alert security =triangle jaune Résolu

Question

Bonjour,
je viens demander votre aide depuis quelque jour ma fille accepter le fameux fichier nokia de msn et puis que des problemes la en se moment un triangle jaune avec un point d exclamation en bas a droite avec plein de message et des pages internet qui s ouvre pour telecharger des antvirus etc... je n accpter rien biensur mais rien y fait sa ne disparer pas , j aie lancer syware doctor rien adware rien ccleaner rien , enfin je ne sais plus quoi faire merci d avance pour votre aide car moi et l informatique sa fait 2 marina

jlpjlp · Answer

slt 
Télécharge MSNFix de Laurent 
http://sosvirus.changelog.fr/MSNFix.zip 

Décompresse-le et double clic sur le fichier MSNFix.bat. 
- Exécute l'option R. 
--Si l'infection est détectée, exécute l'option N 
- Sauvegarde ce rapport puis fais un copier/coller de ce rapport sur le forum. 

Note : 
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal 
Sauvegarder et fermer le rapport pour que Windows termine de se lancer normalement. 

___________________


colle un rapport hijackthis 
 
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html


Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

g!rly · Answer

bonjour,

Téléchargez MSNFix.zip (de !aur3n7) sur votre bureau:
http://sosvirus.changelog.fr/MSNFix.zip
Décompressez-le (clic droit >> Extraire ici) et double cliquer sur le fichier MSNFix.bat.
- Exécutez l'option R.
-- Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage

Note :
Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.txt


http://www.infos-du-net.com/telecharger/Clean-LiveKill-Messenger,0305-12188 .html

et

télécharges smitfraudfix :

En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php

tu doubles cliques sur smitfraudfix.cmd et tu choisi l option 1
cela vas générer un rapport.

Copie/colle le rapport sur le forum stp.

post les deux rapport ici stp

@+

marina · Answer

voici le rapport et merci pour votre aide 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:45:35, on 26/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\qhrwmgwr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [fyjenurg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fyjenurg.dll"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

marina · Answer

et voici celui de msnfix


MSNFix 1.567  
 
C:\Documents and Settings\ANNA\Bureau\MSNFix 
Fix exécuté le 26/11/2007 - 20:49:41,76 By ANNA 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\WINDOWS\cookies.ini 

************************  MSNCHK ***** /!\ beta test /!\


 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\WINDOWS\cookies.ini  
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:	hesims2_update.exe] 4210359A62B1B494013B78A0B3F1CA64 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\ANNA\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 26112007_20534773.zip
 
 
------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

g!rly · Answer

re,

peux tu envoyer ce fichier  C:	hesims2_update.exe 

par l´intermediaire de ce zip : C:\DOCUME~1\ANNA\Bureau\Upload_Me.zip

a l´adresse suivante stp : http://upload.changelog.fr 

puis fais ceci :

fais analyser ce meme fichier (C:	hesims2_update.exe ) sur ce site et post le rapport ici 

https://www.virustotal.com/gui/

puis 

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

et repost un log hijackthis , avec le rapport de virus total

@´+

marina · Answer

le rapport 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:08:28, on 26/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [fyjenurg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fyjenurg.dll"
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - Winlogon Notify: xxyawvu - xxyawvu.dll (file missing)
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

