Problème de publicités qui s'ouvrent n'import

Résolu
Iosoma -  
green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   -
Bonjour a tous, voila j'ai un probleme similaire a certain probleme deja presenté sur le forum, cependant j'ai pu constaté que la resolution du probleme n'est pas forcement la meme pour tous, je me permet donc de poster une fois de plus a ce sujet.
Pour gagner un peu de temps j'ai deja récupéré Navilog et voici le rapport:

Search Navipromo version 3.1.0 commencé le 21/09/2007 à 12:22:15,53

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 20.09.2007 a 14h00 by IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180

*** Recherche Programmes installes ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***

*** Recherche dossiers dans C:\Documents and Settings\Julien LEGRAND\Application Data ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***

*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
https://www.f-secure.com/en

Fichier(s) caché(s) :

C:\WINDOWS\system32\thjqqdjo.dat
C:\WINDOWS\system32\thjqqdjo.exe
C:\WINDOWS\system32\thjqqdjo_nav.dat
C:\WINDOWS\system32\thjqqdjo_navps.dat

Processus caché(s) :

C:\WINDOWS\system32\thjqqdjo.exe

*** Recherche avec GenericNaviSearch ***
!!! Tous Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

* Scan C:\WINDOWS\system32 *

Fichiers trouvés :

thjqqdjo.exe trouvé !

* Scan C:\Documents and Settings\Julien LEGRAND\local settings\application data *

*** Recherche fichiers ***

C:\WINDOWS\pack.epk trouvé !
C:\WINDOWS\system32\nvs2.inf trouvé !

*** Recherche cles registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé !

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:
C:\WINDOWS\system32\yycdd.bak1 trouvé ! infection Vundo possible non traité par cet outil !
C:\WINDOWS\system32\yycdd.bak2 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche Heuristique :

C:\WINDOWS\system32\thjqqdjo.dat trouvé !
C:\WINDOWS\system32\arlbkivy.exe trouvé !
C:\WINDOWS\system32\ecqvdfxo.exe trouvé !
C:\WINDOWS\system32\gdguthne.exe trouvé !
C:\WINDOWS\system32\gtoapixb.exe trouvé !
C:\WINDOWS\system32\hdwmgvud.exe trouvé !
C:\WINDOWS\system32\hvsiliui.exe trouvé !
C:\WINDOWS\system32\jgcyhbga.exe trouvé !
C:\WINDOWS\system32\kfxigipb.exe trouvé !
C:\WINDOWS\system32\mxqndwmn.exe trouvé !
C:\WINDOWS\system32\nxywkyqv.exe trouvé !
C:\WINDOWS\system32\pkuaohdc.exe trouvé !
C:\WINDOWS\system32\tnouduan.exe trouvé !
C:\WINDOWS\system32\twefxbhy.exe trouvé !
C:\WINDOWS\system32\uswmsylp.exe trouvé !
C:\WINDOWS\system32\vkmlylhv.exe trouvé !
C:\WINDOWS\system32\vnkgivlt.exe trouvé !
C:\WINDOWS\system32\xiolrena.exe trouvé !
C:\WINDOWS\system32\ycalukgb.exe trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !

*** Analyse Terminé le 21/09/2007 à 12:34:20,73 ***

Alors si quelqu'un pouvait me conseiller sur la suite de la demarche a suivre...
Encore merci.
Configuration: Windows XP
Internet Explorer 6.0

14 réponses

  1.
    green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    pas mal de bébéttes !

    dans un 1er temps :

    Telecharge ceci :

    lien : hijackthis
    démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

    Choisis l'option "do a scan and a logfile", il va te générer un rapport, copie et colle sur le forum.

    ++
    0
  2. juduvar Messages postés 17 Statut Membre 1
     
    Visiblement j'ai des probleme avec ce forum aussi :s
    C'est toujours Iosoma, je sais pas trop pourquoi mais aujourd'hui ca sera juduvar^^

    Voici le rapport

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:44:02, on 22/09/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\twefxbhy.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\Program Files\Schmads Inc\G15_TeamSpeak\G15_TeamSpeak.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\eMule\emule.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Winamp\Winamp.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
    O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\elurwayi.dll",realset
    O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453985 14
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Orep] "C:\DOCUME~1\JULIEN~1\APPLIC~1\CROSOF~1\wuauclt.exe" -vt yazb
    O4 - HKCU\..\Run: [Diaz] "C:\Documents and Settings\Julien LEGRAND\Mes documents\??sembly\??rvices.exe"
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Picture Package Menu.lnk = ?
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?64b6688c19bd425d8e403a9fca0bc63c
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?64b6688c19bd425d8e403a9fca0bc63c
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: DomainService - - C:\WINDOWS\system32\twefxbhy.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    0
  3. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    ok,
    o Double-cliquer sur navilog1.bat
    o Arriver au menu principal, choisir l'option 2 et valider.
    o Indiquer le mode de nettoyage "automatique"
    o Répondre aux questions éventuelles, le bureau disparaîtra, c'est normal !
    o Patienter jusqu'au message : Nettoyage Termine le ...
    o Sauvegarder le rapport de manière à le retrouver, puis fermer le blocnote, le bureau réapparaîtra
    o Le rapport sera en outre sauvegardé à la racine du disque (cleannavi.txt), poste le stp

    ensuite :

