007, 20:12:35] -    Re-enabling Automatic Shell Restart
[08/21/2007, 20:12:35] -   File to disable: C:\WINDOWS\System32\qommjjj.dll
[08/21/2007, 20:12:35] -  Renaming C:\WINDOWS\System32\qommjjj.dll -> C:\WINDOWS\System32\qommjjj.dll.vir
[08/21/2007, 20:12:36] -  File successfully renamed!
[08/21/2007, 20:12:36] -   Removing HKLM\...\Browser Helper Objects\{57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4}
[08/21/2007, 20:12:36] -   Removing HKCR\CLSID\{57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4}
[08/21/2007, 20:12:36] -   Adding Kill Bit for ActiveX for GUID: {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4}
[08/21/2007, 20:12:36] -   Deleting ATLEvents/MSEvents Registry entries
[08/21/2007, 20:12:36] -   Removing HKLM\...\Winlogon\Notify\qommjjj
[08/21/2007, 20:12:36] - Searching for Browser Helper Objects:
[08/21/2007, 20:12:36] -  BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/21/2007, 20:12:36] -  BHO 2: {7A36E311-8B3B-4B66-B249-55C587493974} (MSEvents Object)
[08/21/2007, 20:12:36] - ALERT: Found MSEvents Object!
[08/21/2007, 20:12:36] -  BHO 3: {ED9F3366-E24B-4E97-95F3-C64A4B267039} ()
[08/21/2007, 20:12:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/21/2007, 20:12:36] -  Checking for HKLM\...\Winlogon\Notify\jkhhe
[08/21/2007, 20:12:36] -  Key not found: HKLM\...\Winlogon\Notify\jkhhe, continuing.
[08/21/2007, 20:12:36] - Finished Searching Browser Helper Objects
[08/21/2007, 20:12:36] - *** Detected MSEvents Object
[08/21/2007, 20:12:36] - Trying to remove MSEvents Object...
[08/21/2007, 20:12:37] -    Terminating Process: IEXPLORE.EXE
[08/21/2007, 20:12:37] -    Terminating Process: RUNDLL32.EXE
[08/21/2007, 20:12:37] -    Disabling Automatic Shell Restart
[08/21/2007, 20:12:37] -    Terminating Process: EXPLORER.EXE
[08/21/2007, 20:12:37] -    Suspending the NT Session Manager System Service
[08/21/2007, 20:12:37] -    Terminating Windows NT Logon/Logoff Manager
[08/21/2007, 20:12:37] -    Re-enabling Automatic Shell Restart
[08/21/2007, 20:12:37] -   File to disable: C:\WINDOWS\System32\mljjh.dll
[08/21/2007, 20:12:37] -  Renaming C:\WINDOWS\System32\mljjh.dll -> C:\WINDOWS\System32\mljjh.dll.vir
[08/21/2007, 20:12:37] -  File successfully renamed!
[08/21/2007, 20:12:37] -   Removing HKLM\...\Browser Helper Objects\{7A36E311-8B3B-4B66-B249-55C587493974}
[08/21/2007, 20:12:37] -   Removing HKCR\CLSID\{7A36E311-8B3B-4B66-B249-55C587493974}
[08/21/2007, 20:12:37] -   Adding Kill Bit for ActiveX for GUID: {7A36E311-8B3B-4B66-B249-55C587493974}
[08/21/2007, 20:12:37] -   Deleting ATLEvents/MSEvents Registry entries
[08/21/2007, 20:12:37] -   Removing HKLM\...\Winlogon\Notify\mljjh
[08/21/2007, 20:12:37] - Searching for Browser Helper Objects:
[08/21/2007, 20:12:37] -  BHO 1: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/21/2007, 20:12:37] -  BHO 2: {ED9F3366-E24B-4E97-95F3-C64A4B267039} ()
[08/21/2007, 20:12:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/21/2007, 20:12:37] -  Checking for HKLM\...\Winlogon\Notify\jkhhe
[08/21/2007, 20:12:37] -  Key not found: HKLM\...\Winlogon\Notify\jkhhe, continuing.
[08/21/2007, 20:12:38] - Finished Searching Browser Helper Objects
[08/21/2007, 20:12:38] - Finishing up...
[08/21/2007, 20:12:38] - A restart is needed.
[08/21/2007, 20:12:45] - Attempting to Restart via STOP error (Blue Screen!)



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:15:30, on 21/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\Isass.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\MSNGR32.com
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\algs.exe
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\system\smss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O20 - AppInit_DLLs: c:\windows\system32\vtstttt.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: ljjgfgg - C:\WINDOWS\SYSTEM32\ljjgfgg.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe

duflox · Answer

Télécharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

Double-clic sur combofix il vas te demander une question répond oui touche y puis attends que combofix soit fini il vas générer un rapport 

Poste le sur le forum dans ta réponse

fatoo · Answer

ComboFix 07-08-17.2 - "fatseb" 2007-08-21 20:47:55.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.281 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\fatseb\APPLIC~1 mp76.tmp.exe C:\WINDOWS\system\smss.exe C:\WINDOWS\system32\.exe C:\WINDOWS\system32\1.exe C:\WINDOWS\system32\isass.exe C:\WINDOWS\system32\vtstttt.dll ((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 ))))))))))))))))))))))))))))))) 2007-08-21 20:50 43,542 --a------ C:\WINDOWS\system32\ddcbcbb.dll 2007-08-21 20:50 118 --a------ C:\WINDOWS\system32\gsccp.bat 2007-08-21 20:49 d--hs---- C:\FOUND.002 2007-08-21 20:46 51,200 --a------ C:\WINDOWS ircmd.exe 2007-08-21 20:44 43,542 --a------ C:\WINDOWS\system32\qommjih.dll 2007-08-21 20:39 43,542 --a------ C:\WINDOWS\system32\vtusrrq.dll 2007-08-21 20:13 43,542 --a------ C:\WINDOWS\system32\ljjgfgg.dll 2007-08-21 20:05 6,513 ---hs---- C:\WINDOWS\system32\hjjlm.bak1 2007-08-21 20:05 298,080 --a------ C:\WINDOWS\system32\mljjh.dll.vir 2007-08-21 20:01 43,542 --a------ C:\WINDOWS\system32\yayyvut.dll 2007-08-21 19:49 d-------- C:\VundoFix Backups 2007-08-21 19:43 43,542 --a------ C:\WINDOWS\system32\awtromj.dll 2007-08-21 19:33 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1 View_Profiles 2007-08-21 17:19 287,589 --a------ C:\WINDOWS\system32\dn98da0c22.dat 2007-08-21 17:16 43,542 --a------ C:\WINDOWS\system32\mljiggf.dll 2007-08-21 16:55 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys 2007-08-21 16:55 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-08-21 16:53 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-21 16:52 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-08-21 16:52 d-------- C:\DOCUME~1\fatseb\WINDOWS 2007-08-21 16:49 43,542 --a------ C:\WINDOWS\system32\khfeffe.dll 2007-08-21 16:46 86,016 -ra------ C:\WINDOWS\system32 vrszht.dll 2007-08-21 16:46 843,776 -ra------ C:\WINDOWS\system32 wiz.exe 2007-08-21 16:46 81,920 -ra------ C:\WINDOWS\system32 vwddi.dll 2007-08-21 16:46 81,920 -ra------ C:\WINDOWS\system32 vmctray.dll 2007-08-21 16:46 5,222,400 -ra------ C:\WINDOWS\system32 voglnt.dll 2007-08-21 16:46 454,656 -ra------ C:\WINDOWS\system32 vshell.dll 2007-08-21 16:46 438,272 -ra------ C:\WINDOWS\system32 vappbar.exe 2007-08-21 16:46 4,112,384 -ra------ C:\WINDOWS\system32 vcpl.dll 2007-08-21 16:46 352,256 -ra------ C:\WINDOWS\system32\keystone.exe 2007-08-21 16:46 32,256 -ra------ C:\WINDOWS\system32 vcodins.dll 2007-08-21 16:46 32,256 -ra------ C:\WINDOWS\system32 vcod.dll 2007-08-21 16:46 3,740,032 -ra------ C:\WINDOWS\system32 v4_disp.dll 2007-08-21 16:46 294,912 -ra------ C:\WINDOWS\system32 vwrses.dll 2007-08-21 16:46 294,912 -ra------ C:\WINDOWS\system32 vwrsel.dll 2007-08-21 16:46 286,720 -ra------ C:\WINDOWS\system32 vwrsesm.dll 2007-08-21 16:46 282,624 -ra------ C:\WINDOWS\system32 vwrspt.dll 2007-08-21 16:46 282,624 -ra------ C:\WINDOWS\system32 vwrsit.dll 2007-08-21 16:46 282,624 -ra------ C:\WINDOWS\system32 vwrsfr.dll 2007-08-21 16:46 278,528 -ra------ C:\WINDOWS\system32 vwrsptb.dll 2007-08-21 16:46 278,528 -ra------ C:\WINDOWS\system32 vwrsnl.dll 2007-08-21 16:46 274,432 -ra------ C:\WINDOWS\system32 vwrsru.dll 2007-08-21 16:46 274,432 -ra------ C:\WINDOWS\system32 vwrshu.dll 2007-08-21 16:46 266,240 -ra------ C:\WINDOWS\system32 vwrstr.dll 2007-08-21 16:46 266,240 -ra------ C:\WINDOWS\system32 vwrsde.dll 2007-08-21 16:46 262,144 -ra------ C:\WINDOWS\system32 vwrssl.dll 2007-08-21 16:46 262,144 -ra------ C:\WINDOWS\system32 vwrsno.dll 2007-08-21 16:46 262,144 -ra------ C:\WINDOWS\system32 vwrsfi.dll 2007-08-21 16:46 258,048 -ra------ C:\WINDOWS\system32 vwrssv.dll 2007-08-21 16:46 258,048 -ra------ C:\WINDOWS\system32 vwrssk.dll 2007-08-21 16:46 258,048 -ra------ C:\WINDOWS\system32 vwrspl.dll 2007-08-21 16:46 258,048 -ra------ C:\WINDOWS\system32 vwrsda.dll 2007-08-21 16:46 249,856 -ra------ C:\WINDOWS\system32 vwrseng.dll 2007-08-21 16:46 249,856 -ra------ C:\WINDOWS\system32 vwrscs.dll 2007-08-21 16:46 245,760 -ra------ C:\WINDOWS\system32 vwrsar.dll 2007-08-21 16:46 241,664 -ra------ C:\WINDOWS\system32 vwrshe.dll 2007-08-21 16:46 241,664 -ra------ C:\WINDOWS\system32 vnt4cpl.dll 2007-08-21 16:46 237,568 -ra------ C:\WINDOWS\system32 vrsar.dll 2007-08-21 16:46 233,472 -ra------ C:\WINDOWS\system32 vrshe.dll 2007-08-21 16:46 200,704 -ra------ C:\WINDOWS\system32 vrsko.dll 2007-08-21 16:46 200,704 -ra------ C:\WINDOWS\system32 vrsja.dll 2007-08-21 16:46 2,459,968 -ra------ C:\WINDOWS\system32\drivers v4_mini.sys 2007-08-21 16:46 196,608 -ra------ C:\WINDOWS\system32 vrsit.dll 2007-08-21 16:46 192,512 -ra------ C:\WINDOWS\system32 vrsfr.dll 2007-08-21 16:46 192,512 -ra------ C:\WINDOWS\system32 vrses.dll 2007-08-21 16:46 192,512 -ra------ C:\WINDOWS\system32 vrsel.dll 2007-08-21 16:46 192,512 -ra------ C:\WINDOWS\system32 vrsde.dll 2007-08-21 16:46 188,416 -ra------ C:\WINDOWS\system32 vrsnl.dll 2007-08-21 16:46 188,416 -ra------ C:\WINDOWS\system32 vrsesm.dll 2007-08-21 16:46 184,320 -ra------ C:\WINDOWS\system32 vwrsja.dll 2007-08-21 16:46 184,320 -ra------ C:\WINDOWS\system32 vrsru.dll 2007-08-21 16:46 184,320 -ra------ C:\WINDOWS\system32 vrsptb.dll 2007-08-21 16:46 184,320 -ra------ C:\WINDOWS\system32 vrspt.dll 2007-08-21 16:46 176,128 -ra------ C:\WINDOWS\system32 vrstr.dll 2007-08-21 16:46 176,128 -ra------ C:\WINDOWS\system32 vrspl.dll 2007-08-21 16:46 176,128 -ra------ C:\WINDOWS\system32 vrsno.dll 2007-08-21 16:46 176,128 -ra------ C:\WINDOWS\system32 vrshu.dll 2007-08-21 16:46 176,128 -ra------ C:\WINDOWS\system32 vrsda.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vwrsko.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vrszhc.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vrssv.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vrssl.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vrssk.dll 2007-08-21 16:46 172,032 -ra------ C:\WINDOWS\system32 vrseng.dll 2007-08-21 16:46 172,032 --a------ C:\WINDOWS\system32 vudisp.exe 2007-08-21 16:46 167,936 -ra------ C:\WINDOWS\system32 vrsfi.dll 2007-08-21 16:46 167,936 -ra------ C:\WINDOWS\system32 vrscs.dll 2007-08-21 16:46 147,456 -ra------ C:\WINDOWS\system32 vwrszht.dll 2007-08-21 16:46 143,360 -ra------ C:\WINDOWS\system32 vwrszhc.dll 2007-08-21 16:46 114,755 -ra------ C:\WINDOWS\system32 vsvc32.exe 2007-08-21 16:46 1,642,496 -ra------ C:\WINDOWS\system32 vwdmcpl.dll 2007-08-21 16:46 1,363,968 -ra------ C:\WINDOWS\system32 view.dll 2007-08-21 16:46 1,110,016 -ra------ C:\WINDOWS\system32 vdspsch.exe 2007-08-21 16:46 1,019,904 -ra------ C:\WINDOWS\system32 vwimg.dll 2007-08-21 16:46 d-------- C:\WINDOWS view 2007-08-21 16:37 d-------- C:\DOCUME~1\fatseb\.gimp-2.2 2007-08-21 16:27 212,480 --------- C:\WINDOWS\pcdlib32.dll 2007-08-21 16:27 d--h----- C:\Program Files\InstallShield Installation Information 2007-08-21 16:26 d-------- C:\Program Files\Fichiers communs\InstallShield 2007-08-21 16:24 552 --a------ C:\WINDOWS\system32\d3d8caps.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-21 19:41 2112 --a------ C:\WINDOWS\pchealth\HELPCTR\PackageStore\SkuStore.bin 2007-08-20 18:14 57856 --a------ C:\WINDOWS\web\wcxnjhhj.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help sbjbtvn.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\Tours\WindowsMediaPlayer\Cnt jnbzhbh.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\Tours\WindowsMediaPlayer\Audio\lllknblj.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\jjlenkbt.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\jbnshhqj.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\hwexrtne.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\bzehxvnz.exe 2007-08-20 17:15 146944 -r-hs---- C:\WINDOWS\system32\dllcache sch0st.exe 2007-08-20 17:01 8738 --a------ C:\WINDOWS\pchealth\HELPCTR\Config\Cntstore.bin 2007-08-13 08:52 318369 --a------ C:\Program Files\HiJackThis.zip 2001-08-28 10:00:00 70,102 --sh--r C:\WINDOWS\system32\mmdmm.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4}] 2007-08-21 20:13 43542 --a------ C:\WINDOWS\System32\ljjgfgg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ED9F3366-E24B-4E97-95F3-C64A4B267039}] C:\WINDOWS\System32\jkhhe.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" [2001-08-28 12:00] "Spooler SubSystem App"="C:\WINDOWS\System32\spoolsvc.exe" [] "Advanced DHTML Enable"="C:\WINDOWS\System32\gilsoh.exe" [2007-08-20 17:14] "Local Security Authority Service"="C:\WINDOWS\System32\lssas.exe" [2001-08-28 12:00] "mmsass"="mmdmm.exe" [2001-08-28 12:00 C:\WINDOWS\system32\mmdmm.exe] "Cmaudio"="cmicnfg.cpl" [] "Topic MSNGR32"="MSNGR32.com" [2007-08-20 17:50 C:\WINDOWS\system32\MSNGR32.com] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-08-21 10:29] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-07-12 10:50] "nwiz"="nwiz.exe" [2004-07-12 10:50 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-07-12 10:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion unservices] "mmsass"=mmdmm.exe "Topic MSNGR32"=MSNGR32.com [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4}"= C:\WINDOWS\System32\ljjgfgg.dll [2007-08-21 20:13 43542] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dbgcfg] dbgcfg.dll 2007-08-20 17:19 94651 C:\WINDOWS\system32\dbgcfg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\ljjgfgg] ljjgfgg.dll 2007-08-21 20:13 43542 C:\WINDOWS\system32\ljjgfgg.dll R2 Microsoft Agent;Microsoft Agent;"C:\WINDOWS\System32\dllcache sch0st.exe" R3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys S2 MSWindows;Network Windows Service;"C:\WINDOWS\System32\urdvxc.exe" /service S2 WINNTSMSS;Windows NT Session Manager;"C:\WINDOWS\system\smss.exe" *Newly Created Service* - IPNAT ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-21 20:50:24 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-21 20:50:57 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-21 20:50 --- E O F ---