g!rly · Answer

on continue,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

marina · Answer

voici le rapport ComboFix 07-11-19.4 - ANNA 2007-11-26 23:20:27.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.223 [GMT 1:00] Running from: C:\Documents and Settings\ANNA\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\ANNA\Favoris\Online Security Guide.lnk C:\Program Files\SecCenter C:\Program Files\SecCenter\scprot4.exe C:\Program Files\smante~1 C:\Program Files\smante~1\S?mantec\ . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-26 to 2007-11-26 )))))))))))))))))))))))))))))))))))) . 2007-11-26 21:40 d-------- C:\VundoFix Backups 2007-11-26 20:39 d-------- C:\Program Files\Trend Micro 2007-11-26 17:09 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-26 17:09 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-26 17:09 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-26 17:09 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-26 17:08 d-------- C:\Program Files\Spyware Doctor 2007-11-26 13:06 143 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-11-26 11:12 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-26 08:15 80,960 --a------ C:\WINDOWS\system32\jxcbeynb.dll 2007-11-26 08:10 1,168,955 ---hs---- C:\WINDOWS\system32\yehctblc.ini 2007-11-26 08:07 d-------- C:\WINDOWS\system32 nrtmwuk 2007-11-24 14:01 1,352,957 ---hs---- C:\WINDOWS\system32\hnhkavvt.ini 2007-11-24 13:58 81,472 --a------ C:\WINDOWS\system32\ilsqvvyi.dll 2007-11-22 17:22 79,936 --a------ C:\WINDOWS\system32\murnqpsp.dll 2007-11-22 17:18 1,004,368 ---hs---- C:\WINDOWS\system32\pgykbnbu.ini 2007-11-22 17:08 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-18 18:58 79,424 --a------ C:\WINDOWS\system32\ydsrbxvb.dll 2007-11-18 18:55 737,138 ---hs---- C:\WINDOWS\system32 iojyxbp.ini 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Modèles 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-12 18:21 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Favoris 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-12 14:51 582,995 ---hs---- C:\WINDOWS\system32\qkbqbdcs.ini 2007-11-12 14:44 81,472 --a------ C:\WINDOWS\system32\soxeqqrx.dll 2007-11-12 13:54 d-------- C:\Program Files\Runtime Software 2007-11-12 10:56 1,024 --a------ C:\WINDOWS\system32\drivers\DCF1518D-AE04-44E5-A398-2B2579435BD4.cxv 2007-11-12 10:38 d--h----- C:\WINDOWS\system32\GroupPolicy 2007-11-12 10:22 10,240 --a------ C:\WINDOWS\system32\drivers\63C1D9DE-045B-4F3E-A220-8CAB6453DA8F.cxv 2007-11-12 10:18 d-------- C:\Program Files\STOPzilla! 2007-11-12 10:18 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2007-11-12 02:34 2,432 --a------ C:\WINDOWS\system32\unpr.sys 2007-11-12 02:34 353 ---hs---- C:\WINDOWS\system32\xxyxx.ini 2007-11-12 02:29 d-------- C:\WINDOWS\system32\bfeguufo 2007-11-12 02:29 d-------- C:\Program Files exunuxy 2007-11-12 02:21 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-12 01:39 d-------- C:\Documents and Settings\ANNA\Application Data\PC Tools 2007-11-10 02:36 d-------- C:\Program Files\RegCleaner 2007-11-10 02:06 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-11-10 01:22 d-------- C:\Documents and Settings\ANNA\Application Data\MSNInstaller 2007-11-10 01:14 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2007-11-10 01:03 d-------- C:\Program Files\Microsoft Windows OneCare Live 2007-11-10 00:39 d-------- C:\Program Files\Windows Live 2007-11-10 00:39 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-11-10 00:39 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-11-09 01:08 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-09 00:32 86,094 --a------ C:\WINDOWS\BPMNT.dll 2007-11-09 00:32 71,749 --a------ C:\WINDOWS\hcextoutput.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-26 22:18 --------- d-----w C:\Program Files\PestPatrol 2007-11-26 21:07 --------- d-----w C:\Program Files\Wanadoo 2007-11-26 19:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-26 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-26 16:01 --------- d-----w C:\Program Files\Google 2007-11-26 07:26 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-11-24 23:48 267,845 ----a-w C:\WINDOWS sc.exe 2007-11-24 23:48 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll 2007-11-22 15:59 --------- d-----w C:\Documents and Settings\ANNA\Application Data\uTorrent 2007-11-22 15:48 --------- d-----w C:\Program Files\LogProtect 2007-11-12 21:35 --------- d-----w C:\Program Files\eMule 2007-11-12 20:56 --------- d-----w C:\Program