    # Télécharge ceci: (merci a S!RI pour ce petit programme).

    http://siri.urz.free.fr/Fix/SmitfraudFix.zip

    Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1,
    voila a quoi cela ressemble : http://siri.urz.free.fr/Fix/SmitfraudFix.php
    il va générer un rapport : copie/colle le sur le poste stp.

    # Démarre en mode sans échec :
    Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
    (Si F8 ne marche pas utilise la touche F5).
    ----------------------------------------------------------------------------
    # Relance le programme Smitfraud :
    Cette fois choisit l’option 2, répond oui a tous ;
    Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

    et enfin remets un hijackthis stp

    @+

    0
  4. juduvar Messages postés 17 Statut Membre 1
     
    Bonsoir, encore une fois merci pour ton aide.
    Voici les rapports après manips effectuées:
    -NAvilog:

    Clean Navipromo version 3.1.0 commencé le 22/09/2007 à 20:28:50,46

    Fix lancé depuis C:\Program Files\navilog1
    Mise a jour le 20.09.2007 a 14h00 by IL-MAFIOSO

    Microsoft Windows XP [version 5.1.2600]
    Internet Explorer : 6.0.2900.2180

    Mode suppression automatique

    *** Creation backups fichiers trouvés par Blacklight ***

    Copie vers "C:\Program Files\navilog1\Backupnavi"

    *** Suppression des fichiers trouvés avec Blacklight ***

    C:\WINDOWS\system32\thjqqdjo.dat supprimé !
    C:\WINDOWS\system32\thjqqdjo.exe supprimé !
    C:\WINDOWS\system32\thjqqdjo_nav.dat supprimé !
    C:\WINDOWS\system32\thjqqdjo_navps.dat supprimé !

    ** 2ème passage **

    C:\WINDOWS\prefetch\thjqqdjo*.pf trouvé !
    Copie C:\WINDOWS\prefetch\thjqqdjo*.pf réalise avec succes !
    C:\WINDOWS\prefetch\thjqqdjo*.pf supprimé !

    *** Suppression avec Backups résultats GenericNaviSearch ***

    * Scan C:\WINDOWS\system32 *

    * Scan C:\Documents and Settings\Julien LEGRAND\local settings\application data *

    *** Suppression dossiers dans C:\WINDOWS ***

    *** Suppression dossiers dans C:\Program Files ***

    *** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***

    *** Suppression dossiers dans C:\Documents and Settings\Julien LEGRAND\Application Data ***

    *** Suppression dossiers dans C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***

    *** Suppression fichiers ***

    C:\WINDOWS\pack.epk supprimé !
    C:\WINDOWS\system32\nvs2.inf supprimé !

    *** Suppression fichiers temporaires ***

    Nettoyage contenu C:\WINDOWS\Temp effectué !
    Nettoyage contenu C:\Documents and Settings\Julien LEGRAND\Local Settings\Temp effectué !

    *** Traitement Recherche complémentaire ***
    (Recherche fichiers spécifiques)

    1)Recherche fichiers connus:

    C:\WINDOWS\system32\yycdd.bak1 trouvé ! infection Vundo possible non traité par cet outil !
    C:\WINDOWS\system32\yycdd.bak2 trouvé ! infection Vundo possible non traité par cet outil !

    2)Recherche et Suppression Heuristique :

    C:\WINDOWS\system32\arlbkivy.exe trouvé !
    Copie C:\WINDOWS\system32\arlbkivy.exe réalise avec succes !
    C:\WINDOWS\system32\arlbkivy.exe supprimé !

    C:\WINDOWS\system32\ecqvdfxo.exe trouvé !
    Copie C:\WINDOWS\system32\ecqvdfxo.exe réalise avec succes !
    C:\WINDOWS\system32\ecqvdfxo.exe supprimé !

    C:\WINDOWS\system32\gdguthne.exe trouvé !
    Copie C:\WINDOWS\system32\gdguthne.exe réalise avec succes !
    C:\WINDOWS\system32\gdguthne.exe supprimé !

    C:\WINDOWS\system32\gtoapixb.exe trouvé !
    Copie C:\WINDOWS\system32\gtoapixb.exe réalise avec succes !
    C:\WINDOWS\system32\gtoapixb.exe supprimé !