duflox · Answer

salut

remet moi un log hijackthis

merci

fatoo · Answer

Bonsoir,

Voici le rapport Hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:05:33, on 22/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\lssas.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\algs.exe
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\ljjgfgg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {A7EFBAB9-CE99-4727-91CD-0776F90AC98A} - C:\WINDOWS\System32\jkhhf.dll
O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll
O20 - Winlogon Notify: ljjgfgg - C:\WINDOWS\SYSTEM32\ljjgfgg.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

telecharge ceci:

 Symantec Vundo Remove Tool

puis

Démarre Windows en mode sans échec en apputyant sur f8 au demarrage du pc!!

Exécute Symantec Vundo Remove Tool 

puis reposte moi un rapport hijackthis

fatoo · Answer

voici le rapport Hijackthis suite au lancement de Symantec Vundo


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:27:26, on 23/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\lssas.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\algs.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {408EB49E-70F6-4FC9-B7BB-2B678BD8C7E4} - C:\WINDOWS\System32\jkhhf.dll
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\ljjgfgg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll
O20 - Winlogon Notify: ljjgfgg - C:\WINDOWS\SYSTEM32\ljjgfgg.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

telecharge le fichier sur ton bureau et execute le

https://www.broadcom.com/support/security-center

puis 

refais moi un log hijackthis

merci

fatoo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:22:32, on 23/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gilsoh.exe
C:\WINDOWS\System32\lssas.exe
C:\WINDOWS\System32\mmdmm.exe
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\MSNGR32.com
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\algs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\dllcache
sch0st.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://start.mozilla.org/fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\ljjgfgg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {973E0A11-DBC5-43FA-B2D5-F6C2AB1C6BB8} - C:\WINDOWS\System32\jkhhf.dll
O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - HKLM\..\Run: [mmsass] mmdmm.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe
O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll
O20 - Winlogon Notify: ljjgfgg - C:\WINDOWS\SYSTEM32\ljjgfgg.dll
O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

salut

alors recopie ou imprime tous  ce que je t ecris dans cette fenetre!!

Télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.

apres que tu es fais ca :

 ferme tes programmes en cours, SURTOUT LES LOGICIELs AVEC PROTECTION EN TEMPS REEL, (antivirus, tea timer, ewido, ad-watch)... ( seul HijackThis doit être ouvert ) , et ensuite Clic [Fix checked]


Relance Hijackthis et clic sur « Do a system Scan only »
sur la page/rapport qui s'affiche ( laisse lui le temps de tout scanner ) 

Coche la case devant ces lignes ( et seulement celles-ci ) :

O2 - BHO: (no name) - {408EB49E-70F6-4FC9-B7BB-2B678BD8C7E4} - C:\WINDOWS\System32\jkhhf.dll

O2 - BHO: (no name) - {57D6708C-88E2-4CAB-9FA4-78BB8CA3A3C4} - C:\WINDOWS\System32\ljjgfgg.dll

O2 - BHO: (no name) - {ED9F3366-E24B-4E97-95F3-C64A4B267039} - C:\WINDOWS\System32\jkhhe.dll (file missing)

O4 - HKLM\..\Run: [Application Layer Gateway Service] C:\WINDOWS\System32\algs.exe

O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe

O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\gilsoh.exe

O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe

O4 - HKLM\..\Run: [mmsass] mmdmm.exe

O4 - HKLM\..\Run: [Topic MSNGR32] MSNGR32.com

O4 - HKLM\..\RunServices: [mmsass] mmdmm.exe

O4 - HKLM\..\RunServices: [Topic MSNGR32] MSNGR32.com

O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll

O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll

O20 - Winlogon Notify: ljjgfgg - C:\WINDOWS\SYSTEM32\ljjgfgg.dll

O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache
sch0st.exe

O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)



puis 

double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.


Citation : 

C:\WINDOWS\System32\dllcache
sch0st.exe

C:\WINDOWS\System32\gilsoh.exe

C:\WINDOWS\System32\lssas.exe

C:\WINDOWS\System32\algs.exe

C:\WINDOWS\System32\jkhhf.dll

C:\WINDOWS\System32\ljjgfgg.dll

C:\WINDOWS\System32\jkhhe.dll

C:\WINDOWS\System32\spoolsvc.exe

C:\WINDOWS\SYSTEM32\dbgcfg.dll

C:\WINDOWS\System32\urdvxc.exe

C:\WINDOWS\system\smss.exe



clique sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

fatoo · Answer

Bonjour,

je te poste le rapport OTmoveit

C:\WINDOWS\System32\dllcache
sch0st.exe moved successfully.
File/Folder  not found.
C:\WINDOWS\System32\gilsoh.exe moved successfully.
File/Folder  not found.
C:\WINDOWS\System32\lssas.exe moved successfully.
File/Folder  not found.
C:\WINDOWS\System32\algs.exe moved successfully.
File/Folder  not found.
DllUnregisterServer procedure not found in C:\WINDOWS\System32\jkhhf.dll
C:\WINDOWS\System32\jkhhf.dll NOT unregistered.
File move failed. C:\WINDOWS\System32\jkhhf.dll scheduled to be moved on reboot.
File/Folder  not found.
File/Folder C:\WINDOWS\System32\ljjgfgg.dll not found.
File/Folder  not found.
File/Folder C:\WINDOWS\System32\jkhhe.dll not found.
File/Folder  not found.
File/Folder C:\WINDOWS\System32\spoolsvc.exe not found.
File/Folder  not found.
DllUnregisterServer procedure not found in C:\WINDOWS\SYSTEM32\dbgcfg.dll
C:\WINDOWS\SYSTEM32\dbgcfg.dll NOT unregistered.
File move failed. C:\WINDOWS\SYSTEM32\dbgcfg.dll scheduled to be moved on reboot.
File/Folder  not found.
C:\WINDOWS\System32\urdvxc.exe moved successfully.
File/Folder  not found.
File/Folder C:\WINDOWS\system\smss.exe not found.
 
