A voir également:
- Infecté par trojan+rapports antivirus hijack
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Comodo antivirus - Télécharger - Sécurité
- Panda antivirus - Télécharger - Antivirus & Antimalwares
- Avast antivirus gratuit - Télécharger - Antivirus & Antimalwares
- Desactiver antivirus windows 10 - Guide
18 réponses
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
5 sept. 2007 à 13:59
5 sept. 2007 à 13:59
AVG antispyxare
https://www.01net.com/telecharger/
Tuto :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html
->Relance AVG AS -> "Analyse" ->"Paramètres"
Sous la question "Comment réagir ?" :
-> clique sur "Actions recommandées" et choisis "Quarantaines"
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"
Si un fichier est infecté en fin d'analyse
->Clique sur "Appliquer toutes les actions "
->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous".
->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici
_________________
et a squared
https://www.01net.com/telecharger/
________________
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.
· Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
· Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
· Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
http://kerio.probb.fr/tuto-Clean-h37.html
_____
scan avec ton antivirus en mode sans echec (demarre l'ordi en appuayant sur F8)
____________
desactive la restauration syteme pour purger les virus qui seraient dedans puis reactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis parametre)
colle le rapport d'un scan en ligne
avec un des suivants:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
scan en ligne firefox
https://www.trendmicro.com/fr_fr/business.html
https://www.01net.com/telecharger/
Tuto :
http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html
->Relance AVG AS -> "Analyse" ->"Paramètres"
Sous la question "Comment réagir ?" :
-> clique sur "Actions recommandées" et choisis "Quarantaines"
-> Re-clique sur l'onglet "Analyse" puis réalise une "Analyse complète du système"
Si un fichier est infecté en fin d'analyse
->Clique sur "Appliquer toutes les actions "
->Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous".
->Enregistre ce fichier texte sur ton bureau ensuite colle le rapport ici
_________________
et a squared
https://www.01net.com/telecharger/
________________
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.
· Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
· Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
· Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
http://kerio.probb.fr/tuto-Clean-h37.html
_____
scan avec ton antivirus en mode sans echec (demarre l'ordi en appuayant sur F8)
____________
desactive la restauration syteme pour purger les virus qui seraient dedans puis reactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis parametre)
colle le rapport d'un scan en ligne
avec un des suivants:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
scan en ligne firefox
https://www.trendmicro.com/fr_fr/business.html
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2007 à 13:26
6 sept. 2007 à 13:26
que dis avg et a squared?
fait la desactivation avant le scan en ligne
_____________
Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
_____________
colle le rapport du scan en ligne
---------------
scan avec ton antivirus en mode sans echec
fait la desactivation avant le scan en ligne
_____________
Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum
_____________
colle le rapport du scan en ligne
---------------
scan avec ton antivirus en mode sans echec
Voilà pour le rapport d'AVG:
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 20:51:21 05/09/2007
+ Résultat de l'analyse:
[1208] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1648] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[168] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1740] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1756] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1776] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[184] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1904] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1964] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1984] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[2016] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[2156] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[228] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[248] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[360] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[416] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[996] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\Downloaded Program Files\AxInst.exe -> Dropper.CP : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sandra\Cookies\sandra@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@divx.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adtech[3].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@com[1].txt -> TrackingCookie.Com : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@stat.dealtime[2].txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@estat[2].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ehg-quechoisir.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@www.paypal[1].txt -> TrackingCookie.Paypal : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@valueclick[2].txt -> TrackingCookie.Valueclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
Fin du rapport
...et pour Clean:
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 06/09/2007 a 6:48:34,45
Microsoft Windows XP [version 5.1.2600]
*** Suppression des fichiers dans C:
*** Suppression des fichiers dans C:\WINDOWS\
*** Suppression des fichiers dans C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\ftpupd.exe
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.2"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.3"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.4"
*** Suppression des fichiers dans C:\Program Files
*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Par contre je n'ai pas fait la désactivation avant le scanner en ligne. Je recommence le clean en mode sans échec et le scanner en ligne. Je t'envoie le rapport
et je continue avec SD fix
J'espère que j'ai bien compris
Merci pour ton aide
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------
+ Créé à: 20:51:21 05/09/2007
+ Résultat de l'analyse:
[1208] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1648] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[168] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1740] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1756] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1776] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[184] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1904] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1964] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[1984] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[2016] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[2156] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[228] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[248] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[360] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[416] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
[996] C:\Program Files\318F1976\347A8AA6.DLL -> Downloader.Delf.mm : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\Downloaded Program Files\AxInst.exe -> Dropper.CP : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Sandra\Cookies\sandra@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@divx.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ads.adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@adtech[3].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@com[1].txt -> TrackingCookie.Com : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@stat.dealtime[2].txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@estat[2].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ehg-quechoisir.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@www.paypal[1].txt -> TrackingCookie.Paypal : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@valueclick[2].txt -> TrackingCookie.Valueclick : Nettoyé.
C:\Documents and Settings\Sandra\Cookies\sandra@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
Fin du rapport
...et pour Clean:
Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 06/09/2007 a 6:48:34,45
Microsoft Windows XP [version 5.1.2600]
*** Suppression des fichiers dans C:
*** Suppression des fichiers dans C:\WINDOWS\
*** Suppression des fichiers dans C:\WINDOWS\system32
tentative de suppression de C:\WINDOWS\system32\ftpupd.exe
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.1"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.2"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.3"
tentative de suppression de "C:\WINDOWS\Downloaded Program Files\CONFLICT.4"
*** Suppression des fichiers dans C:\Program Files
*** Suppression des clefs du registre effectuee..
*** Fin du rapport !
Par contre je n'ai pas fait la désactivation avant le scanner en ligne. Je recommence le clean en mode sans échec et le scanner en ligne. Je t'envoie le rapport
et je continue avec SD fix
J'espère que j'ai bien compris
Merci pour ton aide
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2007 à 13:38
6 sept. 2007 à 13:38
ok
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2007 à 13:44
6 sept. 2007 à 13:44
fait aussi ca
utilise msn fix:
http://sosvirus.changelog.fr/MSNFix.zip
Décompresse-le (clic droit >> Extraire ici) et double cliquer sur le fichier MSNFix.bat.
redemarre en mode sans echec (tapote la touche F8 au demarrage)
- Exécute l'option R.
-- Si l'infection est détectée, exécute l'option N.
--- Sauvegarde ce rapport puis fait un copier/coller de ce rapport sur le forum, ainsi qu'un nouveau scan HijackThis fait en mode normal.
Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.
utilise msn fix:
http://sosvirus.changelog.fr/MSNFix.zip
Décompresse-le (clic droit >> Extraire ici) et double cliquer sur le fichier MSNFix.bat.
redemarre en mode sans echec (tapote la touche F8 au demarrage)
- Exécute l'option R.
-- Si l'infection est détectée, exécute l'option N.
--- Sauvegarde ce rapport puis fait un copier/coller de ce rapport sur le forum, ainsi qu'un nouveau scan HijackThis fait en mode normal.
Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement.
Voilà pour la rapport SDfix:
SDFix: Version 1.102
Run by Sandra on 06/09/2007 at 14:10
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Sandra\Bureau\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Trojan Files Found:
C:\WINDOWS\SYSTEM32\DUST.EXE - Deleted
C:\WINDOWS\system32\TFTP1224 - Deleted
C:\WINDOWS\system32\TFTP1584 - Deleted
C:\WINDOWS\system32\TFTP2148 - Deleted
C:\WINDOWS\system32\TFTP2236 - Deleted
C:\WINDOWS\system32\TFTP2272 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2300 - Deleted
C:\WINDOWS\system32\TFTP2412 - Deleted
C:\WINDOWS\system32\TFTP2620 - Deleted
C:\WINDOWS\system32\TFTP3024 - Deleted
C:\WINDOWS\system32\TFTP3548 - Deleted
C:\WINDOWS\system32\TFTP3760 - Deleted
C:\WINDOWS\system32\TFTP3848 - Deleted
C:\WINDOWS\system32\TFTP3892 - Deleted
C:\WINDOWS\system32\TFTP3900 - Deleted
C:\WINDOWS\system32\TFTP3968 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\WINDOWS\system32\TFTP4004 - Deleted
C:\WINDOWS\system32\TFTP4092 - Deleted
C:\WINDOWS\system32\TFTP496 - Deleted
C:\WINDOWS\system32\TFTP984 - Deleted
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
File Backups: - C:\DOCUME~1\Sandra\Bureau\SDFix\backups\backups.zip
Files with Hidden Attributes:
C:\Program Files\318F1976\347A8AA6.DLL
C:\WINDOWS\system32\MS318F19.DLL
C:\WINDOWS\system32\MS3D714B.DLL
C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe
C:\Documents and Settings\Sandra\Application Data\Microsoft\ModŠles\~WRL2610.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0166.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0219.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0442.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0624.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL1864.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL2640.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL3452.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL3891.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL0002.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL1220.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL3668.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Aufwind 6Š\Kapitel 5\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Aufwind 6Š\Kapitel 5\~WRL0005.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Kontakt 3Š LV2\Kapitel 7\~WRL0716.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\D‚couverte du monde\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\lecture\RIBAMBELLE\les Indiens\POPOTKA LE PETIT SIOUX\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL1021.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL2655.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL0161.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL1663.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL2678.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\afrique du sud\~WRL1920.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\afrique du sud\~WRL2525.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\organisation ann‚e 2007-2008\~WRL0002.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\organisation ann‚e 2007-2008\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Alternative Terminale\Unit‚ 1\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Textes lyc‚e\Musik\~WRL1266.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Textes lyc‚e\Musik 2de\~WRL1266.tmp
Finished
Est-ce que je continune tout de suite ou j'attends l'analyse du rapport peut-être?