    C:\WINDOWS\system32\hdwmgvud.exe trouvé !
    Copie C:\WINDOWS\system32\hdwmgvud.exe réalise avec succes !
    C:\WINDOWS\system32\hdwmgvud.exe supprimé !

    C:\WINDOWS\system32\hvsiliui.exe trouvé !
    Copie C:\WINDOWS\system32\hvsiliui.exe réalise avec succes !
    C:\WINDOWS\system32\hvsiliui.exe supprimé !

    C:\WINDOWS\system32\jgcyhbga.exe trouvé !
    Copie C:\WINDOWS\system32\jgcyhbga.exe réalise avec succes !
    C:\WINDOWS\system32\jgcyhbga.exe supprimé !

    C:\WINDOWS\system32\kfxigipb.exe trouvé !
    Copie C:\WINDOWS\system32\kfxigipb.exe réalise avec succes !
    C:\WINDOWS\system32\kfxigipb.exe supprimé !

    C:\WINDOWS\system32\mxqndwmn.exe trouvé !
    Copie C:\WINDOWS\system32\mxqndwmn.exe réalise avec succes !
    C:\WINDOWS\system32\mxqndwmn.exe supprimé !

    C:\WINDOWS\system32\nxywkyqv.exe trouvé !
    Copie C:\WINDOWS\system32\nxywkyqv.exe réalise avec succes !
    C:\WINDOWS\system32\nxywkyqv.exe supprimé !

    C:\WINDOWS\system32\pkuaohdc.exe trouvé !
    Copie C:\WINDOWS\system32\pkuaohdc.exe réalise avec succes !
    C:\WINDOWS\system32\pkuaohdc.exe supprimé !

    C:\WINDOWS\system32\tnouduan.exe trouvé !
    Copie C:\WINDOWS\system32\tnouduan.exe réalise avec succes !
    C:\WINDOWS\system32\tnouduan.exe supprimé !

    C:\WINDOWS\system32\twefxbhy.exe trouvé !
    Copie C:\WINDOWS\system32\twefxbhy.exe réalise avec succes !
    C:\WINDOWS\system32\twefxbhy.exe !!ERREUR SUPPRESSION!!

    C:\WINDOWS\system32\uswmsylp.exe trouvé !
    Copie C:\WINDOWS\system32\uswmsylp.exe réalise avec succes !
    C:\WINDOWS\system32\uswmsylp.exe supprimé !

    C:\WINDOWS\system32\vkmlylhv.exe trouvé !
    Copie C:\WINDOWS\system32\vkmlylhv.exe réalise avec succes !
    C:\WINDOWS\system32\vkmlylhv.exe supprimé !

    C:\WINDOWS\system32\vnkgivlt.exe trouvé !
    Copie C:\WINDOWS\system32\vnkgivlt.exe réalise avec succes !
    C:\WINDOWS\system32\vnkgivlt.exe supprimé !

    C:\WINDOWS\system32\xiolrena.exe trouvé !
    Copie C:\WINDOWS\system32\xiolrena.exe réalise avec succes !
    C:\WINDOWS\system32\xiolrena.exe supprimé !

    C:\WINDOWS\system32\ycalukgb.exe trouvé !
    Copie C:\WINDOWS\system32\ycalukgb.exe réalise avec succes !
    C:\WINDOWS\system32\ycalukgb.exe supprimé !

    *** Sauvegarde du registre vers dossier Backupnavi ***

    sauvegarde du registre réalise avec succes !

    *** Nettoyage registre ***

    Nettoyage registre Ok

    *** Certificats ***

    Certificat Egroup supprimé !

    *** Nettoyage termine le 22/09/2007 à 20:31:54,09 ***

    -Après l'execution de smitfraudfix voici le rapport:

    SmitFraudFix v2.227

    Rapport fait à 20:37:02,70, 22/09/2007
    Executé à partir de C:\Documents and Settings\Julien LEGRAND\Bureau\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode normal

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\twefxbhy.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\Program Files\Schmads Inc\G15_TeamSpeak\G15_TeamSpeak.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Julien LEGRAND

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Julien LEGRAND\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JULIEN~1\Favoris

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Ma page d'accueil"

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="C:\\PROGRA~1\\Google\\GOOGLE~1\\GOEC62~1.DLL"

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Rustock

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
    DNS Server Search Order: 192.168.1.1
    DNS Server Search Order: 0.0.0.0

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin

    -Apres manip Smitfraudfix en mode sans echec:

    SmitFraudFix v2.227

    Rapport fait à 20:42:10,76, 22/09/2007
    Executé à partir de C:\Documents and Settings\Julien LEGRAND\Bureau\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode sans echec

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{D80979A9-2564-413B-B1F4-65833352D7A2}: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