Created on 08/24/2007 11:15:13

duflox · Answer

ok refais moi un rapport hijackthis

merci

fatoo · Answer

Salut,

Voici le rapport demandé


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:20, on 25/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7AAFB95C-BDE7-4B80-948B-B8E476A59F88} - C:\WINDOWS\System32\jkhhf.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

salut

desolé de ne pas t avoir repondu avant!!!

le rapport hijackthis tu l a fait avant ou apres OTmoveit?

merci

fatoo · Answer

Bonjour,

pas de pb on a tous une vie...lol!
J'ai fais ce rapport après mais je t'en poste un autre

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:46:46, on 29/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {B49AEF01-09ED-4F8B-AC32-FC254B32F274} - C:\WINDOWS\System32\jkhhf.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\System32\jkhhf.dll
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

fait un scan ici 
https://www.bitdefender.fr/ 
et copie colle le résultat ici 
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE 
* Dans la nouvelle fenêtre, clique sur I agree 
* La fenêtre change encore, clique sur Click here to scan 
* Les signatures se chargent, etc. 

copie/colle le rapport sur le forum

fatoo · Answer

voici le rapport bitdefender, j'en ai copié collé 2 car le 1er ne me paraît pas très clair dans la forme

BitDefender Online Scanner - Rapport virus en temps réel
	

 
	

 

Généré à: Wed, Aug 29, 2007 - 19:36:49

 
	

 
	

 

Info d'analyse
	

 
	

 

Fichiers scannés
	

263937

Infectés Fichiers
	

214
	

 
	

 

 
	

 
	

 

Virus Détectés
	

 
	

 

MemScan:Trojan.Dropper.Agent.BON
	

2

Generic.Drop.Alpha.9A499F4F
	

1

Trojan.Clicker.Agent.NP
	

3

MemScan:Backdoor.Agent.YRG
	

3

Trojan.Downloader.ConHook.AI
	

1

DeepScan:Generic.Virtumonde.1.056312B2
	

2

Worm.P2P.AB
	

1

DeepScan:Generic.Ranky.5539181F
	

3

Win32.Kakavex.A
	

3

Trojan.Vundo.DMP
	

12

Backdoor.Agent.YRG
	

6

DeepScan:Generic.Virtumonde.1.F512A3DF
	

3

Trojan.Agent.ABKH
	

3

DeepScan:Generic.Virtumonde.1.7F0C6305
	

2

Trojan.BHO.AW
	

1

DeepScan:Generic.Malware.FYddld.49D6BFE9
	

1

MemScan:Trojan.Proxy.MQH
	

3

Trojan.Proxy.Agent.MX
	

1

MemScan:Trojan.Downloader.ConHook.AJ
	

1

Trojan.Vundo.DMV
	

3

DeepScan:Generic.Sdbot.C32AB491
	

3

Trojan.Peed.Gen
	

4

Trojan.Inject.BP
	

1

Trojan.Agent.AALN
	

3

DeepScan:Generic.Sdbot.31AB7D6C
	

3

Worm.Allaple.A
	

142

Backdoor.Vanbot.CX
	

1

MemScan:Trojan.Juan.V
	

1

Packer.Enigma.B
	

1



Je ne sais pas si c'est cxe rapport que tu souhaitais...voici un autre

BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Wed, Aug 29, 2007 - 19:33:06

 
	

 
	

 

Voie d'analyse: A:\;C:\;D:\;E:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

00:37:09

Fichiers
	

257772

Directoires
	

3739

Secteurs de boot
	

3

Archives
	

1274

Paquets programmes
	

11775
	

 
	

 

Résultats

Virus identifiés
	

30

Fichiers infectés
	

214

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

3

Fichiers effacés
	

387
	

 
	

 

Info sur les moteurs

Définition virus
	

750453

Version des moteurs
	

AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

Analyse des plugins
	

14

Archive des plugins
	

38

Unpack des plugins
	

6

E-mail plugins
	

6

Système plugins
	

1
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

*;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Q7Q1KZSR\84785_redworld[1].exe
	

Infecté par: DeepScan:Generic.Sdbot.C32AB491

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Q7Q1KZSR\84785_redworld[1].exe
	

Echec de la désinfection

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Q7Q1KZSR\84785_redworld[1].exe
	

Supprimé

C:\WINDOWS\system32\zatjyrbl.exe
	

Infecté par: Backdoor.Agent.YRG

C:\WINDOWS\system32\zatjyrbl.exe
	

Echec de la désinfection

C:\WINDOWS\system32\zatjyrbl.exe
	

Supprimé

C:\WINDOWS\system32\spooIsv.exe
	

Infecté par: Trojan.Agent.AALN

C:\WINDOWS\system32\spooIsv.exe
	

Echec de la désinfection

C:\WINDOWS\system32\spooIsv.exe
	

Supprimé

C:\WINDOWS\system32\qwwarnz.exe
	

Infecté par: DeepScan:Generic.Ranky.5539181F

C:\WINDOWS\system32\qwwarnz.exe
	

Echec de la désinfection

C:\WINDOWS\system32\qwwarnz.exe
	

Supprimé

C:\WINDOWS\system32\jkhhf.dll
	

Infecté par: DeepScan:Generic.Virtumonde.1.F512A3DF

C:\WINDOWS\system32\jkhhf.dll
	

Echec de la désinfection

C:\WINDOWS\system32\jkhhf.dll
	

Echec de la suppression

C:\WINDOWS\system32\mljjh.dll.vir
	

Infecté par: DeepScan:Generic.Virtumonde.1.7F0C6305

C:\WINDOWS\system32\mljjh.dll.vir
	

Echec de la désinfection

C:\WINDOWS\system32\mljjh.dll.vir
	

Supprimé

C:\WINDOWS\Help	sbjbtvn.exe
	

Infecté par: Worm.Allaple.A

C:\WINDOWS\Help	sbjbtvn.exe
	

Echec de la désinfection

C:\WINDOWS\Help	sbjbtvn.exe
	

Supprimé

C:\WINDOWS\Help\jbnshhqj.exe
	

Infecté par: Worm.Allaple.A

C:\WINDOWS\Help\jbnshhqj.exe
	

Echec de la désinfection

C:\WINDOWS\Help\jbnshhqj.exe
	

Supprimé

C:\WINDOWS\Help\bzehxvnz.exe
	

Infecté par: Worm.Allaple.A

C:\WINDOWS\Help\bzehxvnz.exe
	

Echec de la désinfection

C:\WINDOWS\Help\bzehxvnz.exe
	

Supprimé

C:\WINDOWS\Help\hwexrtne.exe
	

Infecté par: Worm.Allaple.A

C:\WINDOWS\Help\hwexrtne.exe
	

Echec de la désinfection

C:\WINDOWS\Help\hwexrtne.exe
	

Supprimé

C:\WINDOWS\Help\jjlenkbt.exe
	

Infecté par: Worm.Allaple.A

C:\WINDOWS\Help\jjlenkbt.exe
	

Echec de la désinfection

C:\WINDOWS\Help\jjlenkbt.exe
	

Supprimé

C:\FOUND.000\FILE0007.CHK=>(Quarantine-PE)
	

Infecté par: Backdoor.Agent.YRG

C:\FOUND.000\FILE0007.CHK=>(Quarantine-PE)
	

Echec de la désinfection

C:\FOUND.000\FILE0007.CHK=>(Quarantine-PE)
	

Supprimé

C:\FOUND.000\FILE0009.CHK=>(Quarantine-PE)
	

Infecté par: Backdoor.Agent.YRG

C:\FOUND.000\FILE0009.CHK=>(Quarantine-PE)
	

Echec de la désinfection

C:\FOUND.000\FILE0009.CHK=>(Quarantine-PE)
	

Supprimé

C:\Documents and Settings\fatseb\Local Settings\Temp\gofcsyqa.dll
	

Infecté par: Trojan.Vundo.DMP

C:\Documents and Settings\fatseb\Local Settings\Temp\gofcsyqa.dll
	

Supprimé

C:\Documents and Settings\fatseb\Local Settings\Temp\wewompif.dll
	

Infecté par: Trojan.Vundo.DMP

C:\Documents and Settings\fatseb\Local Settings\Temp\wewompif.dll
	

Supprimé

C:\Program Files\Eset\infected\CIXLMKDA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\CIXLMKDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\D4SABKCA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\D4SABKCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\YIO0PRDA.NQF=>(Quarantine-PE)
	

Infecté par: DeepScan:Generic.Sdbot.31AB7D6C

C:\Program Files\Eset\infected\YIO0PRDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\YIO0PRDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DBKXJWBA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Backdoor.Agent.YRG

C:\Program Files\Eset\infected\DBKXJWBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\DBKXJWBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EIO5DCBA.NQF=>(Quarantine-PE)
	

Infecté par: Packer.Enigma.B

C:\Program Files\Eset\infected\EIO5DCBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\EIO5DCBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\25XFBGAA.NQF=>(Quarantine-PE)
	

Infecté par: DeepScan:Generic.Sdbot.C32AB491

C:\Program Files\Eset\infected\25XFBGAA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\25XFBGAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MJISKMDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MJISKMDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\GOCB52AA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Clicker.Agent.NP

C:\Program Files\Eset\infected\GOCB52AA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\GOCB52AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DQ0S30DA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\DQ0S30DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MQYEJNBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MQYEJNBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DOVVRPAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DOVVRPAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\R1QLXRBA.NQF=>(Quarantine-PE)
	

Infecté par: Generic.Drop.Alpha.9A499F4F

C:\Program Files\Eset\infected\R1QLXRBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\R1QLXRBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\4FXLUQCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\4FXLUQCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FCORQMBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FCORQMBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ND23RKDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ND23RKDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\VAJOFPAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\VAJOFPAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\GOKSBIBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\GOKSBIBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\HNRIVZAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\HNRIVZAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\022LK1BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\022LK1BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DHFRZABA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DHFRZABA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\NGFWDLDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\NGFWDLDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ACSFKYAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ACSFKYAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\PDQIDYCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\PDQIDYCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0YDCQLCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0YDCQLCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\4TLXXRAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\4TLXXRAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0IUM11DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0IUM11DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\H3T3VVDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\H3T3VVDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DO2KHBBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DO2KHBBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\5YLSQJAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\5YLSQJAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BYPLFRCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BYPLFRCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FW5M51BA.NQF=>(Quarantine-PE)
	