Merci
SDFix: Version 1.102
Run by Sandra on 06/09/2007 at 14:10
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Sandra\Bureau\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Trojan Files Found:
C:\WINDOWS\SYSTEM32\DUST.EXE - Deleted
C:\WINDOWS\system32\TFTP1224 - Deleted
C:\WINDOWS\system32\TFTP1584 - Deleted
C:\WINDOWS\system32\TFTP2148 - Deleted
C:\WINDOWS\system32\TFTP2236 - Deleted
C:\WINDOWS\system32\TFTP2272 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2300 - Deleted
C:\WINDOWS\system32\TFTP2412 - Deleted
C:\WINDOWS\system32\TFTP2620 - Deleted
C:\WINDOWS\system32\TFTP3024 - Deleted
C:\WINDOWS\system32\TFTP3548 - Deleted
C:\WINDOWS\system32\TFTP3760 - Deleted
C:\WINDOWS\system32\TFTP3848 - Deleted
C:\WINDOWS\system32\TFTP3892 - Deleted
C:\WINDOWS\system32\TFTP3900 - Deleted
C:\WINDOWS\system32\TFTP3968 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\WINDOWS\system32\TFTP4004 - Deleted
C:\WINDOWS\system32\TFTP4092 - Deleted
C:\WINDOWS\system32\TFTP496 - Deleted
C:\WINDOWS\system32\TFTP984 - Deleted
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
Remaining Files:
---------------
File Backups: - C:\DOCUME~1\Sandra\Bureau\SDFix\backups\backups.zip
Files with Hidden Attributes:
C:\Program Files\318F1976\347A8AA6.DLL
C:\WINDOWS\system32\MS318F19.DLL
C:\WINDOWS\system32\MS3D714B.DLL
C:\Program Files\Fichiers communs\Adobe\ESD\DLMCleanup.exe
C:\Documents and Settings\Sandra\Application Data\Microsoft\ModŠles\~WRL2610.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0166.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0219.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0442.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL0624.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL1864.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL2640.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL3452.tmp
C:\Documents and Settings\Sandra\Application Data\Microsoft\Word\~WRL3891.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL0002.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL1220.tmp
C:\Documents and Settings\Sandra\Mes documents\~WRL3668.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Aufwind 6Š\Kapitel 5\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Aufwind 6Š\Kapitel 5\~WRL0005.tmp
C:\Documents and Settings\Sandra\Mes documents\CollŠge\Kontakt 3Š LV2\Kapitel 7\~WRL0716.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\D‚couverte du monde\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\lecture\RIBAMBELLE\les Indiens\POPOTKA LE PETIT SIOUX\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL1021.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\fran‡ais\orthographe et dict‚es\~WRL2655.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL0161.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL1663.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\~WRL2678.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\afrique du sud\~WRL1920.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\CLASSE\CE1\Le tour du monde d'Emile\afrique du sud\~WRL2525.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\organisation ann‚e 2007-2008\~WRL0002.tmp
C:\Documents and Settings\Sandra\Mes documents\Jean-Ren‚\ECOLE\organisation ann‚e 2007-2008\~WRL0004.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Alternative Terminale\Unit‚ 1\~WRL0003.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Textes lyc‚e\Musik\~WRL1266.tmp
C:\Documents and Settings\Sandra\Mes documents\Lyc‚e\Textes lyc‚e\Musik 2de\~WRL1266.tmp
Finished
Est-ce que je continune tout de suite ou j'attends l'analyse du rapport peut-être?
Merci
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2007 à 17:25
6 sept. 2007 à 17:25
attend l'analyse puis fais msnfix apres
---------------
combofix (colle le rapport)
http://mickael.barroux.free.fr/securite/combofix.php
__________
scan avec ton antivirus en mode sans echec
____________
dis tes pbs et recolle hijackthis
---------------
combofix (colle le rapport)
http://mickael.barroux.free.fr/securite/combofix.php
__________
scan avec ton antivirus en mode sans echec
____________
dis tes pbs et recolle hijackthis
me revoilà
petit souci, l'ordi s'est arreté d'un seul coup pendant le scan en ligne avec bitdefender. la seule chose que j'ai remarqué, c'est que sur les 68000 fichiers que j'avais il n'en reste que 49000! j'espère que c'est normal...
Est-ce que d'après le rapport de SDfix, il y a encore des choses qui ne vont pas?
Merci
Je vais retenter le scan en ligne avec bitdefender et j'envoie le rapport
petit souci, l'ordi s'est arreté d'un seul coup pendant le scan en ligne avec bitdefender. la seule chose que j'ai remarqué, c'est que sur les 68000 fichiers que j'avais il n'en reste que 49000! j'espère que c'est normal...
Est-ce que d'après le rapport de SDfix, il y a encore des choses qui ne vont pas?
Merci
Je vais retenter le scan en ligne avec bitdefender et j'envoie le rapport
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
6 sept. 2007 à 22:25
6 sept. 2007 à 22:25
Trojan Files Found:
C:\WINDOWS\SYSTEM32\DUST.EXE - Deleted
C:\WINDOWS\system32\TFTP1224 - Deleted
C:\WINDOWS\system32\TFTP1584 - Deleted
C:\WINDOWS\system32\TFTP2148 - Deleted
C:\WINDOWS\system32\TFTP2236 - Deleted
C:\WINDOWS\system32\TFTP2272 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2300 - Deleted
C:\WINDOWS\system32\TFTP2412 - Deleted
C:\WINDOWS\system32\TFTP2620 - Deleted
C:\WINDOWS\system32\TFTP3024 - Deleted
C:\WINDOWS\system32\TFTP3548 - Deleted
C:\WINDOWS\system32\TFTP3760 - Deleted
C:\WINDOWS\system32\TFTP3848 - Deleted
C:\WINDOWS\system32\TFTP3892 - Deleted
C:\WINDOWS\system32\TFTP3900 - Deleted
C:\WINDOWS\system32\TFTP3968 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\WINDOWS\system32\TFTP4004 - Deleted
C:\WINDOWS\system32\TFTP4092 - Deleted
C:\WINDOWS\system32\TFTP496 - Deleted
C:\WINDOWS\system32\TFTP984 - Deleted
sdfix a viré tout ca
fait le reste
a plus
C:\WINDOWS\SYSTEM32\DUST.EXE - Deleted
C:\WINDOWS\system32\TFTP1224 - Deleted
C:\WINDOWS\system32\TFTP1584 - Deleted
C:\WINDOWS\system32\TFTP2148 - Deleted
C:\WINDOWS\system32\TFTP2236 - Deleted
C:\WINDOWS\system32\TFTP2272 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2300 - Deleted
C:\WINDOWS\system32\TFTP2412 - Deleted
C:\WINDOWS\system32\TFTP2620 - Deleted
C:\WINDOWS\system32\TFTP3024 - Deleted
C:\WINDOWS\system32\TFTP3548 - Deleted
C:\WINDOWS\system32\TFTP3760 - Deleted
C:\WINDOWS\system32\TFTP3848 - Deleted
C:\WINDOWS\system32\TFTP3892 - Deleted
C:\WINDOWS\system32\TFTP3900 - Deleted
C:\WINDOWS\system32\TFTP3968 - Deleted
C:\WINDOWS\system32\TFTP400 - Deleted
C:\WINDOWS\system32\TFTP4004 - Deleted
C:\WINDOWS\system32\TFTP4092 - Deleted
C:\WINDOWS\system32\TFTP496 - Deleted
C:\WINDOWS\system32\TFTP984 - Deleted
sdfix a viré tout ca
fait le reste
a plus
Merci de toujours être de la partie.
je suis un peu en retard sur les manips.
je viens de lancer MSN fix dont voici le rapport:
MSNFix 1.493
C:\Documents and Settings\Sandra\Mes documents\MSNFix
Fix exécuté le 08/09/2007 - 13:16:55,56 By Sandra
mode sans échec
************************ Recherche les fichiers présents
... C:\log.txt
... C:\WINDOWS\SiSport.sys
************************ Recherche les dossiers présents
... C:\Temp\
************************ Suppression des fichiers
.. OK ... C:\log.txt
.. OK ... C:\WINDOWS\SiSport.sys
************************ Suppression des dossiers
.. OK ... C:\Temp\
************************ Nettoyage du registre
************************ Fichiers suspects
Aucun Fichier trouvé
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 08092007_13173093.zip
------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------
--------------------------------------------- END ---------------------------------------------
et voici le rapport de hijack qui a suivi:
Logfile of HijackThis v1.99.1
Scan saved at 13:23:10, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Est-ce que tout est OK ou est-ce que je continue avec combo ?
A bientot
je suis un peu en retard sur les manips.
je viens de lancer MSN fix dont voici le rapport:
MSNFix 1.493
C:\Documents and Settings\Sandra\Mes documents\MSNFix
Fix exécuté le 08/09/2007 - 13:16:55,56 By Sandra
mode sans échec
************************ Recherche les fichiers présents
... C:\log.txt
... C:\WINDOWS\SiSport.sys
************************ Recherche les dossiers présents
... C:\Temp\
************************ Suppression des fichiers
.. OK ... C:\log.txt
.. OK ... C:\WINDOWS\SiSport.sys
************************ Suppression des dossiers
.. OK ... C:\Temp\
************************ Nettoyage du registre
************************ Fichiers suspects
Aucun Fichier trouvé
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 08092007_13173093.zip
------------------------------------------------------------------------
Auteur : !aur3n7 Contact: https://www.ionos.fr/
------------------------------------------------------------------------
--------------------------------------------- END ---------------------------------------------
et voici le rapport de hijack qui a suivi:
Logfile of HijackThis v1.99.1
Scan saved at 13:23:10, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Est-ce que tout est OK ou est-ce que je continue avec combo ?
A bientot
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
8 sept. 2007 à 13:43
8 sept. 2007 à 13:43
Télécharge MsnCleaner.zip de ElPiedra et décompresse le sur ton bureau. (Clic droit sur le fichier .zip puis Extraire tout).
Copier l’adresse suivante dans ton lien :
https://forospyware.com
· Redémarre le PC en Mode sans échec et connecte toi sous ton nom d'utilisateur habituel.Pour démarrer en mode sans échec.
· Double-clique sur MsnCleaner.exe pour le lancer.
· Sous Language, clique sur la petite flèche et choisis French.
· Clique sur le bouton Analyse.
· A la fin du scan un rapport va être créé.
· Si l'outil trouve une infection, clique sur le bouton Supprimer.
· Redémarre en mode normal.
· Poste le rapport C:\MsnCleaner.txt dans ta prochaine réponse..
__________
combofix (colle le rapport)
http://mickael.barroux.free.fr/securite/combofix.php
__________
scan avec ton antivirus en mode sans echec
____________
dis tes pbs , refait un scan en ligne
et recolle hijackthis
____________
Copier l’adresse suivante dans ton lien :
https://forospyware.com
· Redémarre le PC en Mode sans échec et connecte toi sous ton nom d'utilisateur habituel.Pour démarrer en mode sans échec.
· Double-clique sur MsnCleaner.exe pour le lancer.
· Sous Language, clique sur la petite flèche et choisis French.
· Clique sur le bouton Analyse.
· A la fin du scan un rapport va être créé.
· Si l'outil trouve une infection, clique sur le bouton Supprimer.
· Redémarre en mode normal.
· Poste le rapport C:\MsnCleaner.txt dans ta prochaine réponse..