    Nettoyage terminé.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin

    -Et voici le rapport hijackthis apres etre revenue en mode normal:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:48:07, on 22/09/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Schmads Inc\G15_TeamSpeak\G15_TeamSpeak.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\WINDOWS\system32\twefxbhy.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
    O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\elurwayi.dll",realset
    O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453985 14
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Orep] "C:\DOCUME~1\JULIEN~1\APPLIC~1\CROSOF~1\wuauclt.exe" -vt yazb
    O4 - HKCU\..\Run: [Diaz] "C:\Documents and Settings\Julien LEGRAND\Mes documents\??sembly\??rvices.exe"
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Picture Package Menu.lnk = ?
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?64b6688c19bd425d8e403a9fca0bc63c
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?64b6688c19bd425d8e403a9fca0bc63c
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: DomainService - - C:\WINDOWS\system32\twefxbhy.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    ok , fais les manips de ce lien stp :

    virus methode preliminaire de desinfection version fr

    @+

    ;-)
    0
  7. juduvar
     
    voici le rapport avg

    AVG Anti-Spyware - Rapport d'analyse
    ---------------------------------------------------------

    + Créé à: 22:26:56 22/09/2007

    + Résultat de l'analyse:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo -> Adware.Generic : Aucune action entreprise.
    C:\Program Files\Outerinfo\OiUninstaller.exe -> Adware.PurityScan : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip/backup/winpop.exe -> Adware.Rond : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe -> Adware.Rond : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe -> Adware.Rond : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip/backup/b122.exe -> Adware.Softomate : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe -> Adware.Softomate : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe -> Adware.Softomate : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Mes documents\Programe\utilitaires\gravure\Nero-7.0.1.2 Fra + Serial Nero 7 Premium 100% OK!!!.rar/Serial Nero 7\Nero 7 Keygen\Nero7Keygen.exe -> Backdoor.Hupigon : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Mes documents\Programe\utilitaires\gravure\Serial Nero 7\Nero 7 Keygen\Nero7Keygen.exe -> Backdoor.Hupigon : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip/backup/IMG-0012.zip/img0012-www.photostorage.com -> Backdoor.SdBot.bxr : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip/backup/lsass.exe -> Backdoor.SdBot.bxr : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049293.exe -> Backdoor.SdBot.bxr : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049303.exe -> Backdoor.SdBot.bxr : Aucune action entreprise.
    C:\WINDOWS\b128.exe -> Downloader.PurityScan.eh : Aucune action entreprise.
    C:\WINDOWS\b136.exe -> Dropper.Agent.bfr : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Cookies\julien legrand@247realmedia[1].txt -> TrackingCookie.247realmedia : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Cookies\julien legrand@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Aucune action entreprise.
    [1624] C:\WINDOWS\system32\twefxbhy.exe -> Trojan.Agent.aoy : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\call.exe -> Trojan.Agent.apt : Aucune action entreprise.
    C:\WINDOWS\system32\wapicc.exe -> Trojan.Small : Aucune action entreprise.
    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip/backup/UnInstall.exe -> Trojan.Small.oa : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049284.exe -> Trojan.Small.oa : Aucune action entreprise.
    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049306.exe -> Trojan.Small.oa : Aucune action entreprise.

    Fin du rapport

    le rapport bitdefender

    BitDefender Online Scanner

    Scan report generated at: Sat, Sep 22, 2007 - 23:28:13

    Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

    Statistics

    Time
    00:52:44

    Files
    173407

    Folders
    5984

    Boot Sectors
    2

    Archives
    7741

    Packed Files
    12572

    Results

    Identified Viruses
    24

    Infected Files
    110

    Suspect Files
    0

    Warnings
    0

    Disinfected
    0

    Deleted Files
    79

    Engines Info

    Virus Definitions
    823360

    Engine build
    AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

    Scan plugins
    14

    Archive plugins
    38

    Unpack plugins
    7

    E-mail plugins
    6

    System plugins
    1

    Scan Settings

    First Action
    Disinfect

    Second Action
    Delete

    Heuristics
    Yes

    Enable Warnings
    Yes

    Scanned Extensions
    *;

    Exclude Extensions

    Scan Emails
    Yes

    Scan Archives
    Yes

    Scan Packed
    Yes

    Scan Files
    Yes

    Scan Boot
    Yes

    Scanned File
    Status

    C:\Documents and Settings\admin\Local Settings\Temporary Internet Files\Content.IE5\JGTH9ATD\idien[1]
    Infected with: Trojan.Fotomoto.A

    C:\Documents and Settings\admin\Local Settings\Temporary Internet Files\Content.IE5\Z6O8ZMN6\_affvm[1]
    Infected with: Trojan.Vundo.DMP

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)
    Update failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Infected with: Win32.Netsky.DAR@mm

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Infected with: Win32.Netsky.DAR@mm

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Detected with: Adware.Navipromo.BYD