Infecté par: Backdoor.Agent.YRG

C:\Program Files\Eset\infected\FW5M51BA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\FW5M51BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\HOIOW3CA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Backdoor.Agent.YRG

C:\Program Files\Eset\infected\HOIOW3CA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\HOIOW3CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\XOFD0ZBA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Inject.BP

C:\Program Files\Eset\infected\XOFD0ZBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\XOFD0ZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\AQIKJ3AA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMV

C:\Program Files\Eset\infected\AQIKJ3AA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\AQIKJ3AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\GBVUDSAA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMV

C:\Program Files\Eset\infected\GBVUDSAA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\GBVUDSAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\TJFB1ICA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Dropper.Agent.BON

C:\Program Files\Eset\infected\TJFB1ICA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\TJFB1ICA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\2VT3Z5BA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Clicker.Agent.NP

C:\Program Files\Eset\infected\2VT3Z5BA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\2VT3Z5BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1JFXLQCA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\1JFXLQCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\R3FTAHDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\R3FTAHDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\X2UOFZBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\X2UOFZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BL41XRAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BL41XRAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\2MPYSEDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\2MPYSEDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\XIV54ECA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\XIV54ECA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\D324RLBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\D324RLBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ZUIAZ5AA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ZUIAZ5AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\I1BPH3DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\I1BPH3DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DLGXHXBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DLGXHXBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\24XJF2CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\24XJF2CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\5SPPZ0BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\5SPPZ0BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\S2MRHLAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\S2MRHLAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\SGHYXSDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\SGHYXSDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\QOPXHWCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\QOPXHWCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\TEOQSIBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\TEOQSIBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\YCNDA1CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\YCNDA1CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0QI3UQDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0QI3UQDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\IKZWTQBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\IKZWTQBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\M13OLPCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\M13OLPCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EU3422AA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\EU3422AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0E3PJJDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0E3PJJDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BKWQQ0CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BKWQQ0CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ALNCEMCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ALNCEMCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1TRIQQAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\1TRIQQAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ZHHBGRCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ZHHBGRCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1M2L0YBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\1M2L0YBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\Q3EAIOCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\Q3EAIOCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\GNYQACAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\GNYQACAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\OLWPEKDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\OLWPEKDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\D0M4HLCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\D0M4HLCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\JGYGRTDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\JGYGRTDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\KUEZF5DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\KUEZF5DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0LAZ3JDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0LAZ3JDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\3RNBQYBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\3RNBQYBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\5MQAVWCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\5MQAVWCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BQX1UJBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BQX1UJBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FOMWYZBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FOMWYZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\UJ23VUBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\UJ23VUBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\RZADPCBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\RZADPCBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\IZI4JZCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\IZI4JZCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BV2SEDDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BV2SEDDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\2H3M2DAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\2H3M2DAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DNTWG1DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DNTWG1DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FXUGI2BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FXUGI2BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\U1SDWXAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\U1SDWXAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BMOFZWBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BMOFZWBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\BLIZD1DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\BLIZD1DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\IORGVPAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\IORGVPAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\UID5H5BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\UID5H5BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FLQU0BBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FLQU0BBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\T0ADYDAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\T0ADYDAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\JLVLACBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\JLVLACBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EUKHBVBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\EUKHBVBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\2WC0U2DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\2WC0U2DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ZJDAHZBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ZJDAHZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\IYZ0ROAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\IYZ0ROAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\D2X4R5DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\D2X4R5DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\W4XP3JCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\W4XP3JCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\LT1UF1BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\LT1UF1BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FCOYSXBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FCOYSXBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\Y2WGKBAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\Y2WGKBAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\CYLAVZBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\CYLAVZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\JZKR4YDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\JZKR4YDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\TM0ECQBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\TM0ECQBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\TB5XVNBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\TB5XVNBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MBQDW3AA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MBQDW3AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\OOUKIIBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\OOUKIIBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1CILQADA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\1CILQADA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\22IK2MAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\22IK2MAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\E3TYSSDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\E3TYSSDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\XAI3KHAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\XAI3KHAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\DLIX4IBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\DLIX4IBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\AQZS0NAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\AQZS0NAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\JRE241CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\JRE241CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MUW1KQCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MUW1KQCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0N1BNJBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0N1BNJBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ANSDFRDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ANSDFRDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\XNPHULCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\XNPHULCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1BZQYUBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\1BZQYUBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\KS2VZMCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\KS2VZMCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MVATMSBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MVATMSBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\QTXRYDBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\QTXRYDBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\H3QFGHAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\H3QFGHAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ILKB3IBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ILKB3IBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MAURAHBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MAURAHBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\1ABX1EBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\1ABX1EBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0CY2C2DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0CY2C2DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\C0I53CBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\C0I53CBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\HMUVH2AA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMV

C:\Program Files\Eset\infected\HMUVH2AA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\HMUVH2AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\RVH4XSAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\RVH4XSAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\AQHHLHDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\AQHHLHDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\COXCW4DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\COXCW4DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\HONGVZCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\HONGVZCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\34IUBLDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\34IUBLDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\WUM5Z4DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\WUM5Z4DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\WEJ43TCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\WEJ43TCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\0VYWDOAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\0VYWDOAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\WNL2RACA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\WNL2RACA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\JLSGSRCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\JLSGSRCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\O0XZJGAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\O0XZJGAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\COFNHHCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\COFNHHCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\WZGLWVAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\WZGLWVAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ND5LR1DA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ND5LR1DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EJDBTGCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\EJDBTGCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\AJESH0CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\AJESH0CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\MILET0AA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\MILET0AA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FGGUY3CA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\FGGUY3CA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\D45SHQDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\D45SHQDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ZBOE53BA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\ZBOE53BA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\5WSFRVCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\5WSFRVCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\I0JY5ICA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Juan.V

C:\Program Files\Eset\infected\I0JY5ICA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\I0JY5ICA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\RHXYVTBA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\RHXYVTBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\VF2ABADA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\VF2ABADA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\RVW4GWBA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\RVW4GWBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\ILBZRSAA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\ILBZRSAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EUF4M3DA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\EUF4M3DA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\FPEOCZDA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Vundo.DMP

C:\Program Files\Eset\infected\FPEOCZDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\IFUTONDA.NQF=>(Quarantine-PE)
	

Infecté par: Backdoor.Agent.YRG

C:\Program Files\Eset\infected\IFUTONDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\IFUTONDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\QH13DHDA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Agent.AALN

C:\Program Files\Eset\infected\QH13DHDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\QH13DHDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\UCEXMPDA.NQF=>(Quarantine-PE)
	

Infecté par: DeepScan:Generic.Ranky.5539181F

C:\Program Files\Eset\infected\UCEXMPDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

C:\Program Files\Eset\infected\UCEXMPDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\G1LDMLAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\G1LDMLAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\VVAS5NAA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\VVAS5NAA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\XXIGHZBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\XXIGHZBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\EVSKMCDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\EVSKMCDA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\AWJ5TFCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\AWJ5TFCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\3RNBQYBA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\3RNBQYBA.NQF=>(Quarantine-PE)
	

Supprimé

C:\Program Files\Eset\infected\5MQAVWCA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.Allaple.A

C:\Program Files\Eset\infected\5MQAVWCA.NQF=>(Quarantine-PE)
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002636.exe
	

Infecté par: Trojan.Clicker.Agent.NP

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002636.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002636.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002637.DLL
	

Infecté par: DeepScan:Generic.Virtumonde.1.056312B2

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002637.DLL
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002637.DLL
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002666.dll
	

Infecté par: DeepScan:Generic.Virtumonde.1.7F0C6305

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002666.dll
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002666.dll
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004692.exe
	

Infecté par: Trojan.Peed.Gen

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004692.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004692.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004695.DLL
	

Infecté par: Trojan.Agent.ABKH

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004695.DLL
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004695.DLL
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004696.EXE
	

Infecté par: Trojan.Peed.Gen

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004696.EXE
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004696.EXE
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004697.exe
	

Infecté par: MemScan:Backdoor.Agent.YRG

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004697.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004697.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004712.exe
	

Infecté par: DeepScan:Generic.Sdbot.31AB7D6C

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004712.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004712.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007985.exe
	

Infecté par: DeepScan:Generic.Sdbot.31AB7D6C

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007985.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007985.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008991.exe
	

Infecté par: Backdoor.Agent.YRG

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008991.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008991.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008992.exe
	

Infecté par: Trojan.Agent.AALN

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008992.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008992.exe
	

Supprimé

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008993.exe
	

Infecté par: DeepScan:Generic.Ranky.5539181F

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008993.exe
	

Echec de la désinfection

C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0008993.exe
	

Supprimé

C:\FOUND.001\FILE0006.CHK=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Dropper.Agent.BON

C:\FOUND.001\FILE0006.CHK=>(Quarantine-PE)
	

Echec de la désinfection

C:\FOUND.001\FILE0006.CHK=>(Quarantine-PE)
	

Supprimé

C:\VundoFix Backups\jkhhe.dll.bad
	

Infecté par: DeepScan:Generic.Virtumonde.1.056312B2

C:\VundoFix Backups\jkhhe.dll.bad
	

Echec de la désinfection

C:\VundoFix Backups\jkhhe.dll.bad
	

Supprimé

C:\VundoFix Backups\vtstttt.dll.bad
	

Infecté par: Trojan.Agent.ABKH

C:\VundoFix Backups\vtstttt.dll.bad
	

Echec de la désinfection

C:\VundoFix Backups\vtstttt.dll.bad
	

Supprimé

C:\QooBox\Quarantine\C\WINDOWS\system32\1.exe.vir
	

Infecté par: Trojan.Peed.Gen

C:\QooBox\Quarantine\C\WINDOWS\system32\1.exe.vir
	

Echec de la désinfection

C:\QooBox\Quarantine\C\WINDOWS\system32\1.exe.vir
	

Supprimé

C:\QooBox\Quarantine\C\WINDOWS\system32\vtstttt.dll.vir
	

Infecté par: Trojan.Agent.ABKH

C:\QooBox\Quarantine\C\WINDOWS\system32\vtstttt.dll.vir
	

Echec de la désinfection

C:\QooBox\Quarantine\C\WINDOWS\system32\vtstttt.dll.vir
	

Supprimé

C:\QooBox\Quarantine\C\WINDOWS\system\smss.exe.vir
	

Infecté par: Trojan.Peed.Gen

C:\QooBox\Quarantine\C\WINDOWS\system\smss.exe.vir
	

Echec de la désinfection

C:\QooBox\Quarantine\C\WINDOWS\system\smss.exe.vir
	

Supprimé

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\dllcache
sch0st.exe
	

Infecté par: DeepScan:Generic.Sdbot.C32AB491

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\dllcache
sch0st.exe
	

Echec de la désinfection

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\dllcache
sch0st.exe
	

Supprimé

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\algs.exe
	

Infecté par: Backdoor.Vanbot.CX

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\algs.exe
	

Echec de la désinfection

C:\_OTMoveIt\MovedFiles\WINDOWS\System32\algs.exe
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\4N2VLSBA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Proxy.MQH