__________
combofix (colle le rapport)
http://mickael.barroux.free.fr/securite/combofix.php
__________
scan avec ton antivirus en mode sans echec
____________
dis tes pbs , refait un scan en ligne
et recolle hijackthis
____________
Voilà où j'en suis:
J'ai fait un scan en ligne. Il y avait toujours des pbs:
BitDefender Online Scanner
Rapport d'analyse généré à: Sat, Sep 08, 2007 - 18:13:00
Voie d'analyse: A:\;C:\;D:\;
Statistiques
Temps
01:33:28
Fichiers
100826
Directoires
4626
Secteurs de boot
2
Archives
952
Paquets programmes
5139
Résultats
Virus identifiés
1
Fichiers infectés
8
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
7
Info sur les moteurs
Définition virus
799287
Version des moteurs
AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Program Files\318F1976\347A8AA6.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\Program Files\318F1976\347A8AA6.DLL
Echec de la désinfection
C:\Program Files\318F1976\347A8AA6.DLL
Echec de la suppression
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Supprimé
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Supprimé
C:\WINDOWS\system32\MS3D714B.DLL
Echec de la mise à jour
MSNcleaner donne la chose suivante: je ne retrouve pas le rapport mais cela tenait en une ligne, quelque chose comme:
aucun fichier trouvé
rapport combo ci-dessous:
ComboFix 07-09-08.8 - "Sandra" 2007-09-08 18:42:13.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.193 [GMT 2:00]
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\318F1976
C:\Program Files\318F1976\347A8AA6.DLL
C:\WINDOWS\system32\1201
C:\WINDOWS\system32\H18F1976.log
C:\WINDOWS\system32\HD714BD9.log
C:\WINDOWS\system32\MS318F19.CPL
C:\WINDOWS\system32\MS3D714B.CPL
C:\WINDOWS\system32\MS3D714B.DLL
C:\WINDOWS\system32\nvs2.inf
((((((((((((((((((((((((((((( Fichiers créés 2007-08-08 to 2007-09-08 ))))))))))))))))))))))))))))))))))))
.
2007-09-08 18:40 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 18:34 <REP> d-------- C:\BackUpMSNCleaner
2007-09-06 14:08 <REP> d-------- C:\WINDOWS\ERUNT
2007-09-05 20:58 <REP> d-------- C:\Program Files\a-squared Free
2007-08-18 09:06 <REP> d-------- C:\Program Files\Lavasoft
2007-08-18 09:06 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-18 09:04 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-08 10:54 --------- d-------- C:\Program Files\Dictionnaire
2007-09-08 10:38 --------- d-------- C:\DOCUME~1\Sandra\APPLIC~1\Canon
2007-08-18 08:57 --------- d-------- C:\DOCUME~1\Sandra\APPLIC~1\Lavasoft
2007-08-18 08:42 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-17 20:54 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-15 15:15 --------- d--h----- C:\Program Files\3D714BD9
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-06-26 08:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:22 1037312 --a------ C:\WINDOWS\explorer.exe
2007-04-08 09:33 6469352 --a------ C:\Program Files\avgas-setup-7.5.0.50.exe
2005-06-19 05:35 1256444 --a------ C:\Program Files\wrar342fr.exe
2004-12-23 07:22 7753 --a------ C:\Program Files\hijackthis.log
2003-10-23 18:52 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2002-07-26 16:22 2238 --a------ C:\Program Files\CRDEVIMP.CUR
2002-07-26 16:17 2238 --a------ C:\Program Files\CRSOUSMA.CUR
2002-02-20 09:04 766 --a------ C:\Program Files\CRSYGMA.CUR
2002-02-20 08:47 2238 --a------ C:\Program Files\CRGOMME.CUR
2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
2001-09-01 00:26 766 --a------ C:\Program Files\crpubli.ico
1995-09-20 15:16 456976 --a------ C:\Program Files\Fichiers communs\dao3032.dll
2005-08-05 05:23:07 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="C:\WINDOWS\htpatch.exe" [2002-10-30 11:40]
"vptray"="C:\Program Files\NavNT\vptray.exe" [2001-09-26 19:06]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 13:00]
"nwiz"="nwiz.exe" [2003-11-17 04:33 C:\WINDOWS\system32\nwiz.exe]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-11-17 04:33]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-09-05 17:55]
"Cmaudio"="cmicnfg.cpl" []
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-02-05 07:47]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 14:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-27 08:55]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Start Uppings"=mssupdate.exe
"HLL Data Parameter"=hllcxpa.exe
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"lssas Monitoring Startup"=lssas.exe
"Start Uppings"=mssupdate.exe
"HLL Data Parameter"=hllcxpa.exe
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"Sygate Personals Firewalls"=ccsrn.exe
"Tsa2"=C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-05-21 08:40:23]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 22:05:56]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files\ISTsvc]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\bpjyh.exe
R3 ovt519;VGA USB Camera;C:\WINDOWS\system32\Drivers\ov519vid.sys
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-08 18:47:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-08 18:49:03 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-08 18:49
.
--- E O F ---
j'enchaine avec le scan en mode sans echec
a+
Rapport MSNcleaner
J'ai fait un scan en ligne. Il y avait toujours des pbs:
BitDefender Online Scanner
Rapport d'analyse généré à: Sat, Sep 08, 2007 - 18:13:00
Voie d'analyse: A:\;C:\;D:\;
Statistiques
Temps
01:33:28
Fichiers
100826
Directoires
4626
Secteurs de boot
2
Archives
952
Paquets programmes
5139
Résultats
Virus identifiés
1
Fichiers infectés
8
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
7
Info sur les moteurs
Définition virus
799287
Version des moteurs
AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\Program Files\318F1976\347A8AA6.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\Program Files\318F1976\347A8AA6.DLL
Echec de la désinfection
C:\Program Files\318F1976\347A8AA6.DLL
Echec de la suppression
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000008.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000056.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP2\A0000075.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP3\A0000089.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000183.DLL
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000189.DLL
Supprimé
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\WINDOWS\system32\MS3D714B.DLL=>(Embedded EXE o)
Supprimé
C:\WINDOWS\system32\MS3D714B.DLL
Echec de la mise à jour
MSNcleaner donne la chose suivante: je ne retrouve pas le rapport mais cela tenait en une ligne, quelque chose comme:
aucun fichier trouvé
rapport combo ci-dessous:
ComboFix 07-09-08.8 - "Sandra" 2007-09-08 18:42:13.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.193 [GMT 2:00]
* Created a new restore point
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\318F1976
C:\Program Files\318F1976\347A8AA6.DLL
C:\WINDOWS\system32\1201
C:\WINDOWS\system32\H18F1976.log
C:\WINDOWS\system32\HD714BD9.log
C:\WINDOWS\system32\MS318F19.CPL
C:\WINDOWS\system32\MS3D714B.CPL
C:\WINDOWS\system32\MS3D714B.DLL
C:\WINDOWS\system32\nvs2.inf
((((((((((((((((((((((((((((( Fichiers créés 2007-08-08 to 2007-09-08 ))))))))))))))))))))))))))))))))))))
.
2007-09-08 18:40 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-08 18:34 <REP> d-------- C:\BackUpMSNCleaner
2007-09-06 14:08 <REP> d-------- C:\WINDOWS\ERUNT
2007-09-05 20:58 <REP> d-------- C:\Program Files\a-squared Free
2007-08-18 09:06 <REP> d-------- C:\Program Files\Lavasoft
2007-08-18 09:06 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-18 09:04 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-08 10:54 --------- d-------- C:\Program Files\Dictionnaire
2007-09-08 10:38 --------- d-------- C:\DOCUME~1\Sandra\APPLIC~1\Canon
2007-08-18 08:57 --------- d-------- C:\DOCUME~1\Sandra\APPLIC~1\Lavasoft
2007-08-18 08:42 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-17 20:54 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-08-15 15:15 --------- d--h----- C:\Program Files\3D714BD9
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-06-26 08:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-06-13 15:22 1037312 --a------ C:\WINDOWS\explorer.exe
2007-04-08 09:33 6469352 --a------ C:\Program Files\avgas-setup-7.5.0.50.exe
2005-06-19 05:35 1256444 --a------ C:\Program Files\wrar342fr.exe
2004-12-23 07:22 7753 --a------ C:\Program Files\hijackthis.log
2003-10-23 18:52 40960 --a------ C:\Program Files\Uninstall_CDS.exe
2002-07-26 16:22 2238 --a------ C:\Program Files\CRDEVIMP.CUR
2002-07-26 16:17 2238 --a------ C:\Program Files\CRSOUSMA.CUR
2002-02-20 09:04 766 --a------ C:\Program Files\CRSYGMA.CUR
2002-02-20 08:47 2238 --a------ C:\Program Files\CRGOMME.CUR
2001-11-23 06:08 712704 --a------ C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
2001-09-01 00:26 766 --a------ C:\Program Files\crpubli.ico
1995-09-20 15:16 456976 --a------ C:\Program Files\Fichiers communs\dao3032.dll
2005-08-05 05:23:07 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="C:\WINDOWS\htpatch.exe" [2002-10-30 11:40]
"vptray"="C:\Program Files\NavNT\vptray.exe" [2001-09-26 19:06]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 13:00]
"nwiz"="nwiz.exe" [2003-11-17 04:33 C:\WINDOWS\system32\nwiz.exe]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-11-17 04:33]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2003-09-05 17:55]
"Cmaudio"="cmicnfg.cpl" []
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-02-05 07:47]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 20:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 14:20]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 21:24]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-01-27 08:55]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Start Uppings"=mssupdate.exe
"HLL Data Parameter"=hllcxpa.exe
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"lssas Monitoring Startup"=lssas.exe
"Start Uppings"=mssupdate.exe
"HLL Data Parameter"=hllcxpa.exe
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
"Sygate Personals Firewalls"=ccsrn.exe
"Tsa2"=C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-05-21 08:40:23]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 22:05:56]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files\ISTsvc]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mAD80+¿ÔÇè]Iú" ‹üžiC:\Program Files\ISTsvc\istsvc.exe]
C:\WINDOWS\bpjyh.exe
R3 ovt519;VGA USB Camera;C:\WINDOWS\system32\Drivers\ov519vid.sys
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-08 18:47:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-08 18:49:03 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-08 18:49
.
--- E O F ---
j'enchaine avec le scan en mode sans echec
a+
Rapport MSNcleaner
J'ai fini les manips. C'est curieux; lorsque je fais l'analyse bitdefender, le nombre de fichiers verifiés est supérieur au nombre de fichiers détectés. je n'avais jamais remarqué cela avant le pb. Mon anti virus en mode sans echec ne detecte rien.