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Infected with: DeepScan:Generic.Sdbot.5645F094

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Infected with: DeepScan:Generic.Sdbot.5645F094

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip
    Updated

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\hdwmgvud.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\hvsiliui.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\hvsiliui.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Infected with: Trojan.Virtumod.SU

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\mxqndwmn.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\nxywkyqv.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\nxywkyqv.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\pkuaohdc.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\tnouduan.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\twefxbhy.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\twefxbhy.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\vnkgivlt.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\xiolrena.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\xiolrena.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Deleted

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Infected with: Trojan.Purityad.O

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Disinfection failed

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Deleted

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)
    Update failed

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Infected with: Trojan.Downloader.Autoit.N

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Disinfection failed

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Infected with: Trojan.Downloader.Autoit.N

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Infected with: Trojan.Skintrim.GK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039415.dll
    Infected with: Trojan.Vundo.DMJ

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039428.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039441.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039458.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039472.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039485.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0040509.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041509.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041522.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041567.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041581.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP273\A0042581.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0042627.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Infected with: DeepScan:Generic.Virtumonde.1.E6C0E6E3

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP279\A0047166.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Infected with: Trojan.Virtumod.ADI

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049397.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049398.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049398.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Infected with: Trojan.Virtumod.SU

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049401.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049402.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049402.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049403.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049404.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049404.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049407.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049408.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049408.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Infected with: Trojan.Agent.AAJJ

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Infected with: Trojan.Downloader.JISG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049786.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049787.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Downloader.Purityscan.EH

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049787.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049787.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049787.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049788.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Rootkit.Agent.EV

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049788.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049788.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049788.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049809.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049809.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049809.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049810.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049810.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049810.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049811.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049811.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049811.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049812.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049812.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049812.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049813.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049813.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049813.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049814.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049814.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049814.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049815.exe
    Infected with: Trojan.Virtumod.SU

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049815.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049815.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049816.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049817.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049817.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049818.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049818.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049818.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049819.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049819.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049819.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049820.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049820.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049820.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049821.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049821.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049821.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049822.exe
    Infected with: Trojan.Downloader.Autoit.N

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049822.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049822.exe
    Deleted

    C:\WINDOWS\system32\cwgdjknr.dll
    Infected with: Trojan.JuanSearch.C

    C:\WINDOWS\system32\cwgdjknr.dll
    Disinfection failed

    C:\WINDOWS\system32\cwgdjknr.dll
    Deleted

    C:\WINDOWS\system32\ddcyy.dll
    Infected with: DeepScan:Generic.Virtumonde.1.C591EDAB

    C:\WINDOWS\system32\ddcyy.dll
    Disinfection failed

    C:\WINDOWS\system32\ddcyy.dll
    Delete failed

    C:\WINDOWS\system32\elurwayi.dll
    Infected with: Trojan.Virtumod.ADI

    C:\WINDOWS\system32\elurwayi.dll
    Disinfection failed

    C:\WINDOWS\system32\elurwayi.dll
    Delete failed

    C:\WINDOWS\system32\enukmthy.dll
    Infected with: Trojan.JuanSearch.C

    C:\WINDOWS\system32\enukmthy.dll
    Disinfection failed

    C:\WINDOWS\system32\enukmthy.dll
    Deleted

    C:\WINDOWS\system32\epehxypu.dll
    Infected with: Trojan.Juan.H

    C:\WINDOWS\system32\epehxypu.dll
    Disinfection failed

    C:\WINDOWS\system32\epehxypu.dll
    Deleted

    C:\WINDOWS\system32\fhhnaiuw.dll
    Infected with: Trojan.JuanSearch.B

    C:\WINDOWS\system32\fhhnaiuw.dll
    Disinfection failed

    C:\WINDOWS\system32\fhhnaiuw.dll
    Deleted

    C:\WINDOWS\system32\frqkleri.dll
    Infected with: Trojan.Virtumod.ADI

    C:\WINDOWS\system32\frqkleri.dll
    Disinfection failed

    C:\WINDOWS\system32\frqkleri.dll
    Deleted

    C:\WINDOWS\system32\iifggfc.dll
    Infected with: Trojan.Vundo.DMY

    C:\WINDOWS\system32\jdgnudpw.dll
    Infected with: Trojan.Vundo.DMP

    C:\WINDOWS\system32\lgujlwnt.dll
    Infected with: Trojan.JuanSearch.C

    C:\WINDOWS\system32\lgujlwnt.dll
    Disinfection failed

    C:\WINDOWS\system32\lgujlwnt.dll
    Deleted

    C:\WINDOWS\system32\mlhkseyo.dll
    Infected with: Trojan.Vundo.CG

    C:\WINDOWS\system32\mlhkseyo.dll
    Disinfection failed

    C:\WINDOWS\system32\mlhkseyo.dll
    Deleted

    C:\WINDOWS\system32\olsdlpmj.dll
    Infected with: Trojan.Vundo.CG

    C:\WINDOWS\system32\olsdlpmj.dll
    Disinfection failed

    C:\WINDOWS\system32\olsdlpmj.dll
    Deleted

    C:\WINDOWS\system32\pooceybs.dll
    Infected with: Trojan.Vundo.CG

    C:\WINDOWS\system32\pooceybs.dll
    Disinfection failed

    C:\WINDOWS\system32\pooceybs.dll
    Deleted

    et enfin le rapport hijack

    BitDefender Online Scanner

    Scan report generated at: Sat, Sep 22, 2007 - 23:28:13

    Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;