D:\Logiciels\Program Files\ESET\infected\4N2VLSBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\4N2VLSBA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\4ZTP5BCA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Proxy.MQH

D:\Logiciels\Program Files\ESET\infected\4ZTP5BCA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\4ZTP5BCA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\DRNJDBAA.NQF=>(Quarantine-PE)
	

Infecté par: Win32.Kakavex.A

D:\Logiciels\Program Files\ESET\infected\DRNJDBAA.NQF=>(Quarantine-PE)
	

Désinfecté

D:\Logiciels\Program Files\ESET\infected\DRNJDBAA.NQF
	

Echec de la mise à jour

D:\Logiciels\Program Files\ESET\infected\IL1BWMAA.NQF=>(Quarantine-PE)
	

Infecté par: Win32.Kakavex.A

D:\Logiciels\Program Files\ESET\infected\IL1BWMAA.NQF=>(Quarantine-PE)
	

Désinfecté

D:\Logiciels\Program Files\ESET\infected\IL1BWMAA.NQF
	

Echec de la mise à jour

D:\Logiciels\Program Files\ESET\infected\LPLJN3DA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Downloader.ConHook.AJ

D:\Logiciels\Program Files\ESET\infected\LPLJN3DA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\LPLJN3DA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\RL3IIDDA.NQF=>(Quarantine-PE)
	

Infecté par: Worm.P2P.AB

D:\Logiciels\Program Files\ESET\infected\RL3IIDDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\RL3IIDDA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\T4JBEKDA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Proxy.Agent.MX

D:\Logiciels\Program Files\ESET\infected\T4JBEKDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\T4JBEKDA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\VQJ2JLBA.NQF=>(Quarantine-PE)
	

Infecté par: MemScan:Trojan.Proxy.MQH

D:\Logiciels\Program Files\ESET\infected\VQJ2JLBA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\VQJ2JLBA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\VRAWJEDA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.Downloader.ConHook.AI

D:\Logiciels\Program Files\ESET\infected\VRAWJEDA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\VRAWJEDA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\WUI5TACA.NQF=>(Quarantine-PE)
	

Infecté par: Win32.Kakavex.A

D:\Logiciels\Program Files\ESET\infected\WUI5TACA.NQF=>(Quarantine-PE)
	

Désinfecté

D:\Logiciels\Program Files\ESET\infected\WUI5TACA.NQF
	

Echec de la mise à jour

D:\Logiciels\Program Files\ESET\infected\WYBKQWAA.NQF=>(Quarantine-PE)
	

Infecté par: DeepScan:Generic.Malware.FYddld.49D6BFE9

D:\Logiciels\Program Files\ESET\infected\WYBKQWAA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\WYBKQWAA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\Program Files\ESET\infected\ZCLKC1CA.NQF=>(Quarantine-PE)
	

Infecté par: Trojan.BHO.AW

D:\Logiciels\Program Files\ESET\infected\ZCLKC1CA.NQF=>(Quarantine-PE)
	

Echec de la désinfection

D:\Logiciels\Program Files\ESET\infected\ZCLKC1CA.NQF=>(Quarantine-PE)
	

Supprimé

D:\Logiciels\sécurité scan\hijackthis\backups\backup-20070824-111216-979.dll
	

Infecté par: DeepScan:Generic.Virtumonde.1.F512A3DF

D:\Logiciels\sécurité scan\hijackthis\backups\backup-20070824-111216-979.dll
	

Echec de la désinfection

D:\Logiciels\sécurité scan\hijackthis\backups\backup-20070824-111216-979.dll
	

Supprimé

D:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009001.dll
	

Infecté par: DeepScan:Generic.Virtumonde.1.F512A3DF

D:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009001.dll
	

Echec de la désinfection

D:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009001.dll
	

Supprimé
	

 

 
	

 
	

 
	

 

 
	

 
	

 

 
	

 
	

 

Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.

duflox · Answer

tu vois ce n est pas en formatant que tu resout tes problemes !!!!
y avait encore du monde sur ton pc !!
mais y a encore quelque truc qu il n as pas effacés mais c est normal......
alors:

telecharge http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

Double-clic sur combofix il vas te demander une question repond oui touche y puis attends que combofix soit fini il vas generer un rapport 

Poste le sur le forum dans ta reponse

fatoo · Answer

oui c'est vrai qu'en réinstallant je croyais choisir la solution de facilité mais tous ces messages que m'envoyait mon antivirus me faisait mal à la tête...!! lol en parlant d'antivirus tu pourrais m'en conseiller un bon...j'ai NOD32 et je l'ai choisit en regardant un comparatif d'antivirus sur un site mais vu tout le monde qu'il y avait sur mon pc..... ComboFix 07-08-17.2 - "fatseb" 2007-08-29 20:47:25.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.110 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\fatseb\APPLIC~1 mp228.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mp25.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mp271.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mp2D.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mp2E.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mp92.tmp.exe C:\DOCUME~1\fatseb\APPLIC~1 mpC0.tmp.exe C:\WINDOWS\system32\fhhkj.bak1 C:\WINDOWS\system32\fhhkj.bak2 C:\WINDOWS\system32\fhhkj.ini C:\WINDOWS\system32\jkhhf.dll ((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-29 ))))))))))))))))))))))))))))))) 2007-08-29 18:53 d-------- C:\WINDOWS\BDOSCAN8 2007-08-24 20:33 d-------- C:\DOCUME~1\fatseb\APPLIC~1\Nokia Multimedia Player 2007-08-24 20:12 d-------- C:\Program Files\Fichiers communs\Nokia 2007-08-24 20:11 8,704 --a------ C:\WINDOWS\system32\drivers mwcdc.sys 2007-08-24 20:11 4,608 --a------ C:\WINDOWS\system32 mwcdlog.dll 2007-08-24 20:11 30,720 --a------ C:\WINDOWS\system32 mwcdcocls.dll 2007-08-24 20:11 13,312 --a------ C:\WINDOWS\system32\drivers mwcdcm.sys 2007-08-24 20:11 127,488 --a------ C:\WINDOWS\system32\drivers mwcd.sys 2007-08-24 20:11 d-------- C:\Program Files\Nokia 2007-08-24 20:11 d-------- C:\Program Files\Fichiers communs\PCSuite 2007-08-24 19:30 d-------- C:\WINDOWS\system32\appmgmt 2007-08-24 18:00 d-------- C:\DOCUME~1\fatseb\APPLIC~1\AdobeUM 2007-08-24 17:58 d-------- C:\DOCUME~1\fatseb\Phone Browser 2007-08-24 17:58 d-------- C:\DOCUME~1\fatseb\APPLIC~1\Datalayer 2007-08-24 17:56 d-------- C:\DOCUME~1\fatseb\APPLIC~1\Nokia 2007-08-24 17:55 d-------- C:\Program Files\DIFX 2007-08-24 17:52 d-------- C:\DOCUME~1\fatseb\APPLIC~1\PC Suite 2007-08-24 17:52 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite 2007-08-24 17:51 50,688 --a------ C:\WINDOWS\system32 mwcdcls.dll 2007-08-24 17:51 d-------- C:\WINDOWS\system32\DRVSTORE 2007-08-24 17:50 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations 2007-08-24 17:49 d--hs---- C:\WINDOWS\ftpcache 2007-08-24 15:45 1,156 --a------ C:\WINDOWS\mozver.dat 2007-08-23 21:29 69,632 -ra------ C:\WINDOWS\system32\odbcconf.exe 2007-08-23 21:29 126,976 -ra------ C:\WINDOWS\system32\odbcconf.dll 2007-08-23 21:29 d-------- C:\WINDOWS\RegisteredPackages 2007-08-23 21:26 d-------- C:\Program Files\Fichiers communs\HP 2007-08-23 21:24 d-------- C:\Program Files\Hewlett-Packard 2007-08-23 21:24 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard 2007-08-23 21:23 82,432 -ra------ C:\WINDOWS\system32\MSXML4r.dll 2007-08-23 21:23 626,960 -ra------ C:\WINDOWS\system32\hpvaut32.dll 2007-08-23 21:23 487,424 -ra------ C:\WINDOWS\system32\hpvcp70.dll 2007-08-23 21:23 44,544 -ra------ C:\WINDOWS\system32\MSXML4a.dll 2007-08-23 21:23 344,064 -ra------ C:\WINDOWS\system32\hpvcr70.dll 2007-08-23 21:23 1,230,336 -ra------ C:\WINDOWS\system32\MSXML4.dll 2007-08-23 21:21 d-------- C:\Program Files\Fichiers communs\Hewlett-Packard 2007-08-23 21:20 d-------- C:\WINDOWS\system32\URTTemp 2007-08-23 21:18 51,088 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys 2007-08-23 21:18 182,880 --a------ C:\WINDOWS\system32\iuengine.dll 2007-08-23 21:18 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2007-08-23 21:17 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2007-08-23 21:17 65,536 --a------ C:\WINDOWS\system32\HPZipm12.exe 2007-08-23 21:17 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe 2007-08-23 21:17 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2007-08-23 21:17 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2007-08-23 21:17 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys 2007-08-23 21:17 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2007-08-23 21:17 13,824 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-08-23 20:54 d-------- C:\Program Files\HP 2007-08-23 20:46 17,176 --------- C:\WINDOWS\hpomdl04.dat 2007-08-23 20:46 104,265 --a------ C:\WINDOWS\hpoins04.dat 2007-08-23 20:12 5,894 --a------ C: enpo.bat 2007-08-23 16:04 288,039 --a------ C:\WINDOWS\system32\dn98da0c22.dat 2007-08-22 20:58 d--hs---- C:\FOUND.005 2007-08-22 20:57 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-22 20:57 dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer 2007-08-22 20:57 d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau 2007-08-22 20:57 d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression 2007-08-22 20:57 d--h----- C:\DOCUME~1\ADMINI~1\ModŠles 2007-08-22 20:57 d-------- C:\DOCUME~1\ADMINI~1\Mes documents 2007-08-22 20:57 d-------- C:\DOCUME~1\ADMINI~1\Favoris 2007-08-22 20:57 d-------- C:\DOCUME~1\ADMINI~1\Bureau 2007-08-22 20:56 d--hs---- C:\FOUND.004 2007-08-22 20:54 d--hs---- C:\FOUND.003 2007-08-22 10:30 43,542 --a------ C:\WINDOWS\system32\xxyywut.dll 2007-08-21 20:50 43,542 --a------ C:\WINDOWS\system32\ddcbcbb.dll 2007-08-21 20:50 118 --a------ C:\WINDOWS\system32\gsccp.bat 2007-08-21 20:49 d--hs---- C:\FOUND.002 2007-08-21 20:46 51,200 --a------ C:\WINDOWS ircmd.exe 2007-08-21 20:44 43,542 --a------ C:\WINDOWS\system32\qommjih.dll 2007-08-21 20:39 43,542 --a------ C:\WINDOWS\system32\vtusrrq.dll 2007-08-21 20:05 6,513 ---hs---- C:\WINDOWS\system32\hjjlm.bak1 2007-08-21 20:01 43,542 --a------ C:\WINDOWS\system32\yayyvut.dll 2007-08-21 19:49 d-------- C:\VundoFix Backups 2007-08-21 19:43 43,542 --a------ C:\WINDOWS\system32\awtromj.dll 2007-08-21 19:33 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1 View_Profiles 2007-08-21 17:16 43,542 --a------ C:\WINDOWS\system32\mljiggf.dll 2007-08-21 16:55 36,224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys 2007-08-21 16:55 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-08-21 16:53 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-21 16:52 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-08-21 16:52 d-------- C:\DOCUME~1\fatseb\WINDOWS 2007-08-21 16:49 43,542 --a------ C:\WINDOWS\system32\khfeffe.dll 2007-08-21 16:46 86,016 -ra------ C:\WINDOWS\system32 vrszht.dll 2007-08-21 16:46 843,776 -ra------ C:\WINDOWS\system32 wiz.exe 2007-08-21 16:46 81,920 -ra------ C:\WINDOWS\system32 vwddi.dll 2007-08-21 16:46 81,920 -ra------ C:\WINDOWS\system32 vmctray.dll 2007-08-21 16:46 5,222,400 -ra------ C:\WINDOWS\system32 voglnt.dll 2007-08-21 16:46 454,656 -ra------ C:\WINDOWS\system32 vshell.dll 2007-08-21 16:46 438,272 -ra------ C:\WINDOWS\system32 vappbar.exe 2007-08-21 16:46 4,112,384 -ra------ C:\WINDOWS\system32 vcpl.dll 2007-08-21 16:46 352,256 -ra------ C:\WINDOWS\system32\keystone.exe 2007-08-21 16:46 32,256 -ra------ C:\WINDOWS\system32 vcodins.dll 2007-08-21 16:46 32,256 -ra------ C:\WINDOWS\system32 vcod.dll 2007-08-21 16:46 3,740,032 -ra------ C:\WINDOWS\system32 v4_disp.dll 2007-08-21 16:46 294,912 -ra------ C:\WINDOWS\system32 vwrses.dll 2007-08-21 16:46 294,912 -ra------ C:\WINDOWS\system32 vwrsel.dll 2007-08-21 16:46 286,720 -ra------ C:\WINDOWS\system32 vwrsesm.dll 2007-08-21 16:46 282,624 -ra------ C:\WINDOWS\system32 vwrspt.dll 2007-08-21 16:46 282,624 -ra------ C:\WINDOWS\system32 vwrsit.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-21 19:41 2112 --a------ C:\WINDOWS\pchealth\HELPCTR\PackageStore\SkuStore.bin 2007-08-20 18:14 57856 --a------ C:\WINDOWS\web\wcxnjhhj.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\Tours\WindowsMediaPlayer\Cnt jnbzhbh.exe 2007-08-20 18:14 57856 --a------ C:\WINDOWS\help\Tours\WindowsMediaPlayer\Audio\lllknblj.exe 2007-08-20 17:01 8738 --a------ C:\WINDOWS\pchealth\HELPCTR\Config\Cntstore.bin 2007-08-13 08:52 318369 --a------ C:\Program Files\HiJackThis.zip 2001-08-28 10:00:00 70,102 --sh--r C:\WINDOWS\system32\mmdmm.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cmaudio"="cmicnfg.cpl" [] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-08-21 10:29] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-07-12 10:50] "nwiz"="nwiz.exe" [2004-07-12 10:50 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-07-12 10:50] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 13:38] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18] "Adobe Photo Downloader"="D:\Logiciels\3.0\Apps\apdproxy.exe" [2005-06-23 20:33] "PCSuiteTrayApplication"="D:\LOGICI~1\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-28 12:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2001-08-02 07:14] "PcSync"="D:\Logiciels\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 22:31:38] D‚marrage rapide du logiciel HP Image Zone.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 23:06:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\dbgcfg] dbgcfg.dll 2007-08-20 17:19 94651 C:\WINDOWS\system32\dbgcfg.dll R3 FETNDIS;Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet;C:\WINDOWS\System32\DRIVERS\fetnd5.sys S2 MSWindows;Network Windows Service;"C:\WINDOWS\System32\urdvxc.exe" /service S2 WINNTSMSS;Windows NT Session Manager;"C:\WINDOWS\system\smss.exe" S4 Microsoft Agent;Microsoft Agent;"C:\WINDOWS\System32\dllcache sch0st.exe" Contents of the 'Scheduled Tasks' folder 2007-08-23 19:34:42 C:\WINDOWS\Tasks\WebReg 20070823213440.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-29 20:49:57 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-29 20:50:50 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-29 20:50 C:\ComboFix2.txt ... 2007-08-21 20:50 --- E O F ---