J'envoie les rapports demandes:
bitdefender
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >
<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
<p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan="3" width="912">
<p><font face="Arial"><span style="font-size:11pt;"><B>Rapport d'analyse généré à: Sat, Sep 08, 2007 - 21:49:27</b></span></font></p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B>Voie d'analyse: </b></span><span style="font-size:10pt;">A:\;C:\;D:\;</span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Statistiques</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Temps</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">00:46:42</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">99967</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Directoires</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4600</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Secteurs de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">942</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4962</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Résultats</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Virus identifiés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">1</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers infectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers suspects</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Désinfectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers effacés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Info sur les moteurs</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Définition virus</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">800186</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Version des moteurs</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">14</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archive des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">38</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Unpack des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">E-mail plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Système plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">1</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Paramètres d'analyse</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Première action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Désinfecté</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Seconde Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Heuristique</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Acceptez les avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Extensions analysées</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">*;</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Excludez les extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse d'emails</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyser paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Fichier analysé</b></font></p>
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
<p align="left"><b><font size="2" face="Arial"> Statut</font></b></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Mis à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr>
</table>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
</table>
<p> </p>
</body>
</html>
et le rapport Hijack:
Logfile of HijackThis v1.99.1
Scan saved at 22:11:57, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C231421-B95A-45CA-87CD-36E3201DA952}: NameServer = 86.64.145.144 84.103.237.144
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Je ne suis pas sure que la conversion du rapport bitdefender en fichier text soit tres facile à lire. Dois-je recommencer? Et que faire ensuite?
Merci pour l'aide
A bientot
J'envoie les rapports demandes:
bitdefender
<HTML>
<HEAD>
<TITLE>BitDefender Online Scanner - Rapport d'analyse</TITLE>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
</HEAD>
<BODY BGCOLOR=#FFFFFF leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >
<table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
<tr>
<td width="458">
<p><font face="Arial" color=red><span style="font-size:14pt;"><b>BitDefender Online Scanner</b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan="3" width="912">
<p><font face="Arial"><span style="font-size:11pt;"><B>Rapport d'analyse généré à: Sat, Sep 08, 2007 - 21:49:27</b></span></font></p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B>Voie d'analyse: </b></span><span style="font-size:10pt;">A:\;C:\;D:\;</span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Statistiques</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Temps</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">00:46:42</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">99967</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Directoires</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4600</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Secteurs de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">2</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">942</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">4962</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Résultats</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Virus identifiés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">1</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers infectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers suspects</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Désinfectés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">0</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Fichiers effacés</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Info sur les moteurs</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Définition virus</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">800186</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Version des moteurs</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">14</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Archive des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">38</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Unpack des plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">7</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">E-mail plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">6</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Système plugins</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">1</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="451" colspan="2" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Paramètres d'analyse</b></font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Première action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Désinfecté</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Seconde Action</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Heuristique</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Acceptez les avertissements</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Extensions analysées</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">*;</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Excludez les extensions</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2"> </font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse d'emails</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des Archives</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyser paquets programmes</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse des fichiers</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">Analyse de boot</font></p>
</td>
<td width="43%" align="right">
<p><font face="Arial" size="2">Oui</font></p>
</td>
</tr>
</table>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td colspan=2>
<table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
<tr>
<td width="252" bgcolor="#CCCCCC">
<p><font face="Arial" size="2"><B>Fichier analysé</b></font></p>
</td>
<td width="195" bgcolor="#CCCCCC" align="right">
<p align="left"><b><font size="2" face="Arial"> Statut</font></b></p>
</td>
</tr>
<tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip=>347A8AA6.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\qoobox\Quarantine\catchme2007-09-08_184707.17.zip</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Mis à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000302.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP4\A0000307.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000343.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Infecté par: Trojan.Spy.Agent.SF</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la désinfection</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Supprimé</font></p>
</td>
</tr><tr>
<td width="57%">
<p><font face="Arial" size="2">C:\WINDOWS\system32\MS318F19.DLL</font></p>
</td>
<td width="43%" align="left">
<p><font face="Arial" size="2">Echec de la mise à jour</font></p>
</td>
</tr>
</table>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
<tr>
<td width="458">
<p><font face="Arial"><span style="font-size:11pt;"><B> </b></span></font></p>
</td>
<td width="40%">
<p> </p>
</td>
<td width="10%">
<p> </p>
</td>
</tr>
</table>
<p> </p>
</body>
</html>
et le rapport Hijack:
Logfile of HijackThis v1.99.1
Scan saved at 22:11:57, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C231421-B95A-45CA-87CD-36E3201DA952}: NameServer = 86.64.145.144 84.103.237.144
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Je ne suis pas sure que la conversion du rapport bitdefender en fichier text soit tres facile à lire. Dois-je recommencer? Et que faire ensuite?
Merci pour l'aide
A bientot
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
8 sept. 2007 à 23:10
8 sept. 2007 à 23:10
quel virus trouvés par bitdefender?
quels virus n'ont pas été effacés?
___________
telecharge e scan decompresse le (unzip) et scan avec
http://www.spywareinfo.dk/download/mwav.exe
_________
recolle hijackthis et dis tes pbs
quels virus n'ont pas été effacés?
___________
telecharge e scan decompresse le (unzip) et scan avec
http://www.spywareinfo.dk/download/mwav.exe
_________
recolle hijackthis et dis tes pbs
desolée pour l précédent message avec le rapport qui ne donnait pas grand chose.
Voici plus succint de ce matin avant le spywareinfo:
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Sep 09, 2007 - 11:11:33
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
105053
Infectés Fichiers
3
Virus Détectés
Trojan.Spy.Agent.SF
3
--------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
Je fais la manip suivante
A+
Voici plus succint de ce matin avant le spywareinfo:
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Sep 09, 2007 - 11:11:33
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
105053
Infectés Fichiers
3
Virus Détectés
Trojan.Spy.Agent.SF
3
--------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
Je fais la manip suivante
A+
Et voici les 2 derniers rapports demandés:
mwav:
Sun Sep 09 13:00:48 2007 => **********************************************************
Sun Sep 09 13:00:48 2007 => eScan AntiVirus Toolkit Utility.
Sun Sep 09 13:00:48 2007 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Sep 09 13:00:48 2007 => **********************************************************
Sun Sep 09 13:00:48 2007 => Version 4.4.7
Sun Sep 09 13:00:48 2007 => Log File: C:\KASPER~1\mwav.log
Sun Sep 09 13:00:50 2007 => Latest Date of files inside MWAV: 04 Sep 2007 00:11:30.
Sun Sep 09 13:00:53 2007 => AV Library Loaded...
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavss.exe
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\Getvlist.exe
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavss.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavssdi.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavssi.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavvlg.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\msvlclnt.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\ipc.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\main.avi
Sun Sep 09 13:00:54 2007 => Scanning File C:\KASPER~1\virus.avi
Sun Sep 09 13:00:54 2007 => Virus Database Date: 2007/09/04
Sun Sep 09 13:00:54 2007 => Virus Database Count: 403200
Sun Sep 09 13:02:00 2007 => **********************************************************
Sun Sep 09 13:02:00 2007 => eScan AntiVirus Toolkit Utility.
Sun Sep 09 13:02:00 2007 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Sep 09 13:02:00 2007 =>
Sun Sep 09 13:02:00 2007 => Support: support@mwti.net
Sun Sep 09 13:02:00 2007 => Web: https://www.escanav.com/en/index.asp
Sun Sep 09 13:02:00 2007 => **********************************************************
Sun Sep 09 13:02:00 2007 => Version 4.4.7
Sun Sep 09 13:02:00 2007 => Log File: C:\KASPER~1\mwav.log
Sun Sep 09 13:02:00 2007 => Latest Date of files inside MWAV: 04 Sep 2007 00:11:30.
Sun Sep 09 13:02:00 2007 => Options Selected by User:
Sun Sep 09 13:02:00 2007 => Memory Check: Enabled
Sun Sep 09 13:02:00 2007 => Registry Check: Enabled
Sun Sep 09 13:02:00 2007 => StartUp Folder Check: Enabled
Sun Sep 09 13:02:00 2007 => System Folder Check: Enabled
Sun Sep 09 13:02:00 2007 => System Area Check: Disabled
Sun Sep 09 13:02:00 2007 => Services Check: Enabled
Sun Sep 09 13:02:00 2007 => Drive Check Option Disabled
Sun Sep 09 13:02:00 2007 => Scanning Type: Scan And Clean
Sun Sep 09 13:02:00 2007 => Folder Check: Disabled
Sun Sep 09 13:02:01 2007 => ***** Scanning Memory Files *****
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\Explorer.EXE
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\PROGRA~1\A-SQUA~1\A2SERV~1.EXE
Sun Sep 09 13:02:01 2007 => Scanning File C:\PROGRA~1\Lavasoft\AD-AWA~1\AAWSER~1.EXE
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\defwatch.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCDsrv.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\rtvscan.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\System32\nvsvc32.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\vptray.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\ScanSoft\OMNIPA~1.0\OPWARE~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCD.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\FICHIE~1\Real\UPDATE~1\REALSC~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\QUICKT~1\qttask.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Winamp\winampa.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\wscntfy.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\MsgSys.EXE
Sun Sep 09 13:02:04 2007 => Scanning File C:\Kaspersky\mwavscan.com
Sun Sep 09 13:02:05 2007 => Scanning File C:\Kaspersky\kavss.exe
Sun Sep 09 13:02:05 2007 => ***** Scanning Registry Files *****
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Sun Sep 09 13:02:05 2007 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Sep 09 13:02:05 2007 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\System32\webcheck.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\System32\stobject.dll
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
Sun Sep 09 13:02:05 2007 => {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\Adobe\ACROBA~2.0\ActiveX\ACROIE~1.DLL
Sun Sep 09 13:02:05 2007 => {2E03C0FD-4C48-43A7-9A54-00240C70FF16} = C:\WINDOWS\system32\BhoECart.dll
Sun Sep 09 13:02:05 2007 => ERROR!!! Invalid Entry = C:\WINDOWS\system32\BhoECart.dll. Removing it.