    Statistics

    Time
    00:52:44

    Files
    173407

    Folders
    5984

    Boot Sectors
    2

    Archives
    7741

    Packed Files
    12572

    Results

    Identified Viruses
    24

    Infected Files
    110

    Suspect Files
    0

    Warnings
    0

    Disinfected
    0

    Deleted Files
    79

    Engines Info

    Virus Definitions
    823360

    Engine build
    AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22)

    Scan plugins
    14

    Archive plugins
    38

    Unpack plugins
    7

    E-mail plugins
    6

    System plugins
    1

    Scan Settings

    First Action
    Disinfect

    Second Action
    Delete

    Heuristics
    Yes

    Enable Warnings
    Yes

    Scanned Extensions
    *;

    Exclude Extensions

    Scan Emails
    Yes

    Scan Archives
    Yes

    Scan Packed
    Yes

    Scan Files
    Yes

    Scan Boot
    Yes

    Scanned File
    Status

    C:\Documents and Settings\admin\Local Settings\Temporary Internet Files\Content.IE5\JGTH9ATD\idien[1]
    Infected with: Trojan.Fotomoto.A

    C:\Documents and Settings\admin\Local Settings\Temporary Internet Files\Content.IE5\Z6O8ZMN6\_affvm[1]
    Infected with: Trojan.Vundo.DMP

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/b122.exe=>(NSIS o)
    Update failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Infected with: Win32.Netsky.DAR@mm

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/IMG-0012.zip
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Infected with: Win32.Netsky.DAR@mm

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/lsass.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/UnInstall.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Infected with: Trojan.Popwin.BK

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip=>backup/winpop.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Bureau\MSNFix\21092007_13424673.zip
    Updated

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Detected with: Adware.Navipromo.BYD

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\legrandjulien\ParisHilton.exe
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Infected with: DeepScan:Generic.Sdbot.5645F094

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\www.X_0005_jpg-msn.com
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Infected with: DeepScan:Generic.Sdbot.5645F094

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Disinfection failed

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip=>www.X_0005_jpg-msn.com
    Deleted

    C:\Documents and Settings\Julien LEGRAND\Mes documents\Mes images\X_0005_jpg.zip
    Updated

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\arlbkivy.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\ecqvdfxo.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\gdguthne.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\gtoapixb.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\hdwmgvud.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\hvsiliui.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\hvsiliui.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\jgcyhbga.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Infected with: Trojan.Virtumod.SU

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\kfxigipb.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\mxqndwmn.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\nxywkyqv.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\nxywkyqv.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\pkuaohdc.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\tnouduan.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\twefxbhy.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\twefxbhy.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\uswmsylp.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\vkmlylhv.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\vnkgivlt.exe
    Infected with: Trojan.Fotomoto.A

    C:\Program Files\Navilog1\Backupnavi\xiolrena.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\xiolrena.exe
    Deleted

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Infected with: Trojan.Agent.AAOA

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Disinfection failed

    C:\Program Files\Navilog1\Backupnavi\ycalukgb.exe
    Deleted

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Infected with: Trojan.Purityad.O

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Disinfection failed

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)=>zlib_nsis0001
    Deleted

    C:\Program Files\Outerinfo\OiUninstaller.exe=>(NSIS o)
    Update failed

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Infected with: Trojan.Downloader.Autoit.N

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Disinfection failed

    C:\RECYCLER\S-1-5-21-1018689550-1385910794-529965642-1008\Dc1.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Infected with: Trojan.Downloader.Autoit.N

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP258\A0035311.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035386.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP261\A0035417.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037814.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037843.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP265\A0037874.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP266\A0037903.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Infected with: Trojan.Skintrim.GK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP267\A0037966.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP269\A0038192.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038252.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Infected with: Trojan.Vundo.CG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP270\A0038275.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039415.dll
    Infected with: Trojan.Vundo.DMJ

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039428.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039441.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039458.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039472.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0039485.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0040509.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041509.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041522.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041567.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP272\A0041581.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP273\A0042581.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0042627.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Infected with: DeepScan:Generic.Virtumonde.1.E6C0E6E3