Files\a-squared Free 2007-11-12 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-12 18:26 --------- d-----w C:\Program Files\Ontrack 2007-11-12 12:54 --------- d-----w C:\Program Files\PowerArchiver 2007-11-12 11:06 --------- d-----w C:\Program Files\Ahead 2007-11-12 11:06 --------- d-----w C:\Documents and Settings\ANNA\Application Data\Ahead 2007-11-12 10:10 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-11-11 23:53 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-11-10 00:55 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-11-10 00:43 --------- d-----w C:\Program Files\MSN Messenger 2007-11-09 23:33 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-11-08 23:31 69,689 ----a-w C:\WINDOWS\UNZIP.DLL 2007-11-08 23:31 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL 2007-11-08 23:31 286,720 ----a-w C:\WINDOWS\PATCH.EXE 2007-11-08 17:00 --------- d-----w C:\Program Files\Macrogaming 2007-11-08 15:09 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared 2007-10-25 17:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-25 17:05 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-25 17:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-25 17:01 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-25 16:58 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-25 16:24 815,480 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-10-25 16:14 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-08 20:52 --------- d-----w C:\Program Files\Wizards of the Coast 2007-09-14 08:37 45,192 ----a-w C:\WINDOWS\system32\MsgPlusLoader.dll 2006-04-19 21:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 2007-11-26 08:16 80960 --a------ C:\WINDOWS\system32\jxcbeynb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}] C:\WINDOWS\system32\efecd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATI Launchpad"="C:\Program Files\ATI Multimedia\main\LaunchPd.exe" [2002-05-02 09:57] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 13:50] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:54] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 21:41] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "WINSOS VERIFY"="C:\Program Files\Winsos\WINSOS.exe" [] "Ptei"="C:\PROGRA~1\SMANTE~1\attrib.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 17:06] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "C-Media Mixer"="Mixer.exe" [2001-12-07 16:24 C:\WINDOWS\Mixer.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-14 17:29] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2003-08-05 09:11] "PestPatrol Control Center"="C:\Program Files\PESTPA~1\PPControl.exe" [2003-08-05 09:11] "CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2003-08-05 09:11] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17] C:\Documents and Settings\ANNA\Menu D‚marrer\Programmes\D‚marrage\ PPControl.lnk - C:\Documents and Settings\ANNA\Application Data\Microsoft\Installer\{FA1B3B7A-98D0-4F54-B555-7711A6E54544}\IconFA1B3B7A.exe [2005-03-23 00:49:53] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-13 01:44:38] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\xxyawvu] xxyawvu.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6PV_0001_N91M2107] C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr [1].exe -nag R0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys S2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINDOWS\system32\DRIVERS\CINEMSUP.SYS S3 AX88172;ASIX AX88172 USB2 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88172.sys S3 oUltraf;oUltraf;\??\C:\DOCUME~1\ANNA\LOCALS~1\Temp\oUltraf.sys S3 pgfilter;pgfilter;\??\C:\Program Files\PeerGuardian2\pgfilter.sys S3 RescueDrv;Inventel Access Point USB Rescue Driver;C:\WINDOWS\system32\Drivers esc_dwb.sys S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys S3 viafilter;VIA USB Filter;C:\WINDOWS\system32\Drivers\viausb1.sys S3 wanusb;ECI Telecom USB ADSL WAN Modem;C:\WINDOWS\system32\DRIVERS\gwausb.sys *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-11-26 22:00:00 C:\WINDOWS\Tasks\AF9263E490021B9C.job" - c:\docume~1\anna\applic~1\inside~1\meow 4 view.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-26 23:23:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run EPSON Stylus Photo R300 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"?????E????????????a?w????????????????p????????????????????b?w????p???????????8???????????h??w????p???????z??wp???????????)??|??????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-26 23:24:42 . --- E O F ---