Sun Sep 09 13:02:05 2007 => {53707962-6F74-2D53-2644-206D7942484F} = C:\PROGRA~1\SPYBOT~1\SDHelper.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\SPYBOT~1\SDHelper.dll
Sun Sep 09 13:02:05 2007 => {AA58ED58-01DD-4d91-8333-CF10577473F7} = c:\program files\google\googletoolbar4.dll
Sun Sep 09 13:02:05 2007 => Scanning File c:\PROGRA~1\google\GOOGLE~4.DLL
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\Explorer.exe
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\userinit.exe
Sun Sep 09 13:02:05 2007 => Scanning HKCU\Control Panel\Desktop
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\NavNT\vptray.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\SiSUSBrg.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\ScanSoft\OMNIPA~1.0\OPWARE~1.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\nwiz.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\RUNDLL32.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCD.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\RunDll32.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\FICHIE~1\Real\UPDATE~1\REALSC~1.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\QUICKT~1\qttask.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Winamp\winampa.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Sep 09 13:02:06 2007 => *** File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe having Size Restriction ***
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe [**]
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Sep 09 13:02:07 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:07 2007 => *** File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe having Size Restriction ***
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe [**]
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\Google\GOOGLE~2\121128~1.546\GOOGLE~1.EXE
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Sep 09 13:02:07 2007 => Scanning HKCR\txtfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\comfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\exefile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\dllfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\batfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\piffile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\scrfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\scrfile\shell\config\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\regfile\shell\open\command
Sun Sep 09 13:02:07 2007 => ***** Scanning StartUp Folders *****
Sun Sep 09 13:02:07 2007 => ***** Scanning C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage Folder *****
Sun Sep 09 13:02:07 2007 => Scanning Folder: C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage\*.*
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage\desktop.ini
Sun Sep 09 13:02:07 2007 => ***** Scanning C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage Folder *****
Sun Sep 09 13:02:07 2007 => Scanning Folder: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\*.*
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
Sun Sep 09 13:02:07 2007 => ***** Scanning Service Files *****
Sun Sep 09 13:02:07 2007 => Scanning HKLM\SYSTEM\CurrentControlSet\Services
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\A-SQUA~1\A2SERV~1.EXE
Sun Sep 09 13:02:08 2007 => Scanning File C:\PROGRA~1\Lavasoft\AD-AWA~1\AAWSER~1.EXE
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ACPI.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\Drivers\adildr.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\drivers\aec.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\drivers\afd.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\alg.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\amdk7.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\asyncmac.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\atapi.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\atmarpc.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\audstub.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\PROGRA~1\GRISOFT\AVGANT~1.5\GUARD.SYS
Sun Sep 09 13:02:09 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\guard.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\AvgAsCln.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => ERROR!!! Invalid Entry \??\C:\DOCUME~1\Sandra\LOCALS~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme...
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\cdrom.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\cisvc.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\clipsrv.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\drivers\cmuda.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\dllhost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\PROGRA~1\NavNT\defwatch.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\disk.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\dmadmin.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\dmboot.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\dmio.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\DMusic.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\drmkaud.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\fdc.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\flpydisk.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\drivers\fltmgr.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ftdisk.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\gameenum.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\msgpc.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\PROGRA~1\Google\Common\GOOGLE~1\GOOGLE~1.EXE
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\Drivers\HTTP.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\i8042prt.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\System32\imapi.exe
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\InCDPass.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCDsrv.exe
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\drivers\ip6fw.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipinip.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipnat.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipsec.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\irenum.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\isapnp.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\kbdclass.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\drivers\kmixer.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\mnmsrvc.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mouclass.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mrxdav.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\msdtc.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\msiexec.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSKSSRV.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSPCLOCK.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSPQM.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mssmbios.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSTEE.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\drivers\msmpu401.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\NAVNT\NAVAP.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\NAVNT\NAVAPEL.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20070829.009\NAVENG.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20070829.009\NAVEX15.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\NdisIP.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndistapi.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndiswan.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\netbios.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\netbt.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\netdde.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\netdde.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\PROGRA~1\NavNT\rtvscan.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\nvsvc32.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\Drivers\ov519vid.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\parport.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\pci.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\pciide.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\drivers\pfc.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspptp.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\processr.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\psched.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ptilink.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rasacd.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspppoe.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspti.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rdbss.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rdpdr.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\sessmgr.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\redbook.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\locator.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\rsvp.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\SCardSvr.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\drivers\scsiport.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\secdrv.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\serenum.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\serial.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\sisnic.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\SLIP.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\drivers\splitter.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\sr.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\srescan.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\srv.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\StreamIP.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\swenum.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\drivers\swmidi.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\dllhost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\PROGRA~1\SYMANTEC\SYMEVENT.SYS
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\drivers\sysaudio.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\smlogsvc.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\tcpip.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\termdd.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\tlntsvr.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\wdfmgr.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\update.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\ups.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\drivers\usbaudio.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbccgp.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbhub.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbohci.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbprint.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbscan.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\drivers\vga.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\vsdatant.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\vssvc.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\wanarp.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\drivers\wdmaud.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\wbem\wmiapsrv.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\drivers\ws2ifsl.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => ***** Scanning System32 Folders *****
Sun Sep 09 13:02:21 2007 => Scanning C:\WINDOWS Directory
Sun Sep 09 13:02:21 2007 => Scanning Folder: C:\WINDOWS\*.*
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\0.log [**]
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\001221_.tmp
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\002810_.tmp
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\318F1976.log
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\ABC3D.SN
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\adidsl.ini
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\adiras.ini
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\Alternative Uninstaller.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\amcap.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\Ascd_tmp.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\aucfg.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\AuHCcup1.dll
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\AuHCcup1.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\autoclk.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bdoscandel.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bdoscandellang.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bootstat.dat
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\BPMNT.dll
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\Bulles de savon.bmp
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\catchme.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\cdplayer.ini
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CleanDev.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\clock.avi
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMB.inf
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMCDPLAY.INI
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMIRmDriver.dll
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CmiRmRedundDir.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMISETUP.INI
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMIUninstall.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\comsetup.log
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Contact.INI
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\control.ini [**]
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\CSTBox.INI
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\desktop.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\explorer.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\explorer.scf
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Fast800.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FaxSetup.log
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FeAnim.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FeMakro.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\GetServer.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Granit vert.bmp
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\hcextoutput.dll
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\hh.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\iis6.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\imsins.BAK
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\imsins.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\IsUn040c.exe
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\Jour de pêche.bmp
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB921503.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB933360.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB936021.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB936782.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB937143.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938127.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938828.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938829.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\loadhttp.dll
Sun Sep 09 13:02:26 2007 => *** File C:\WINDOWS\LPT$VPN.395 having Size Restriction ***
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\LPT$VPN.395 [**]
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\MAXLINK.INI
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\MedCtrOC.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msdfmap.ini
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msgsocm.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msmqinst.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msnfix.txt
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\Mur de Santa Fe.bmp
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\netfxocm.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NirCmd.exe
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\notepad.exe
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\ntbtlog.txt
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\ntdtcsetup.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NuNinst.cfg
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NuNinst.exe
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\o2cLicStore.bin
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ocgen.log
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ocmsn.log
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ODBC.INI
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ODBCINST.INI
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\OV519.txt
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ov519cap.exe
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ov519dib.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\PATCH.EXE
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\patchw32.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\pavsig.txt
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\pcdlib32.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\Plume.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\POCE98.DLL
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\POCELANG.DLL
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\PS_setup.ini
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\regedit.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\REGLOCS.OLD
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rhododendron.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rivière Sumida.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rosace bleue 16.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\runtsckl.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SchedLgU.Txt
Sun Sep 09 13:02:29 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\SchedLgU.Txt
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\sel3110.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET3.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET38.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET3A.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET44.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET46.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET7.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\setupact.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.log.0.old
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.old
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setuperr.log [**]
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\SiSUSBrg.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\SIS_LIB.DLL
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\slrundll.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\spupdsvc.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\Sti_Trace.log [**]
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\system.ini
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tabletoc.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\taskman.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\Tasse à café.bmp
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\TMUPDATE.DLL
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tmupdate.ini
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tsc.exe
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\TSC.INI
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\tsc.ptn
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\tsoc.log
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twain.dll
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twain_32.dll
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\TwnkCamP.TXT
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twunk_16.exe
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twunk_32.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNMRW.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNMRW.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNeroVision.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNeroVision.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNMP.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNMP.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\unvise32.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNZIP.DLL
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\updspapi.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\UPGRADE.TXT
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vb.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vbaddin.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\Vent de prairie.bmp
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vidcap32.exe
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\videoimp.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\VI_setup.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vmmreg32.dll
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vpc32.INI [**]
Sun Sep 09 13:02:33 2007 => *** File C:\WINDOWS\VPTNFILE.395 having Size Restriction ***
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\VPTNFILE.395 [**]
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vsapi32.dll
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\wiadebug.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\wiadebug.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\wiaservc.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\wiaservc.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\win.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winamp.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\WindowsShell.Manifest
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\WindowsUpdate.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\WindowsUpdate.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winhelp.exe
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winhlp32.exe
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winiini.fin
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\Wininit.ini [**]
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winio.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winio.sys
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winnt.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winnt256.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\wmprfFRA.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\wmsetup.log
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\WMSysPr9.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\WMSysPrx.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\Zapotec.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\zllsputility.exe
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\zllsputility_loc040c.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\_default.pif
Sun Sep 09 13:02:34 2007 => Scanning C:\WINDOWS\system32 Directory
Sun Sep 09 13:02:34 2007 => Scanning Folder: C:\WINDOWS\system32\*.*
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\$winnt$.inf
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\12520437.cpx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\12520850.cpx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\6to4svc.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\a3d.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\aaaamon.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\access.cpl
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acctres.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\accwiz.exe
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acelpdec.ax
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acledit.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\aclui.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\activeds.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\activeds.tlb
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\actmovie.exe
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\actxprxy.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\adadix16.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adadix2k.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adadix32.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\AddQuit.ico
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\admparse.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adptif.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsldp.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsldpc.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsmsext.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnds.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnt.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnw.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\advapi32.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\advpack.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\ahui.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\alg.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\alrsvc.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\amcompat.tlb
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\AMSLIB.DLL
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\amstream.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\ansi.sys
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\apcups.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\append.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\apphelp.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\appmgmts.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\appmgr.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\appwiz.cpl
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\arp.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asctrls.ocx
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asferror.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asfiles.txt [**]
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asinst.cfg
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_fmt.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_ldm.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_pfu.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asuninst.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asycfilt.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\at.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\ati2cqag.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\ati2dvaa.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati2dvag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3d1ag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3d2ag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3duag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativdaxx.ax
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativmvxx.ax
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativtmxx.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativvaxx.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atkctrs.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atl.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atl71.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atmadm.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmfd.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmlib.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmpvcno.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atrace.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\attrib.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\Audio3D.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\Audiodev.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\audiosrv.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\auditusr.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\authz.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\autochk.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\autoconv.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autodisc.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\AUTOEXEC.NT
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autofmt.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autolfn.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avicap.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avicap32.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avifil32.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avifile.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avmeter.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avtapi.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avwav.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\basesrv.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\batmeter.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\batt.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bdaplgin.ax
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bidispl.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bios1.rom
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bios4.rom
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bitsprx2.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bitsprx3.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\blackbox.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\blastcln.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootcfg.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootok.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootvid.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootvrfy.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bopomofo.uce
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\browselc.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browser.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browseui.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browsewm.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthci.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthprops.cpl
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthserv.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\btpanui.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\C1210.PLG
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\C1210TA.PLG
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cabinet.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cabview.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cacls.exe
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cadstrin.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\calc.exe
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\camocx.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\capesnpn.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\cards.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrv.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrvps.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrvut.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\cba.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\CBAXFR.DLL
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\ccfgnt.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\ccrpftv6.ocx
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdfview.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdm.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdmodem.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdosys.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdplayer.exe.manifest
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certcli.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certmgr.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certmgr.msc
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cewmdm.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cfgbkend.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cfgmgr32.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\charmap.exe
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\Chaînes.scf
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chcp.com
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chkdsk.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chkntfs.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciadmin.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciadv.msc
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cic.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cidaemon.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciodm.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cipher.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cisvc.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ckcnv.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\clb.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\clbcatex.dll
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\clbcatq.dll
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\cleanmgr.exe
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\cliconf.chm
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.dll
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.rll
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clipbrd.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clipsrv.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clusapi.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\CLUTIL_S.DLL
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmcfg32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmd.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdial32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdl32.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdlib.wsc
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmglue.vxd
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmirmdrv.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmirmdrv.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmmgr32.hlp
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmmon32.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmos.ram
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmpbk32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmprops.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmsetacl.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmstp.exe
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmuda.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmutil.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cnbjmon.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cnetcfg.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMCP58.exe
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMLM58.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMVS58.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNQA1210.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNQL1210.DLL
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\CNQU85.DLL
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\cnvfat.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\coclassfast.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\colbact.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comaddin.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comcat.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comctl32.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMCTL32.OCA
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMCTL32.OCX
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comdlg32.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMDLG32.OCA
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMDLG32.OCX
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comm.drv
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\command.com
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\commdlg.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comp.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compact.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compatui.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compmgmt.msc
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compobj.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compstui.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comrepl.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comres.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsdupd.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsnap.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsvcs.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\comuid.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\CONFIG.NT
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\CONFIG.TMP
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\confmsp.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\conime.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\console.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\Contact.INI
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\control.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\convert.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\corpol.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\country.sys
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\credui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\crtdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\crypt32.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptdlg.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptext.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptnet.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptsvc.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscript.exe
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\CSL.DLL
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\csrsrv.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\csrss.exe
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\csseqchk.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSM32S.DLL
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSM32S.SIG
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSMS_IN.DLL
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctl3d32.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctl3dv2.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctype.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_037.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10000.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10006.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10007.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10010.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10017.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10029.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10079.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10081.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10082.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1026.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1250.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1251.nls
Sun Sep 09 13:02:56 2007 => Scanning File C:\WINDOWS\system32\c_1252.nls
Sun Se
mwav:
Sun Sep 09 13:00:48 2007 => **********************************************************
Sun Sep 09 13:00:48 2007 => eScan AntiVirus Toolkit Utility.