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP274\A0043627.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP279\A0047166.dll
    Infected with: Trojan.Vundo.DMP

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Infected with: Trojan.Virtumod.ADI

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP281\A0047211.dll
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049285.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049292.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)=>lzma_solid_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049295.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Infected with: Trojan.Popwin.BK

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP300\A0049307.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049393.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049394.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049395.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049396.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049397.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049398.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049398.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049399.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Infected with: Trojan.Virtumod.SU

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049400.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049401.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049402.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049402.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049403.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049404.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049404.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049405.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049406.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049407.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049408.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049408.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Infected with: Trojan.Agent.AAOA

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049409.exe
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Infected with: Trojan.Agent.AAJJ

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0001
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Infected with: Trojan.Downloader.JISG

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Disinfection failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)=>zlib_nsis0002
    Deleted

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049785.exe=>(NSIS o)
    Update failed

    C:\System Volume Information\_restore{27856369-B24C-4B69-AEAB-2EF3CEE6E940}\RP302\A0049786.exe
    Infected with: Trojan.Fotomoto.A

    C:\System Volume Information\_restore{27856369-B24C-4B6
    0
  8. juduvar Messages postés 17 Statut Membre 1
     
    avec les manip réalisées çà va beaucoup mieux dèjà j'ai plus de fenêtre de pub qui s'affichent dans tout les sens encore merci pour ton aide Greenday :D
    0
  9. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    ce petit nettoyage a fait un bien fou ! :)

    un dernier détail :

    Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    * Démarrer en mode sans echec
    * Double cliquer combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt, poste le stp

    ++
    0
  10. juduvar Messages postés 17 Statut Membre 1
     
    Voici le rapport:

    ComboFix 07-09-21.2 - "Julien LEGRAND" 2007-09-23 23:05:18.1 - NTFSx86 MINIMAL
    Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.1791 [GMT 2:00]
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\DOCUME~1\JULIEN~1\APPLIC~1\CROSOF~1
    C:\DOCUME~1\JULIEN~1\APPLIC~1\CROSOF~1\??crosoft\
    C:\DOCUME~1\JULIEN~1\MESDOC~1\SEMBLY~1
    C:\Program Files\Fichiers communs\Yazzle1122OinUninstaller.exe
    C:\Program Files\outerinfo
    C:\Program Files\outerinfo\OiUninstaller.exe
    C:\Program Files\outerinfo\outerinfo.ico
    C:\Program Files\outerinfo\Terms.rtf
    C:\Program Files\winpop
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\system32\cbxustt.dll
    C:\WINDOWS\system32\ddcyy.dll
    C:\WINDOWS\system32\drivers\core.cache.dsk
    C:\WINDOWS\system32\drivers\core.sys
    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\elurwayi.dll
    C:\WINDOWS\system32\iyawrule.ini
    C:\WINDOWS\system32\jdgnudpw.dll
    C:\WINDOWS\system32\jkhfefc.dll
    C:\WINDOWS\system32\kimwxxra.dll
    C:\WINDOWS\system32\opnnllk.dll
    C:\WINDOWS\system32\packet.dll
    C:\WINDOWS\system32\pthreadVC.dll
    C:\WINDOWS\system32\qouphhlq.dll
    C:\WINDOWS\system32\W007T32W.DLL
    C:\WINDOWS\system32\wanpacket.dll
    C:\WINDOWS\system32\wpcap.dll
    C:\WINDOWS\system32\wpdungdj.ini
    C:\WINDOWS\system32\yycdd.bak1
    C:\WINDOWS\system32\yycdd.bak2
    C:\WINDOWS\system32\yycdd.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    -------\LEGACY_CORE
    -------\LEGACY_DOMAINSERVICE
    -------\core
    -------\DomainService
    -------\NPF

    ((((((((((((((((((((((((( Files Created from 2007-08-23 to 2007-09-23 )))))))))))))))))))))))))))))))
    .

    2007-09-23 23:04 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-09-22 22:34 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2007-09-22 21:52 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-09-22 21:43 <REP> d-------- C:\Program Files\CCleaner
    2007-09-22 20:37 3,010 --a------ C:\WINDOWS\system32\tmp.reg
    2007-09-22 13:43 <REP> d-------- C:\Program Files\Trend Micro
    2007-09-21 12:20 <REP> d-------- C:\Program Files\Navilog1
    2007-09-21 11:38 33,792 --a------ C:\WINDOWS\system32\yayyvsq.dll
    2007-08-29 18:57 442,368 -ra------ C:\WINDOWS\system32\vp6vfw.dll
    2007-08-29 18:57 <REP> d-------- C:\Program Files\EA GAMES