g!rly · Answer

re,

* Relance Vundofix
* Ne clique pas sur "Scan for a vundo"
* Clique droit au milieu de la fenêtre
* Clique sur Add more files ?
* Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\jxcbeynb.dll
C:\WINDOWS\system32\efecd.dll
C:\WINDOWS\system32\xxyawvu.dll

* Clique sur Add files
* Ensuite clique sur Close Windows
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
* Si l'outils demande un redémarrage, accepte
* Poste le rapport Vundofix

puis vide tes fichiers temporaires avec ceci :

http://www.infos-du-net.com/telecharger/ATF-Cleaner,0301-10869.html

tutoriel :

http://www.infosecu.fr/atf.html

post le rapport vundofix

marina · Answer

VundoFix V6.6.2

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.5
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 21:40:37 26/11/2007

Listing files found while scanning....

C:\windows\system32\__c0017A4.dat
C:\windows\system32\dcefe.bak1
C:\windows\system32\dcefe.bak2
C:\windows\system32\dcefe.ini
C:\windows\system32\divungjf.dll
C:\windows\system32\efecd.dll
C:\windows\system32\guscwddl.dllbox
C:\windows\system32\ipqvurfg.dll
C:\windows\system32\jgfgmnql.dll
C:\windows\system32\lacodmct.dll
C:\WINDOWS\system32\qhrwmgwr.dll
C:\windows\system32\qhrwmgwr.dllbox
C:\windows\system32\swlrokjp.dll

Beginning removal...

 Attempting to delete C:\windows\system32\__c0017A4.dat
C:\windows\system32\__c0017A4.dat Has been deleted!

 Attempting to delete C:\windows\system32\dcefe.bak1
C:\windows\system32\dcefe.bak1 Has been deleted!

 Attempting to delete C:\windows\system32\dcefe.bak2
C:\windows\system32\dcefe.bak2 Has been deleted!

 Attempting to delete C:\windows\system32\dcefe.ini
C:\windows\system32\dcefe.ini Has been deleted!

 Attempting to delete C:\windows\system32\divungjf.dll
C:\windows\system32\divungjf.dll Has been deleted!

 Attempting to delete C:\windows\system32\efecd.dll
C:\windows\system32\efecd.dll Has been deleted!

 Attempting to delete C:\windows\system32\guscwddl.dllbox
C:\windows\system32\guscwddl.dllbox Has been deleted!

 Attempting to delete C:\windows\system32\ipqvurfg.dll
C:\windows\system32\ipqvurfg.dll Has been deleted!

 Attempting to delete C:\windows\system32\jgfgmnql.dll
C:\windows\system32\jgfgmnql.dll Has been deleted!

 Attempting to delete C:\windows\system32\lacodmct.dll
C:\windows\system32\lacodmct.dll Has been deleted!

 Attempting to delete C:\WINDOWS\system32\qhrwmgwr.dll
C:\WINDOWS\system32\qhrwmgwr.dll Has been deleted!

 Attempting to delete C:\windows\system32\qhrwmgwr.dllbox
C:\windows\system32\qhrwmgwr.dllbox Has been deleted!

 Attempting to delete C:\windows\system32\swlrokjp.dll
C:\windows\system32\swlrokjp.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\jxcbeynb.dll 
C:\WINDOWS\system32\jxcbeynb.dll  Has been deleted!

Performing Repairs to the registry.
Done!

g!rly · Answer

re,

tu as posté le meme rapport qu´auparavant

tu dois  en avoir un autre?

C:\vundofix.txt

marina · Answer

non je n est rien j aie fait la manip que tu ma dit celle dessous et l outils a demander un redemarage et rien d autre que dois je faire ???

* Clique sur Add files 
* Ensuite clique sur Close Windows 
* Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale) 
* Si l'outils demande un redémarrage, accepte 
* Poste le rapport Vundofix

g!rly · Answer

re,

repost un combofix stp

marina · Answer

pardon je viens de le voire le voici 


Beginning removal...

Performing Repairs to the registry.
Done!