Sun Sep 09 13:00:48 2007 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Sep 09 13:00:48 2007 => **********************************************************
Sun Sep 09 13:00:48 2007 => Version 4.4.7
Sun Sep 09 13:00:48 2007 => Log File: C:\KASPER~1\mwav.log
Sun Sep 09 13:00:50 2007 => Latest Date of files inside MWAV: 04 Sep 2007 00:11:30.
Sun Sep 09 13:00:53 2007 => AV Library Loaded...
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavss.exe
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\Getvlist.exe
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavss.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavssdi.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavssi.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\kavvlg.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\msvlclnt.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\ipc.dll
Sun Sep 09 13:00:53 2007 => Scanning File C:\KASPER~1\main.avi
Sun Sep 09 13:00:54 2007 => Scanning File C:\KASPER~1\virus.avi
Sun Sep 09 13:00:54 2007 => Virus Database Date: 2007/09/04
Sun Sep 09 13:00:54 2007 => Virus Database Count: 403200
Sun Sep 09 13:02:00 2007 => **********************************************************
Sun Sep 09 13:02:00 2007 => eScan AntiVirus Toolkit Utility.
Sun Sep 09 13:02:00 2007 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Sun Sep 09 13:02:00 2007 =>
Sun Sep 09 13:02:00 2007 => Support: support@mwti.net
Sun Sep 09 13:02:00 2007 => Web: https://www.escanav.com/en/index.asp
Sun Sep 09 13:02:00 2007 => **********************************************************
Sun Sep 09 13:02:00 2007 => Version 4.4.7
Sun Sep 09 13:02:00 2007 => Log File: C:\KASPER~1\mwav.log
Sun Sep 09 13:02:00 2007 => Latest Date of files inside MWAV: 04 Sep 2007 00:11:30.
Sun Sep 09 13:02:00 2007 => Options Selected by User:
Sun Sep 09 13:02:00 2007 => Memory Check: Enabled
Sun Sep 09 13:02:00 2007 => Registry Check: Enabled
Sun Sep 09 13:02:00 2007 => StartUp Folder Check: Enabled
Sun Sep 09 13:02:00 2007 => System Folder Check: Enabled
Sun Sep 09 13:02:00 2007 => System Area Check: Disabled
Sun Sep 09 13:02:00 2007 => Services Check: Enabled
Sun Sep 09 13:02:00 2007 => Drive Check Option Disabled
Sun Sep 09 13:02:00 2007 => Scanning Type: Scan And Clean
Sun Sep 09 13:02:00 2007 => Folder Check: Disabled
Sun Sep 09 13:02:01 2007 => ***** Scanning Memory Files *****
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\Explorer.EXE
Sun Sep 09 13:02:01 2007 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Sun Sep 09 13:02:01 2007 => Scanning File C:\PROGRA~1\A-SQUA~1\A2SERV~1.EXE
Sun Sep 09 13:02:01 2007 => Scanning File C:\PROGRA~1\Lavasoft\AD-AWA~1\AAWSER~1.EXE
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\defwatch.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCDsrv.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\rtvscan.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\System32\nvsvc32.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\NavNT\vptray.exe
Sun Sep 09 13:02:02 2007 => Scanning File C:\PROGRA~1\ScanSoft\OMNIPA~1.0\OPWARE~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCD.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\FICHIE~1\Real\UPDATE~1\REALSC~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\QUICKT~1\qttask.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Winamp\winampa.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe
Sun Sep 09 13:02:03 2007 => Scanning File C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\SAGEM\SAGEMF~1\dslmon.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\wscntfy.exe
Sun Sep 09 13:02:04 2007 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
Sun Sep 09 13:02:04 2007 => Scanning File C:\WINDOWS\system32\MsgSys.EXE
Sun Sep 09 13:02:04 2007 => Scanning File C:\Kaspersky\mwavscan.com
Sun Sep 09 13:02:05 2007 => Scanning File C:\Kaspersky\kavss.exe
Sun Sep 09 13:02:05 2007 => ***** Scanning Registry Files *****
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Sun Sep 09 13:02:05 2007 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Sep 09 13:02:05 2007 => *** File C:\WINDOWS\system32\SHELL32.dll having Size Restriction ***
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\SHELL32.dll [**]
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\System32\webcheck.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\System32\stobject.dll
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
Sun Sep 09 13:02:05 2007 => {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\Adobe\ACROBA~2.0\ActiveX\ACROIE~1.DLL
Sun Sep 09 13:02:05 2007 => {2E03C0FD-4C48-43A7-9A54-00240C70FF16} = C:\WINDOWS\system32\BhoECart.dll
Sun Sep 09 13:02:05 2007 => ERROR!!! Invalid Entry = C:\WINDOWS\system32\BhoECart.dll. Removing it.
Sun Sep 09 13:02:05 2007 => {53707962-6F74-2D53-2644-206D7942484F} = C:\PROGRA~1\SPYBOT~1\SDHelper.dll
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\SPYBOT~1\SDHelper.dll
Sun Sep 09 13:02:05 2007 => {AA58ED58-01DD-4d91-8333-CF10577473F7} = c:\program files\google\googletoolbar4.dll
Sun Sep 09 13:02:05 2007 => Scanning File c:\PROGRA~1\google\GOOGLE~4.DLL
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\Explorer.exe
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\system32\userinit.exe
Sun Sep 09 13:02:05 2007 => Scanning HKCU\Control Panel\Desktop
Sun Sep 09 13:02:05 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Sep 09 13:02:05 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:05 2007 => Scanning File C:\PROGRA~1\NavNT\vptray.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\SiSUSBrg.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\ScanSoft\OMNIPA~1.0\OPWARE~1.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\nwiz.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\RUNDLL32.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCD.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\WINDOWS\system32\RunDll32.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\FICHIE~1\Real\UPDATE~1\REALSC~1.EXE
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\QUICKT~1\qttask.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Winamp\winampa.exe
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\iTunes\ITUNES~1.EXE
Sun Sep 09 13:02:06 2007 => *** File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe having Size Restriction ***
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe [**]
Sun Sep 09 13:02:06 2007 => Scanning File C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Sep 09 13:02:06 2007 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sun Sep 09 13:02:07 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:07 2007 => *** File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe having Size Restriction ***
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\MSNMES~1\MsnMsgr.Exe [**]
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\Google\GOOGLE~2\121128~1.546\GOOGLE~1.EXE
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
Sun Sep 09 13:02:07 2007 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Sun Sep 09 13:02:07 2007 => Scanning HKCR\txtfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\comfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\exefile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\dllfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\batfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\piffile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\scrfile\shell\open\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\scrfile\shell\config\command
Sun Sep 09 13:02:07 2007 => Scanning HKCR\regfile\shell\open\command
Sun Sep 09 13:02:07 2007 => ***** Scanning StartUp Folders *****
Sun Sep 09 13:02:07 2007 => ***** Scanning C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage Folder *****
Sun Sep 09 13:02:07 2007 => Scanning Folder: C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage\*.*
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\Sandra\Menu Démarrer\Programmes\Démarrage\desktop.ini
Sun Sep 09 13:02:07 2007 => ***** Scanning C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage Folder *****
Sun Sep 09 13:02:07 2007 => Scanning Folder: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\*.*
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\DSLMON.lnk
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
Sun Sep 09 13:02:07 2007 => Scanning File C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
Sun Sep 09 13:02:07 2007 => ***** Scanning Service Files *****
Sun Sep 09 13:02:07 2007 => Scanning HKLM\SYSTEM\CurrentControlSet\Services
Sun Sep 09 13:02:07 2007 => Scanning File C:\PROGRA~1\A-SQUA~1\A2SERV~1.EXE
Sun Sep 09 13:02:08 2007 => Scanning File C:\PROGRA~1\Lavasoft\AD-AWA~1\AAWSER~1.EXE
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ACPI.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\Drivers\adildr.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\adiusbaw.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\drivers\aec.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\drivers\afd.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\System32\alg.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\amdk7.sys
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:08 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\asyncmac.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\atapi.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\atmarpc.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\audstub.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\PROGRA~1\GRISOFT\AVGANT~1.5\GUARD.SYS
Sun Sep 09 13:02:09 2007 => Scanning File C:\PROGRA~1\Grisoft\AVGANT~1.5\guard.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\AvgAsCln.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:09 2007 => ERROR!!! Invalid Entry \??\C:\DOCUME~1\Sandra\LOCALS~1\Temp\catchme.sys in SYSTEM\CurrentControlSet\Services\catchme...