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-09-23 23:09 --------- d-------- C:\Program Files\Wanadoo
    2007-09-23 18:44 --------- d-------- C:\Program Files\eMule
    2007-09-19 11:15 --------- d-------- C:\Program Files\MSN Messenger
    2007-09-08 02:32 --------- d-------- C:\Program Files\WowCartographe
    2007-09-07 12:10 --------- d-------- C:\DOCUME~1\JULIEN~1\APPLIC~1\Nokia Multimedia Player
    2007-08-15 19:39 287766 --a------ C:\WINDOWS\system32\iifggfc.dll
    2007-08-08 20:31 --------- d-------- C:\Program Files\World of Warcraft
    2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
    2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
    2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
    2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
    2007-07-30 19:19 271224 --a------ C:\WINDOWS\system32\mucltui.dll
    2007-07-30 19:19 207736 --a------ C:\WINDOWS\system32\muweb.dll
    2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
    2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
    2007-06-26 08:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1039118B-A33F-A9BA-4B64-898DBC528FBB}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
    2007-08-15 19:39 287766 --a------ C:\WINDOWS\system32\iifggfc.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2006-03-02 07:22 C:\WINDOWS\SOUNDMAN.EXE]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-02 22:41]
    "nwiz"="nwiz.exe" [2006-03-02 22:41 C:\WINDOWS\system32\nwiz.exe]
    "Muscbrigade"="c:\Musicbrigade\Musicbrigade.exe" [2005-12-22 10:26]
    "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49]
    "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 19:14]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
    "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-11-24 01:04]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-01-23 11:19]
    "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 17:31]
    "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 17:14]
    "Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 07:25]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "fsc-reminder.exe"="C:\WINDOWS\reminder\fsc-reminder.exe" [2005-01-19 17:10]
    "WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-10-28 17:25]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 19:49]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

    C:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
    Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-12-08 20:18:47]
    Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 01:05:56]
    Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2006-10-03 15:07:49]
    Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2006-10-03 15:07:45]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= C:\WINDOWS\system32\iifggfc.dll [2007-08-15 19:39 287766]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyyxw]
    ddcyyxw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iifggfc]
    iifggfc.dll 2007-08-15 19:39 287766 C:\WINDOWS\system32\iifggfc.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

    R3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\sis163u.sys
    R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys
    S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-09-23 20:29:00 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job"
    .
    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-09-23 23:08:30
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-09-23 23:10:29 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-09-23 23:10
    .
    --- E O F ---
    0
  11. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    et bien ! celui-ci on ne l'a pas fait pour rien !

    comment évolue la situation ??

    ++
    0
  12. juduvar Messages postés 17 Statut Membre 1
     
    Bonjour greenday, ben la ca va beaucoup mieux qu'avant, il reste quelque pages qui s'ouvrent de temps en temps mais vraiment peu.
    Encore merci pour ton aide, ça va beaucoup mieux qu'avant.
    0
  13. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    ok, des fenêtres Cid non ?!

    poste un nouveau hijack stp

    ++
    0
  14. juduvar Messages postés 17 Statut Membre 1
     
    Voila le nouveau rapport:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:34:42, on 25/09/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\FTRTSVC.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\Program Files\Schmads Inc\G15_TeamSpeak\G15_TeamSpeak.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
    C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
    C:\PROGRA~1\Wanadoo\ComComp.exe
    C:\PROGRA~1\Wanadoo\Toaster.exe
    C:\PROGRA~1\Wanadoo\Inactivity.exe
    C:\PROGRA~1\Wanadoo\PollingModule.exe
    C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
    C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
    C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
    C:\PROGRA~1\Wanadoo\Watch.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Windows Live Toolbar\msn_sl.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Muscbrigade] c:\Musicbrigade\Musicbrigade.exe check
    O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
    O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [fsc-reminder.exe] C:\WINDOWS\reminder\fsc-reminder.exe 2453985 14
    O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Picture Package Menu.lnk = ?
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?64b6688c19bd425d8e403a9fca0bc63c
    O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?64b6688c19bd425d8e403a9fca0bc63c
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {88764F69-3831-4EC1-B40B-FF21D8381345} (AdVerifierADPCtrl Class) - https://static.impots.gouv.fr/tdir/static/adpform/AdSignerADP-1.0.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    0
  15. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    là, c'est tout bon !

    installe un parefeu si tu n'en as pas !

    voir ici : securite proteger un ordinateur contre les malwares d internet

    @+

    ;-)
    0

Discussions similaires

Message "Un bloqueur de publicité empêche la lecture..."
pistouri -
pistouri -

0 réponse
Mise à jour et sécurité
bollo1 -
bollo1 -

12 réponses
comment desactiver un bloqueur de pub
amour10 -
MPMP10 -

4 réponses
Colis VOVA dédouanement complété
Jerome544 -
Afrikarnak -

13 réponses
M6 Replay désactiver le bloqueur de publicité
katydel88 -
Mathieu -

14 réponses