duflox · Answer

si tu veux un antivirus performant mais en anglais:
   telecharges antivir:

cliques sur le liens:
     https://www.avira.com/en/prime

regardes le tuto:
    https://www.malekal.com/avira-free-security-antivirus-gratuit/

si tu veux un antivirus un peu moins perormant mais en francais:
    telecharges avast:
cliques sur le lien: 
         https://www.avast.com/free-antivirus-download

regardes le tuto:
        https://www.malekal.com/tutoriel-antivirus-avast/

l un ou l autre c est toi qui voit

sur ce refais moi un rapport hijackthis

merci

fatoo · Answer

Merci pour les infos mais il faut alors que je supprime mon antivirus actuel?!!!! si c'est la cas je vais attendre octobre 2007 date à laquelle j'ai fini mon abonnement...
Voici le rapport



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:29:00, on 29/08/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG10.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

* télécharge AVG Anti-Spyware 

avg antispyware 
http://www.infos-du-net.com/telecharger/Ewido-Security-Suite,0301-734.html 


Tuto : http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 

* tu l'installes 

Démarrer AVG antispyware. Cliquer sur "mise à jour", cliquer sur le bouton "Commencer la mise à jour" et attendre la fin de cette mise à jour puis, fermer le programme. 

si tu n'arrives pas à le mettre à jour prends ici les Mise à jour: 

http://downloads.ewido.net/avgas-signatures-full-current.exe 



Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

relance AVG AS et cliquer sur l'onglet "scanner" puis sur "Analyse complète du système". 
Une fois le scan terminé, il t'affiche un rapport. Cliquer sur "configurer..." en bas a gauche et choisir "supprimer". Ensuite cliquer sur "Appliquer toutes les actions ", ca va supprimer toutes les infections détectées. 
Ensuite cliquer sur "Enregistrer le rapport d'analyse" -> "enregistrer sous" et enregistrer le rapport où bon te semble, afin de me l'envoyer dans ta prochaine réponse. 


Copie Et colle le rapport ici

fatoo · Answer

Je t'envoie le rapport sachant que j'ai supprimé toutes les menaces après l'édition du rapport car l'option "configurer" n'est pas apparu de suite j'ai dû cliquer manuellement sur "ignoré" pour changer l'option en "supprimé"


AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:46:43 30/08/2007

 + Résultat de l'analyse:	



HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Ignoré.
C:\WINDOWS\system32\mmdmm.exe -> Backdoor.Rbot.crt : Ignoré.
:mozilla.371:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.2o7 : Ignoré.
:mozilla.80:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.2o7 : Ignoré.
:mozilla.81:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.2o7 : Ignoré.
:mozilla.82:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.2o7 : Ignoré.
C:\Documents and Settings\fatseb\Cookies\fatseb@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Ignoré.
:mozilla.213:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.214:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.216:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.220:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adrevolver : Ignoré.
:mozilla.319:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adtech : Ignoré.
:mozilla.320:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adtech : Ignoré.
:mozilla.233:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Advertising : Ignoré.
:mozilla.235:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Advertising : Ignoré.
:mozilla.236:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Advertising : Ignoré.
:mozilla.237:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Advertising : Ignoré.
:mozilla.200:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Adviva : Ignoré.
:mozilla.142:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Atdmt : Ignoré.
:mozilla.102:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\fatseb\Cookies\fatseb@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Ignoré.
:mozilla.298:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Dealtime : Ignoré.
:mozilla.299:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Dealtime : Ignoré.
:mozilla.39:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Doubleclick : Ignoré.
:mozilla.57:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Estat : Ignoré.
:mozilla.178:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Fastclick : Ignoré.
:mozilla.179:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Fastclick : Ignoré.
:mozilla.294:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.300:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.301:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.372:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.425:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.428:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Googleadservices : Ignoré.
:mozilla.175:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Hitbox : Ignoré.
:mozilla.176:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Hitbox : Ignoré.
:mozilla.177:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Hitbox : Ignoré.
:mozilla.92:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignoré.
:mozilla.93:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignoré.
:mozilla.104:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Mediaplex : Ignoré.
C:\Documents and Settings\fatseb\Cookies\fatseb@mediaplex[1].txt -> TrackingCookie.Mediaplex : Ignoré.
:mozilla.143:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Netflame : Ignoré.
C:\Documents and Settings\fatseb\Cookies\fatseb@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Ignoré.
:mozilla.241:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Paypal : Ignoré.
:mozilla.436:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Reliablestats : Ignoré.
:mozilla.437:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Reliablestats : Ignoré.
:mozilla.438:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Reliablestats : Ignoré.
:mozilla.439:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Reliablestats : Ignoré.
:mozilla.440:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Reliablestats : Ignoré.
:mozilla.336:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.337:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.338:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.339:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.340:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.341:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Serving-sys : Ignoré.
:mozilla.34:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.35:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.36:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.37:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.38:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.
:mozilla.360:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Specificclick : Ignoré.
:mozilla.361:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Specificclick : Ignoré.
:mozilla.362:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Specificclick : Ignoré.
:mozilla.363:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Specificclick : Ignoré.
:mozilla.365:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Spylog : Ignoré.
:mozilla.368:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Statcounter : Ignoré.
:mozilla.17:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignoré.
:mozilla.18:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignoré.
:mozilla.334:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignoré.
:mozilla.109:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
:mozilla.110:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
:mozilla.111:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Weborama : Ignoré.
:mozilla.125:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Webtrends : Ignoré.
:mozilla.369:C:\Documents and Settings\fatseb\Application Data\Mozilla\Firefox\Profiles\8g65vrdd.default\cookies.txt -> TrackingCookie.Yadro : Ignoré.
C:\FOUND.000\FILE0013.CHK -> Trojan.Zapchast : Ignoré.
C:	enpo.bat -> Trojan.Zapchast : Ignoré.


Fin du rapport

duflox · Answer

tu n as pas fais ce que je t ai ecris:

relance AVG AS et cliquer sur l'onglet "scanner" puis sur "Analyse complète du système". 
Une fois le scan terminé, il t'affiche un rapport. Cliquer sur "configurer..." en bas a gauche et choisir "supprimer". Ensuite cliquer sur "Appliquer toutes les actions ", ca va supprimer toutes les infections détectées. 
Ensuite cliquer sur "Enregistrer le rapport d'analyse" -> "enregistrer sous" et enregistrer le rapport où bon te semble, afin de me l'envoyer dans ta prochaine réponse.

fatoo · Answer

salut!

voici le rapport



AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	21:01:20 30/08/2007

 + Résultat de l'analyse:	



Rien à signaler.