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\cdrom.sys
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\cisvc.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\clipsrv.exe
Sun Sep 09 13:02:09 2007 => Scanning File C:\WINDOWS\system32\drivers\cmuda.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\dllhost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\PROGRA~1\NavNT\defwatch.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\disk.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\dmadmin.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\dmboot.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\dmio.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\DMusic.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\drivers\drmkaud.sys
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:10 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\fdc.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\flpydisk.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\drivers\fltmgr.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ftdisk.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\gameenum.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\msgpc.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\PROGRA~1\Google\Common\GOOGLE~1\GOOGLE~1.EXE
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\Drivers\HTTP.sys
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:11 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\i8042prt.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\System32\imapi.exe
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\InCDPass.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\PROGRA~1\Ahead\InCD\InCDsrv.exe
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\drivers\ip6fw.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipinip.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipnat.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ipsec.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\irenum.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\isapnp.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\kbdclass.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\system32\drivers\kmixer.sys
Sun Sep 09 13:02:12 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\mnmsrvc.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mouclass.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mrxdav.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\msdtc.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\System32\msiexec.exe
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSKSSRV.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSPCLOCK.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSPQM.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\mssmbios.sys
Sun Sep 09 13:02:13 2007 => Scanning File C:\WINDOWS\system32\drivers\MSTEE.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\drivers\msmpu401.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\NAVNT\NAVAP.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\NAVNT\NAVAPEL.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20070829.009\NAVENG.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20070829.009\NAVEX15.SYS
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\NdisIP.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndistapi.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ndiswan.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\netbios.sys
Sun Sep 09 13:02:14 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\netbt.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\netdde.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\netdde.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\PROGRA~1\NavNT\rtvscan.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\System32\nvsvc32.exe
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\Drivers\ov519vid.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\parport.sys
Sun Sep 09 13:02:15 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\pci.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\pciide.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\drivers\pfc.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\services.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\lsass.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspptp.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\processr.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\psched.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\ptilink.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rasacd.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspppoe.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\raspti.sys
Sun Sep 09 13:02:16 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rdbss.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\rdpdr.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\sessmgr.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\redbook.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\locator.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\rsvp.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\lsass.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\SCardSvr.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\drivers\scsiport.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\secdrv.sys
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:17 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\serenum.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\serial.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\sisnic.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\SLIP.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\drivers\splitter.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\spoolsv.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\sr.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\srescan.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\srv.sys
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:18 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\StreamIP.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\swenum.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\drivers\swmidi.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\dllhost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\PROGRA~1\SYMANTEC\SYMEVENT.SYS
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\drivers\sysaudio.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\smlogsvc.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\tcpip.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\termdd.sys
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\tlntsvr.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\System32\wdfmgr.exe
Sun Sep 09 13:02:19 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\update.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\ups.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\drivers\usbaudio.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbccgp.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbhub.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbohci.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbprint.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\usbscan.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\drivers\vga.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\vsdatant.sys
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\vssvc.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:20 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\wanarp.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\drivers\wdmaud.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\wbem\wmiapsrv.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\drivers\ws2ifsl.sys
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\system32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => Scanning File C:\WINDOWS\System32\svchost.exe
Sun Sep 09 13:02:21 2007 => ***** Scanning System32 Folders *****
Sun Sep 09 13:02:21 2007 => Scanning C:\WINDOWS Directory
Sun Sep 09 13:02:21 2007 => Scanning Folder: C:\WINDOWS\*.*
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\0.log [**]
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\001221_.tmp
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\002810_.tmp
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\318F1976.log
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\ABC3D.SN
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\adidsl.ini
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\adiras.ini
Sun Sep 09 13:02:22 2007 => Scanning File C:\WINDOWS\Alternative Uninstaller.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\amcap.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\Ascd_tmp.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\aucfg.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\AuHCcup1.dll
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\AuHCcup1.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\autoclk.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bdoscandel.exe
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bdoscandellang.ini
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\bootstat.dat
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\BPMNT.dll
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\Bulles de savon.bmp
Sun Sep 09 13:02:23 2007 => Scanning File C:\WINDOWS\catchme.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\cdplayer.ini
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CleanDev.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\clock.avi
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMB.inf
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMCDPLAY.INI
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMIRmDriver.dll
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CmiRmRedundDir.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMISETUP.INI
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\CMIUninstall.exe
Sun Sep 09 13:02:24 2007 => Scanning File C:\WINDOWS\comsetup.log
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Contact.INI
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\control.ini [**]
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\CSTBox.INI
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\desktop.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\explorer.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\explorer.scf
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Fast800.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FaxSetup.log
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FeAnim.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\FeMakro.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\GetServer.ini
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\Granit vert.bmp
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\hcextoutput.dll
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\hh.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\htpatch.exe
Sun Sep 09 13:02:25 2007 => Scanning File C:\WINDOWS\iis6.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\imsins.BAK
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\imsins.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\IsUn040c.exe
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\Jour de pêche.bmp
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB921503.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB933360.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB936021.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB936782.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB937143.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938127.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938828.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\KB938829.log
Sun Sep 09 13:02:26 2007 => Scanning File C:\WINDOWS\loadhttp.dll
Sun Sep 09 13:02:26 2007 => *** File C:\WINDOWS\LPT$VPN.395 having Size Restriction ***
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\LPT$VPN.395 [**]
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\MAXLINK.INI
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\MedCtrOC.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msdfmap.ini
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msgsocm.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msmqinst.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\msnfix.txt
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\Mur de Santa Fe.bmp
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\netfxocm.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NirCmd.exe
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\notepad.exe
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\ntbtlog.txt
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\ntdtcsetup.log
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NuNinst.cfg
Sun Sep 09 13:02:27 2007 => Scanning File C:\WINDOWS\NuNinst.exe
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\o2cLicStore.bin
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ocgen.log
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ocmsn.log
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ODBC.INI
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ODBCINST.INI
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\OV519.txt
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ov519cap.exe
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\ov519dib.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\PATCH.EXE
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\patchw32.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\pavsig.txt
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\pcdlib32.dll
Sun Sep 09 13:02:28 2007 => Scanning File C:\WINDOWS\Plume.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\POCE98.DLL
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\POCELANG.DLL
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\PS_setup.ini
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\regedit.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\REGLOCS.OLD
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rhododendron.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rivière Sumida.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\Rosace bleue 16.bmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\runtsckl.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SchedLgU.Txt
Sun Sep 09 13:02:29 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\SchedLgU.Txt
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\sel3110.exe
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET3.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET38.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET3A.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET44.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET46.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\SET7.tmp
Sun Sep 09 13:02:29 2007 => Scanning File C:\WINDOWS\setupact.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.log.0.old
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setupapi.old
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\setuperr.log [**]
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\SiSUSBrg.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\SIS_LIB.DLL
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\slrundll.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\spupdsvc.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\Sti_Trace.log [**]
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\system.ini
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tabletoc.log
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\taskman.exe
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\Tasse à café.bmp
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\TMUPDATE.DLL
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tmupdate.ini
Sun Sep 09 13:02:30 2007 => Scanning File C:\WINDOWS\tsc.exe
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\TSC.INI
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\tsc.ptn
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\tsoc.log
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twain.dll
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twain_32.dll
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\TwnkCamP.TXT
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twunk_16.exe
Sun Sep 09 13:02:31 2007 => Scanning File C:\WINDOWS\twunk_32.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNMRW.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNMRW.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNeroVision.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNeroVision.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNMP.cfg
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNNMP.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\unvise32.exe
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\UNZIP.DLL
Sun Sep 09 13:02:32 2007 => Scanning File C:\WINDOWS\updspapi.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\UPGRADE.TXT
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vb.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vbaddin.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\Vent de prairie.bmp
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vidcap32.exe
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\videoimp.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\VI_setup.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vmmreg32.dll
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vpc32.INI [**]
Sun Sep 09 13:02:33 2007 => *** File C:\WINDOWS\VPTNFILE.395 having Size Restriction ***
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\VPTNFILE.395 [**]
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\vsapi32.dll
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\wiadebug.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\wiadebug.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\wiaservc.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\wiaservc.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\win.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winamp.ini
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\WindowsShell.Manifest
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\WindowsUpdate.log
Sun Sep 09 13:02:33 2007 => ERROR!!! ScanFile fails for C:\WINDOWS\WindowsUpdate.log
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winhelp.exe
Sun Sep 09 13:02:33 2007 => Scanning File C:\WINDOWS\winhlp32.exe
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winiini.fin
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\Wininit.ini [**]
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winio.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winio.sys
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winnt.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\winnt256.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\wmprfFRA.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\wmsetup.log
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\WMSysPr9.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\WMSysPrx.prx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\Zapotec.bmp
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\zllsputility.exe
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\zllsputility_loc040c.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\_default.pif
Sun Sep 09 13:02:34 2007 => Scanning C:\WINDOWS\system32 Directory
Sun Sep 09 13:02:34 2007 => Scanning Folder: C:\WINDOWS\system32\*.*
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\$winnt$.inf
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\12520437.cpx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\12520850.cpx
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\6to4svc.dll
Sun Sep 09 13:02:34 2007 => Scanning File C:\WINDOWS\system32\a3d.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\aaaamon.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\access.cpl
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acctres.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\accwiz.exe
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acelpdec.ax
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\acledit.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\aclui.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\activeds.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\activeds.tlb