Fin du rapport

duflox · Answer

tu l as fais en mode sans echec le 2 eme scan?

fatoo · Answer

bonjour,

oui en mode sans echec

duflox · Answer

ok alors refais moi un rapport hijackthis !!!normalement ca devrais etre pas trop mal..

merci

a+

fatoo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:45:39, on 01/09/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\WinDV.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\WinDV.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\winIogon.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Windows Drivers Version - Unknown owner - C:\WINDOWS\WinDV.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

c est pas mal on a encore 2 ou 3 truc a regler

Clic sur ce lien : 

https://www.trendmicro.com/fr_fr/business.html 

Puis clic sur scanner maintenant : 
Suit les différentes etapes 

Et supprime les infections trouvés 
Copie/colle le rapport

fatoo · Answer

je n'arrive pas à faire le scan.... j'appuie sur scanner et j'accepte les conditions mais y'a rien a faire...il me dit en anglais "the house call-API did not define a native Binding"

duflox · Answer

ok bon c est le site de trend micro qui beugue!!!

alors pendant que je trouve une autre solution(qui est en train d emerger dans ma tete)

¤ Désactive le pare-feu de Windows (SP2) puis installe celui-ci pour plus de sécurité 

Kerio (pare-feu) : reste gratuit après la période d'essai en français 
----> http://www.infos-du-net.com/telecharger/Firewall-Kerio-Personal,0301-390.html 

Regarde ce tutoriel si tu as besoin d'aide pour l'installation, la configuration et compréhension de Kerio 
http://www.malekal.com/kerio_firewall.php
Plus d'info : 
->https://kerio.probb.fr/ 

puis va sur le site de windows uptade et fais toutes les mises a jour meme les non prioritaires

quand c est fait dis le moi j aurais deja trouvé la solution

a+

duflox · Answer

pour la suite fais ceci:

Étape 1: 
Télécharge eScan Antivirus Toolkit ici: 

http://www.spywareinfo.dk/download/mwav.exe 

Sauvegarde-le sur ton Bureau. 
Avant de lancer le programme, il faut le mettre à jour tel qu'indiqué à l'étape 2. 

Étape 2: 
Voici comment mettre l'outil à jour : 

1.) Double-clique le fichier mwav.exe qui se trouve sur le Bureau ; dézippe les fichiers dans le nouveau dossier suggéré (C:\Kaspersky). Le programme va se lancer, et tu dois le quitter (clique sur "Exit" puis "Exit"). 

2.) Double-clique sur le Poste de travail, puis double-clique sur le lecteur principal (habituellement C:\), double-clique sur le dossier Kaspersky ; ensuite, double-clique sur le fichier kavupd.exe. Tu verras maintenant une fenêtre DOS apparaître, et la mise à jour se complètera en quelques minutes. 

3.) Lorsque la mise à jour sera complétée, tu verras "Press any key to continue" ; tape sur une clé pour continuer. Deux nouveaux répertoires (dossiers) ont été créés lors de la mise à jour (C:\Bases et C:\Downloads). 

4.) Sélectionne/copie tous les fichiers présents dans le dossier C:\Downloads, puis colle-les dans le dossier C:\Kaspersky. Accepte à l'invite de remplacer les fichiers existants. 

Ne pas lancer le scan tout de suite ! 

Étape 3: 
Redémarre en mode Sans Échec : 
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisi la première option : Sans Échec, et valide avec "Entrée" 
5) Choisi ton compte régulier, et non Administrateur 


Étape 4: 
Du mode Sans Échec, voici comment utiliser le programme : 

1.) Pour lancer "eScan Antivirus Toolkit", trouve le fichier mwavscan.com situé dans le dossier C:\Kaspersky 

2.) Double-clique sur mwavscan.com ; l'interface d'eScan va apparaître à l'écran. 

3.) Il est très important de bien cocher ces boîtes sous Scan Option : Memory, Registry, Startup Folders, System Folders, Services. 

4.) Coche la boîte Drive, ce qui donne accès à une nouvelle boîte Drive (bouton rond) juste dessous ; coche ce bouton "Drive" (très important..), et tu verras une nouvelle boîte de navigation apparaître à la droite. Clique sur la petite flèche de cette boîte and choisi la lettre de ton disque dur, habituellement C:\. 

5.) Juste au-dessous, assure-toi que Scan All Files est coché, et non Program Files. 

6.) Clique sur Scan Clean et laisse le tool vérifier tout le disque dur (ça peut être long..). Lorsque terminé, tu verras Scan Completed. Ne pas quitter tout de suite ! 

7.) Ouvre un nouveau fichier Bloc notes (clique sur "Démarrer" >> "Programmes" >>"Accessoires" >> "Bloc notes"), puis copie/colle tout le contenu de la fenêtre Virus Log Information (la deuxième, au bas) dans le fichier texte, et sauvegarde le. eScan génère également un rapport complet dans le dossier C:\Kaspersky (nommé mwav.log), mais il est trop lourd pour poster sur le forum. 

Ferme le programme. Redémarre ton PC en mode Normal. Poste (copie/colle) le rapport que tu as sauvegardé dans ta prochaine réponse. 

Tutoriel : 

http://www.malekal.com/tutorial_eScan_antivirus_toolkit.php

fatoo · Answer

salut!

je vois que tu t'es penché sur mon cas durant mon absence....je t'en remercie!!!!
concernant l'étape 69 je rencontre 2 pbs...
le 1er concernant les mises à jour windows...en effet le collègue qui m'a installé le système m'a dit de ne jamais faire de mises à jour car c'est un CD gravé (c pas joli mais bon...) .
pour l'installation du parefeu kerio je n'ai pas eu de problèmes mais le parefeu m'ouvre des fenêtres d'intrusion en permanence que j'ai beau fermé à chaque fois...alors j'ai préféré réactivé le parefeu windows...

duflox · Answer

ah non c est pas joli joli!!!!!!comme ca tu n as aucune mise a jour de securité windows!!!