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\actmovie.exe
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\actxprxy.dll
Sun Sep 09 13:02:35 2007 => Scanning File C:\WINDOWS\system32\adadix16.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adadix2k.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adadix32.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\AddQuit.ico
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\admparse.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adptif.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsldp.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsldpc.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsmsext.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnds.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnt.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\adsnw.dll
Sun Sep 09 13:02:36 2007 => Scanning File C:\WINDOWS\system32\advapi32.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\advpack.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\ahui.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\alg.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\alrsvc.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\amcompat.tlb
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\AMSLIB.DLL
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\amstream.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\ansi.sys
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\apcups.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\append.exe
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\apphelp.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\appmgmts.dll
Sun Sep 09 13:02:37 2007 => Scanning File C:\WINDOWS\system32\appmgr.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\appwiz.cpl
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\arp.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asctrls.ocx
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asferror.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asfiles.txt [**]
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asinst.cfg
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_fmt.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_ldm.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asr_pfu.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asuninst.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\asycfilt.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\at.exe
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\ati2cqag.dll
Sun Sep 09 13:02:38 2007 => Scanning File C:\WINDOWS\system32\ati2dvaa.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati2dvag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3d1ag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3d2ag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ati3duag.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativdaxx.ax
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativmvxx.ax
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativtmxx.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\ativvaxx.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atkctrs.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atl.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atl71.dll
Sun Sep 09 13:02:39 2007 => Scanning File C:\WINDOWS\system32\atmadm.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmfd.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmlib.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atmpvcno.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\atrace.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\attrib.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\Audio3D.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\Audiodev.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\audiosrv.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\auditusr.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\authz.dll
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\autochk.exe
Sun Sep 09 13:02:40 2007 => Scanning File C:\WINDOWS\system32\autoconv.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autodisc.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\AUTOEXEC.NT
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autofmt.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\autolfn.exe
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avicap.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avicap32.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avifil32.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avifile.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avmeter.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avtapi.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\avwav.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\basesrv.dll
Sun Sep 09 13:02:41 2007 => Scanning File C:\WINDOWS\system32\batmeter.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\batt.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bdaplgin.ax
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bidispl.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bios1.rom
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bios4.rom
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bitsprx2.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bitsprx3.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\blackbox.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\blastcln.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootcfg.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootok.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootvid.dll
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bootvrfy.exe
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\bopomofo.uce
Sun Sep 09 13:02:42 2007 => Scanning File C:\WINDOWS\system32\browselc.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browser.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browseui.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\browsewm.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthci.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthprops.cpl
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\bthserv.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\btpanui.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\C1210.PLG
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\C1210TA.PLG
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cabinet.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cabview.dll
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cacls.exe
Sun Sep 09 13:02:43 2007 => Scanning File C:\WINDOWS\system32\cadstrin.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\calc.exe
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\camocx.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\capesnpn.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\cards.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrv.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrvps.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\catsrvut.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\cba.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\CBAXFR.DLL
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\ccfgnt.dll
Sun Sep 09 13:02:44 2007 => Scanning File C:\WINDOWS\system32\ccrpftv6.ocx
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdfview.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdm.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdmodem.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdosys.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cdplayer.exe.manifest
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certcli.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certmgr.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\certmgr.msc
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cewmdm.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cfgbkend.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\cfgmgr32.dll
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\charmap.exe
Sun Sep 09 13:02:45 2007 => Scanning File C:\WINDOWS\system32\Chaînes.scf
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chcp.com
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chkdsk.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\chkntfs.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciadmin.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciadv.msc
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cic.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cidaemon.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ciodm.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cipher.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\cisvc.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\ckcnv.exe
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\clb.dll
Sun Sep 09 13:02:46 2007 => Scanning File C:\WINDOWS\system32\clbcatex.dll
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\clbcatq.dll
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\cleanmgr.exe
Sun Sep 09 13:02:47 2007 => Scanning File C:\WINDOWS\system32\cliconf.chm
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.dll
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\cliconfg.rll
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clipbrd.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clipsrv.exe
Sun Sep 09 13:02:48 2007 => Scanning File C:\WINDOWS\system32\clusapi.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\CLUTIL_S.DLL
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmcfg32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmd.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdial32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdl32.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmdlib.wsc
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmglue.vxd
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmirmdrv.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmirmdrv.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmmgr32.hlp
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmmon32.exe
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmos.ram
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmpbk32.dll
Sun Sep 09 13:02:49 2007 => Scanning File C:\WINDOWS\system32\cmprops.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmsetacl.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmstp.exe
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmuda.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cmutil.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cnbjmon.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\cnetcfg.dll
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMCP58.exe
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMLM58.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNMVS58.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNQA1210.DLL
Sun Sep 09 13:02:50 2007 => Scanning File C:\WINDOWS\system32\CNQL1210.DLL
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\CNQU85.DLL
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\cnvfat.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\coclassfast.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\colbact.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comaddin.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comcat.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comctl32.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMCTL32.OCA
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMCTL32.OCX
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\comdlg32.dll
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMDLG32.OCA
Sun Sep 09 13:02:51 2007 => Scanning File C:\WINDOWS\system32\COMDLG32.OCX
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comm.drv
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\command.com
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\commdlg.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comp.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compact.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compatui.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compmgmt.msc
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compobj.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\compstui.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comrepl.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comres.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsdupd.exe
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsnap.dll
Sun Sep 09 13:02:52 2007 => Scanning File C:\WINDOWS\system32\comsvcs.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\comuid.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\CONFIG.NT
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\CONFIG.TMP
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\confmsp.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\conime.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\console.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\Contact.INI
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\control.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\convert.exe
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\corpol.dll
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\country.sys
Sun Sep 09 13:02:53 2007 => Scanning File C:\WINDOWS\system32\credui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\crtdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\crypt32.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptdlg.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptext.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptnet.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptsvc.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cryptui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscdll.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscript.exe
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\cscui.dll
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\CSL.DLL
Sun Sep 09 13:02:54 2007 => Scanning File C:\WINDOWS\system32\csrsrv.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\csrss.exe
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\csseqchk.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSM32S.DLL
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSM32S.SIG
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\CSSMS_IN.DLL
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctfmon.exe
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctl3d32.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctl3dv2.dll
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\ctype.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_037.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10000.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10006.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10007.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10010.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10017.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10029.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10079.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10081.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_10082.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1026.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1250.nls
Sun Sep 09 13:02:55 2007 => Scanning File C:\WINDOWS\system32\c_1251.nls
Sun Sep 09 13:02:56 2007 => Scanning File C:\WINDOWS\system32\c_1252.nls
Sun Se
jlpjlp
Messages postés
51580
Date d'inscription
vendredi 18 mai 2007
Statut
Contributeur sécurité
Dernière intervention
3 mai 2022
5 040
9 sept. 2007 à 17:26
9 sept. 2007 à 17:26
utilise pour supprimer tes traces
CCLEANER: (lance un nettoyage et répare erreurs) sans installer la barre yahoo
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
_______________
encore des pbs?
CCLEANER: (lance un nettoyage et répare erreurs) sans installer la barre yahoo
https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
_______________
encore des pbs?
Bonjour,
les fichiers infectés sont toujours presents. En tout cas, ils réapparaissent à chaque redémarrage et analyse.
Voici les rapports hijack et bitdefender:
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Sep 09, 2007 - 21:48:25
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
105103
Infectés Fichiers
3
Virus Détectés
Trojan.Spy.Agent.SF
3
BitDefender Online Scanner
Rapport d'analyse généré à: Sun, Sep 09, 2007 - 21:33:37
Voie d'analyse: A:\;C:\;D:\;
Statistiques
Temps
00:40:41
Fichiers
100117
Directoires
4547
Secteurs de boot
2
Archives
942
Paquets programmes
4953
Résultats
Virus identifiés
1
Fichiers infectés
3
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
3
Info sur les moteurs
Définition virus
800257
Version des moteurs
AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Echec de la désinfection
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Supprimé
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir
Echec de la mise à jour
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL
Echec de la mise à jour
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Supprimé
C:\WINDOWS\system32\MS318F19.DLL
Echec de la mise à jour
Hijack:
Logfile of HijackThis v1.99.1
Scan saved at 12:20:14, on 12/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C231421-B95A-45CA-87CD-36E3201DA952}: NameServer = 84.103.237.141 86.64.145.141
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Y a-t-il encore quelque chose à faire?
Merci pour l'aide
--------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
les fichiers infectés sont toujours presents. En tout cas, ils réapparaissent à chaque redémarrage et analyse.
Voici les rapports hijack et bitdefender:
BitDefender Online Scanner - Rapport virus en temps réel
Généré à: Sun, Sep 09, 2007 - 21:48:25
--------------------------------------------------------------------------------
Info d'analyse
Fichiers scannés
105103
Infectés Fichiers
3
Virus Détectés
Trojan.Spy.Agent.SF
3
BitDefender Online Scanner
Rapport d'analyse généré à: Sun, Sep 09, 2007 - 21:33:37
Voie d'analyse: A:\;C:\;D:\;
Statistiques
Temps
00:40:41
Fichiers
100117
Directoires
4547
Secteurs de boot
2
Archives
942
Paquets programmes
4953
Résultats
Virus identifiés
1
Fichiers infectés
3
Fichiers suspects
0
Avertissements
0
Désinfectés
0
Fichiers effacés
3
Info sur les moteurs
Définition virus
800257
Version des moteurs
AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)
Analyse des plugins
14
Archive des plugins
38
Unpack des plugins
7
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Echec de la désinfection
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir=>(Embedded EXE o)
Supprimé
C:\qoobox\Quarantine\C\WINDOWS\system32\MS3D714B.DLL.vir
Echec de la mise à jour
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL=>(Embedded EXE o)
Supprimé
C:\System Volume Information\_restore{D5232423-9DA4-4AF6-ABFD-72024B872A99}\RP5\A0000334.DLL
Echec de la mise à jour
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Infecté par: Trojan.Spy.Agent.SF
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Echec de la désinfection
C:\WINDOWS\system32\MS318F19.DLL=>(Embedded EXE o)
Supprimé
C:\WINDOWS\system32\MS318F19.DLL
Echec de la mise à jour
Hijack:
Logfile of HijackThis v1.99.1
Scan saved at 12:20:14, on 12/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sandra\Bureau\Maintenance\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.emjysoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1F83CD9E-505E-4F87-BECE-0832A763E36F} (Image Uploader 3.0 Control) - http://www.mypixmania.com/fr/fr/importer/MypixUploader.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103135541607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6DB731A3-B074-4118-8B1C-32511C65D836} (FotovistaPhotoUploader.ctrFpu) - http://www.mypixmania.com/fr/fr/tools/activex/fpu.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - https://www.zonealarm.com/
O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - https://www.zonealarm.com/
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C231421-B95A-45CA-87CD-36E3201DA952}: NameServer = 84.103.237.141 86.64.145.141
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Y a-t-il encore quelque chose à faire?
Merci pour l'aide
--------------------------------------------------------------------------------
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde.
6 sept. 2007 à 08:02
Si je n'ai pas fait ce qu'il fallait, je recommence
Merci