j attend le rapport du scan

a+

fatoo · Answer

salut,
voici le scan

File C:\WINDOWS\WinDV.exe infected by "Backdoor.Win32.SdBot.bnk" Virus. Action Taken: File Renamed.
File C:\WINDOWS\ffd.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\eep.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\vsa.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\eqpxem.exe infected by "Trojan-Proxy.Win32.Agent.mf" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\dbgcfg.dll infected by "Backdoor.Win32.Agent.bfd" Virus. Action Taken: File to be renamed on reboot.
File C:\WINDOWS\System32\i infected by "Trojan-Downloader.BAT.Ftp.ab" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\zhrezsi.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\umqq.exe infected by "Backdoor.Win32.IRCBot.ye" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\yphy.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\chkik.exe infected by "Backdoor.Win32.IRCBot.ye" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\xopvbbb.exe infected by "Backdoor.Win32.IRCBot.ye" Virus. Action Taken: File Renamed.
File C:\WINDOWS\System32\hqyny.exe infected by "Backdoor.Win32.IRCBot.ye" Virus. Action Taken: File Renamed.
File C:\WINDOWS\system32\oobe\html\mouse\hcvxrtwz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\lbzcxver.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse
rlcnzsh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\bzrbbsrn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\jjlhknhh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\bccxejnc.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\klkhkrts.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\cjxsjlbr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mousebnrnnxt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\khkvhhsb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\mouse\qetvqlnw.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\iconnect\jsnsljzh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\iconnect\shrtrsbs.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\dslmain\slhcezwb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\dslmain\qxztllwj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\dslmain
evttblh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\isptype\lnvlnzbq.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\sconnect\jkhjlhbb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\html\sconnect\vznnebet.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setupresnsct.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\knkhrczb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\hlqstwxz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
vbbshss.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\crjrhltv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\esjhxblq.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\kjqkxtnz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup	nqsbljb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\vkckxhbn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\zhhrrltb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\kksksesr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\hxxttskn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
leevxqj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup	thzxntk.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\hnhkkene.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\shbqjhcl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\hwncrnhh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\jtxsbxwn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setupserkten.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
twbjnxv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup	qkbrhnx.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\zeblsxxw.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\seqtjbee.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\vjbssbhj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\enbsjwre.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\wnklretl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
stnnnkk.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\lhkhbjzl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\jejrhnvh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\wrbbnjss.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\sejkhevn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\eskcxkhr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
khlvlzt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\bknkjheh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\lkjtrhks.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\zhzsnhje.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup
wqjkkhn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\hxckwnzl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\wtenslnj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\setup\bvqncler.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\xenjnbqe.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\erettxjr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\jkhehnjn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\kbwnhlkk.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\lktkttrb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\ektltnch.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error
eehnzxl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\error\sswzlttc.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\cetrjwtt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerrorcwnttzv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\ehxzeshx.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\etnwxxnv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\wlkbbnrq.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\xcjnkske.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\kjtzrlbb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobeegerror\wtkkxrlr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup
zzwhebn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\vrrkkhbn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\zvswnlev.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\brvecwcs.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\blvccbsx.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\btesnnel.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetupkjenssc.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup	chekrqt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\hlrrerkq.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\cwbbnetr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\knkskthw.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\btqkxenz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetuprthsntk.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\actsetup\lrlzztll.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\icserror\vcejlxkt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperrorkeetqew.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\ztceskls.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\knkbrnbn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\ktkbeknl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\skqbvxsq.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\hkenntsl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror\jjtrkbnj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\isperror	sjhshcj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe	ttnwshl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\qjeejeej.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\oobe\krcxzncj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\lllknblj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt	jnbzhbh.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\WINDOWS\Help\ciadmin.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\WINDOWS\Web	ip.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\WINDOWS\Web\wcxnjhhj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\FOUND.000\FILE0000.CHK infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\FOUND.000\FILE0001.CHK infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\FOUND.000\FILE0002.CHK infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Vierge.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Punch aux agrumes.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Belle journée.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Fiesta.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Glacier.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Lierre.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Feuilles.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Céramique.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Nature.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Réseau.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Camemberts.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Tournesol.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Sucreries.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Technique.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\cvhrrnkr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\lhlksbkv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\xcrhcljj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres
shxrvsz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\vhsbbknz.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettreseeqntbt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\llvbnekb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\bxjsjwkl.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\zqkrvsre.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\jekrcktb.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\ekzwrrrn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettreseehbqsr.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres	csbtese.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\hvxbzklt.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Fichiers communs\System\ado\MDACReadme.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\Fichiers communs\System\ado\svsllkjj.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\MSN\MSNCoreFiles\msnread.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\MSN\MSNCoreFiles	lbhnrlv.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\NetMeeting
etmeet.htm infected by "Net-Worm.Win32.Allaple.a" Virus. Action Taken: File Disinfected.
File C:\Program Files\NetMeetingsewzjqn.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\cache\FND1.NFI infected by "Backdoor.Win32.SdBot.bnk" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\Y2SIMYBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\O1CNVBAA.NQF infected by "Trojan-Proxy.Win32.Agent.mf" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\4Z32NMBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\PJGKD0DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FDB41YBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\3N5QBUCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\33A5BWCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\XHS2KFAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\RO2GBQAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\HFFXQOCA.NQF infected by "Backdoor.Win32.IRCBot.aby" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\W5NKNJDA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\4SYT43DA.NQF infected by "Backdoor.Win32.VanBot.dt" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\BIR4Q4DA.NQF infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\OJL3NBDA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\1BXX5YCA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\XSN4CNDA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\BTPZ0ODA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\4UZ22MAA.NQF infected by "Backdoor.Win32.IRCBot.ye" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\GUL0Z2BA.NQF infected by "Backdoor.Win32.VanBot.dt" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\SXNJHOBA.NQF infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\2UVF4MCA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\TTWPAGDA.NQF infected by "Backdoor.Win32.VanBot.dt" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\XCDEYBDA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\GOKSBIBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\022LK1BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\2D1CROCA.NQF infected by "Backdoor.Win32.VanBot.du" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\T3YAEHCA.NQF infected by "Trojan-Dropper.Win32.Sramler.e" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\SAR5NCDA.NQF infected by "Backdoor.Win32.VanBot.dl" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\UDTI40AA.NQF infected by "Backdoor.Win32.Rbot.bqj" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\MLA52EBA.NQF infected by "Backdoor.Win32.VanBot.dm" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\2NCGDICA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\TR0KFYBA.NQF tagged as not-a-virus:Dialer.Win32.Agent.b. No Action Taken.
File C:\Program Files\Eset\infected\D5FBF1BA.NQF infected by "Backdoor.Win32.SdBot.bnk" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\BQX1UJBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FOMWYZBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\UJ23VUBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\RZADPCBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\IZI4JZCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\BV2SEDDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\2H3M2DAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\DNTWG1DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FXUGI2BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\U1SDWXAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\BMOFZWBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\BLIZD1DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\IORGVPAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\UID5H5BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FLQU0BBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\T0ADYDAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\JLVLACBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\EUKHBVBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\2WC0U2DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\ZJDAHZBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\IYZ0ROAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\D2X4R5DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\W4XP3JCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\LT1UF1BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FCOYSXBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\Y2WGKBAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\CYLAVZBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\JZKR4YDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\TM0ECQBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\TB5XVNBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MBQDW3AA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\OOUKIIBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\1CILQADA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\22IK2MAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\E3TYSSDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\XAI3KHAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\DLIX4IBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\AQZS0NAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\JRE241CA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MUW1KQCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\0N1BNJBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\ANSDFRDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\GOCB52AA.NQF infected by "Trojan-Downloader.Win32.Tiny.id" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\XNPHULCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\1BZQYUBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\KS2VZMCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MVATMSBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\QTXRYDBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\H3QFGHAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\ILKB3IBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MAURAHBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FCORQMBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\DBKXJWBA.NQF infected by "Backdoor.Win32.VanBot.dl" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\ND23RKDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\VAJOFPAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\YIO0PRDA.NQF infected by "Backdoor.Win32.VanBot.ej" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\AQIKJ3AA.NQF tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\Program Files\Eset\infected\EIO5DCBA.NQF infected by "Backdoor.Win32.Rbot.cqg" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\1ABX1EBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\0CY2C2DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\C0I53CBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\IFUTONDA.NQF infected by "Backdoor.Win32.VanBot.ax" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\QH13DHDA.NQF infected by "Backdoor.Win32.EggDrop.v" Virus. Action Taken: File Renamed.
File C:\Program Files\Eset\infected\UCEXMPDA.NQF infected by "Trojan-Proxy.Win32.Agent.mf" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\RVH4XSAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\AQHHLHDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\COXCW4DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\HONGVZCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\34IUBLDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\WUM5Z4DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\WEJ43TCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\0VYWDOAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\WNL2RACA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\JLSGSRCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\O0XZJGAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\COFNHHCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\WZGLWVAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\ND5LR1DA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\EJDBTGCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\AJESH0CA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MILET0AA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FGGUY3CA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\D45SHQDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\ZBOE53BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\5WSFRVCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\PKEYQPDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\PEYB0NCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MQ01FAAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\21YHTFCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\LQQZ3ODA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\4SD02YDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\1WDWLOBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\BJJPTYCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\XUFKLCCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\E5M5A5BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\NDLQK2BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\X5UMDECA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\MIZVQBDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\120IH2BA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\UW5MTRAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\GTWB3MCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\TR2ZDJBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\4ZQ35KDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\A1XT4YDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\12NUDOBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\DVKBY0CA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\K2GCKKCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\KB3COHDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\42XVZJAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\K1F4TFAA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\AT352YBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\AIRUCQCA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\EJYP4CBA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\X3SDM5CA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\Program Files\Eset\infected\FHX10DDA.NQF infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000016.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000017.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000018.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000031.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000032.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000033.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000048.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000049.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000050.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000058.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000059.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000060.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000066.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000067.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0000068.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0002125.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0002126.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP1\A0002127.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002585.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002586.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002587.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002595.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002596.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002603.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002621.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002622.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002623.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002653.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002654.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP5\A0002655.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002670.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002671.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0002672.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0003670.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0003671.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0003672.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0004671.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0004672.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP6\A0004673.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004709.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004710.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004711.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004788.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004789.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004790.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004797.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004798.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004799.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004806.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004807.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004808.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004819.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004820.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0004821.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007829.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007830.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007831.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007837.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007838.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007839.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007849.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007850.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007851.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007856.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007857.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007858.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007871.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007873.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007872.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007881.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007882.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP7\A0007883.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007975.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007976.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007977.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP8\A0007984.exe infected by "Trojan-Proxy.Win32.Agent.mf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009000.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009246.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009247.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009248.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009258.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009265.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009280.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009296.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009330.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009331.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009332.EXE infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009333.exe infected by "Net-Worm.Win32.Allaple.b" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009334.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009363.exe tagged as not-a-virus:AdWare.Win32.Virtumonde.lk. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009374.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009386.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009387.exe infected by "Backdoor.Win32.VanBot.do" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009431.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009437.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP19\A0009447.exe infected by "Trojan.Win32.Pakes" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015630.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015631.com infected by "Backdoor.Win32.Rbot.cqg" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015632.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015633.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015634.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015635.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015636.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015637.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015638.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015639.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015640.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015641.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015642.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015643.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015644.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015646.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP24\A0015647.dll tagged as not-a-virus:AdWare.Win32.Virtumonde.jp. No Action Taken.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016707.exe infected by "Backdoor.Win32.SdBot.bnk" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016708.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016709.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016710.exe infected by "Trojan-Clicker.Win32.VB.rk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016711.exe infected by "Trojan-Proxy.Win32.Agent.mf" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{4A5BA454-59E4-4685-B2C9-69BAAD329C7C}\RP25\A0016712.exe infected b

duflox · Answer

et bah!!ton pc c etait un nid a virus!!!

refais moi un rapport hijackthis

merci

fatoo · Answer

Oui j'ai en effet constaté qu'il atrouvé plein de virus...je me demande à quoi me sert mon antivirus payant?????.....


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:47, on 06/09/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\WinDV.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

relance hijackthis puis clic sur "do a system scan only"

apres le scan coche ces lignes et seulement celles ci !!

O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe

O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll

O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)


referme ton navigateur (internet explorer ) puis clic sur " fix check"

puis

double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 


Citation : 

C:\WINDOWS\SYSTEM32\dbgcfg.dll

clique sur MoveIt! pour lancer la suppression. 
le résultat apparaîtra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

fatoo · Answer

Salut,

Voici le rapport OTMoveIt


DllUnregisterServer procedure not found in C:\WINDOWS\SYSTEM32\dbgcfg.dll
C:\WINDOWS\SYSTEM32\dbgcfg.dll NOT unregistered.
File move failed. C:\WINDOWS\SYSTEM32\dbgcfg.dll scheduled to be moved on reboot.
 
Created on 09/08/2007 14:58:56

duflox · Answer

ok alors refais moi un rapport hijackthis

merci

fatoo · Answer

Bonjour,

voici le rapport!...juste une question, lorsque j'allume mon ordi, il me dit que le fichier "C:\windows\WinDV.exe est introuvable. Est-ce un fichier important? puis-je le récupérer si c'est le cas...

Merci de ton aide!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:34, on 10/09/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\WinDV.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

ok alors:

Télécharge et installe CCleaner (n'installe pas la barre d'outil Yahoo) 
---> http://www.infos-du-net.com/telecharger/CCleaner,0301-1039.html 

- Dans la colonne de gauche clic sur "erreurs" coches toutes les cases, puis clic en bas sur "chercher des erreurs" une fois terminé, clic sur "réparer les erreurs" et tu auras un message pour sauvegarder ta base de registre tu clic "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs. 
Les sauvegardes que tu aura faites, tu pourras les supprimer si ton ordinateur n'a plus de problèmes. 

- Relance Ccleaner, vas dans l'onglet "nettoyeur" présent sur la gauche, décoches la dernière case (Avancé si elle est cochée) puis clic sur "lancer le nettoyage" 

Si tu as besoin d'aide avec Ccleaner, regarde ce tutorial : 
https://www.malekal.com/tutoriel-ccleaner/

Et suis les instructions donnée dans ce lien : 
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

fatoo · Answer

Salut!

J'ai fais ce que tu m'as demandé avec Ccleaner jusqu'à ce qu'il ne trouve plus d'erreurs.
Je te poste un rapport HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:53:18, on 16/09/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\System32
vsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
D:\Logiciels\3.0\Apps\apdproxy.exe
D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
D:\Logiciels\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Logiciels\sécurité scan\hijackthis\scan.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe %WINDIR%\WinDV.exe
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Logiciels\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\LOGICI~1\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] D:\Logiciels\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O20 - Winlogon Notify: dbgcfg - C:\WINDOWS\SYSTEM32\dbgcfg.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Logiciels\sécurité scan\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

duflox · Answer

salut

ok as tu encore des soucis?

fatoo · Answer

Salut!!!

a priori je ne vois rien de particulier sauf ce que je t'ai mis dans le message dans le massage 79
"lorsque j'allume mon ordi, il me dit que le fichier "C:\windows\WinDV.exe est introuvable. Est-ce un fichier important? puis-je le récupérer si c'est le cas... "

@+

duflox · Answer

tu peux le recuperer en faisant ceci:

Réparer Windows XP avec le CD 
Pour réparer une installation XP sans passer par la Console de Récupération, procédez comme suit :
- démarrez votre PC avec le CD d'installation de XP
- lancez le programme d'installation de XP
- au 1er menu, choisissez "Installation"
- poursuivre le processus d'installation jusqu'à la fenêtre vous avertissant qu'une version de XP est déjà installée et active
- choisissez "Réparer"
- le processus de réparation va remplacer tous les fichiers corrompus ou manquants.

Attention : les pilotes non Microsoft, les mises à jour de Windows, le Service Pack doivent être réinstallés après ce processus de réparation.

fatoo · Answer

Salut,

je tiens à te remercier pour ton aide, tu as été super efficace et très compréhensif (j'ai fais quelques bourdes...LOL). Mon ordi est comme neuf
je te souhaite bonne continuation et je me permettrais de revenir vers toi si je rencontrais à nouveau ce type de pbs

au plaisir!!!!!!

fatou

fatoo · Answer

La mise en place de certains logiciels de nettoyage et le suivi des conseils de mon tuteur ont permis l'élimination du virus trojan et compagnie sur mon pc

duflox · Answer

pas de probleme

a+++

kidcaster · Answer

il est trop baleze ce duflox
Kidcaster

Win 32 TrojanProxy...HELLLLLP! - Page 5

Discussions similaires

Newsletters