1  = parcontre que dois je faire de tous les programme insteller et dossier qui se sont cree je les laisse ou les supprimes 

2  = j aie un autre souci j essaye de restaurer la sauvegarde de mon registres et sa me dit impossible car toutes les donnees non pas ete inscrites correctements dans le registres .Certaines cles sont ouvertes par le systemes ou d autres processus . 


voila que dois je faire marci d avance

g!rly · Answer

1 pour le moment ne supprime rien
2 ne tente surtout une restauration du registre car ca reinjecterais les clefs infectés

repost un combofix stp

marina · Answer

ComboFix 07-11-19.4 - ANNA 2007-11-27 0:28:51.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.237 [GMT 1:00] Running from: C:\Documents and Settings\ANNA\Bureau\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-26 to 2007-11-26 )))))))))))))))))))))))))))))))))))) . 2007-11-26 23:29 467,632 --a------ C:\WINDOWS\system32\perfh040.dat 2007-11-26 23:29 74,326 --a------ C:\WINDOWS\system32\perfc040.dat 2007-11-26 21:40 d-------- C:\VundoFix Backups 2007-11-26 20:39 d-------- C:\Program Files\Trend Micro 2007-11-26 17:09 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-26 17:09 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-26 17:09 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-26 17:09 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-26 17:08 d-------- C:\Program Files\Spyware Doctor 2007-11-26 13:06 143 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-11-26 11:12 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-26 08:10 1,168,955 ---hs---- C:\WINDOWS\system32\yehctblc.ini 2007-11-26 08:07 d-------- C:\WINDOWS\system32 nrtmwuk 2007-11-25 00:47 d-------- C:\WINDOWS\AU_Temp 2007-11-24 14:01 1,352,957 ---hs---- C:\WINDOWS\system32\hnhkavvt.ini 2007-11-24 13:58 81,472 --a------ C:\WINDOWS\system32\ilsqvvyi.dll 2007-11-22 17:22 79,936 --a------ C:\WINDOWS\system32\murnqpsp.dll 2007-11-22 17:18 1,004,368 ---hs---- C:\WINDOWS\system32\pgykbnbu.ini 2007-11-22 17:08 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-18 18:58 79,424 --a------ C:\WINDOWS\system32\ydsrbxvb.dll 2007-11-18 18:55 737,138 ---hs---- C:\WINDOWS\system32 iojyxbp.ini 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Modèles 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-12 18:21 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Favoris 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-12 14:51 582,995 ---hs---- C:\WINDOWS\system32\qkbqbdcs.ini 2007-11-12 14:44 81,472 --a------ C:\WINDOWS\system32\soxeqqrx.dll 2007-11-12 13:54 d-------- C:\Program Files\Runtime Software 2007-11-12 10:56 1,024 --a------ C:\WINDOWS\system32\drivers\DCF1518D-AE04-44E5-A398-2B2579435BD4.cxv 2007-11-12 10:38 d--h----- C:\WINDOWS\system32\GroupPolicy 2007-11-12 10:22 10,240 --a------ C:\WINDOWS\system32\drivers\63C1D9DE-045B-4F3E-A220-8CAB6453DA8F.cxv 2007-11-12 10:18 d-------- C:\Program Files\STOPzilla! 2007-11-12 10:18 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2007-11-12 02:34 2,432 --a------ C:\WINDOWS\system32\unpr.sys 2007-11-12 02:34 353 ---hs---- C:\WINDOWS\system32\xxyxx.ini 2007-11-12 02:29 d-------- C:\WINDOWS\system32\bfeguufo 2007-11-12 02:29 d-------- C:\Program Files exunuxy 2007-11-12 02:21 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-12 01:39 d-------- C:\Documents and Settings\ANNA\Application Data\PC Tools 2007-11-10 02:36 d-------- C:\Program Files\RegCleaner 2007-11-10 02:06 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-11-10 01:22 d-------- C:\Documents and Settings\ANNA\Application Data\MSNInstaller 2007-11-10 01:14 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2007-11-10 01:03 d-------- C:\Program Files\Microsoft Windows OneCare Live 2007-11-10 00:39 d-------- C:\Program Files\Windows Live 2007-11-10 00:39 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-11-10 00:39 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-11-09 01:08 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-09 00:32 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-11-09 00:32 267,845 --a------ C:\WINDOWS sc.exe 2007-11-09 00:32 86,094 --a------ C:\WINDOWS\BPMNT.dll 2007-11-09 00:32 71,749 --a------ C:\WINDOWS\hcextoutput.dll 2007-11-09 00:31 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-11-09 00:31 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-11-09 00:31 69,689 --a------ C:\WINDOWS\UNZIP.DLL . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-26 23:21 --------- d-----w C:\Program Files\PestPatrol 2007-11-26 23:20 --------- d-----w C:\Program Files\Wanadoo 2007-11-26 19:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-26 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-26 16:01 --------- d-----w C:\Program Files\Google 2007-11-26 07:26 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-11-22 15:59 --------- d-----w C:\Documents and Settings\ANNA\Application Data\uTorrent 2007-11-22 15:48 --------- d-----w C:\Program Files\LogProtect 2007-11-12 21:35 --------- d-----w C:\Program Files\eMule 2007-11-12 20:56 --------- d-----w C:\Program Files\a-squared Free 2007-11-12 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-12 18:26 --------- d-----w C:\Program Files\Ontrack 2007-11-12 12:54 --------- d-----w C:\Program Files\PowerArchiver 2007-11-12 11:06 --------- d-----w C:\Program Files\Ahead 2007-11-12 11:06 --------- d-----w C:\Documents and Settings\ANNA\Application Data\Ahead 2007-11-12 10:10 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-11-11 23:53 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-11-10 00:55 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-11-10 00:43 --------- d-----w C:\Program Files\MSN Messenger 2007-11-09 23:33 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-11-08 17:00 --------- d-----w C:\Program Files\Macrogaming 2007-11-08 15:09 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared 2007-10-25 17:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-25 17:05 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-25 17:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-25 17:01 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-25 16:58 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-25 16:24 815,480 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-10-25 16:14 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-08 20:52 --------- d-----w C:\Program Files\Wizards of the Coast 2007-09-14 08:37 45,192 ----a-w C:\WINDOWS\system32\MsgPlusLoader.dll 2006-04-19 21:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-26_23.23.53,98 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-26 16:10:28 61,476 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-26 23:25:12 61,476 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-26 16:10:28 401,932 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-26 23:25:12 401,932 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-11-26 21:06:07 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_534.dat + 2007-11-26 23:19:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_534.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] C:\WINDOWS\system32\jxcbeynb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}] C:\WINDOWS\system32\efecd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATI Launchpad"="C:\Program Files\ATI Multimedia\main\LaunchPd.exe" [2002-05-02 09:57] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 13:50] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:54] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 21:41] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "WINSOS VERIFY"="C:\Program Files\Winsos\WINSOS.exe" [] "Ptei"="C:\PROGRA~1\SMANTE~1\attrib.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 17:06] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "C-Media Mixer"="Mixer.exe" [2001-12-07 16:24 C:\WINDOWS\Mixer.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-14 17:29] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2003-08-05 09:11] "PestPatrol Control Center"="C:\Program Files\PESTPA~1\PPControl.exe" [2003-08-05 09:11] "CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2003-08-05 09:11] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17] C:\Documents and Settings\ANNA\Menu D‚marrer\Programmes\D‚marrage\ PPControl.lnk - C:\Documents and Settings\ANNA\Application Data\Microsoft\Installer\{FA1B3B7A-98D0-4F54-B555-7711A6E54544}\IconFA1B3B7A.exe [2005-03-23 00:49:53] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-13 01:44:38] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\guscwddl] guscwddl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\qhrwmgwr] qhrwmgwr.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\xxyawvu] xxyawvu.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6PV_0001_N91M2107] C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr [1].exe -nag R0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys S2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINDOWS\system32\DRIVERS\CINEMSUP.SYS S3 AX88172;ASIX AX88172 USB2 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88172.sys S3 oUltraf;oUltraf;\??\C:\DOCUME~1\ANNA\LOCALS~1\Temp\oUltraf.sys S3 pgfilter;pgfilter;\??\C:\Program Files\PeerGuardian2\pgfilter.sys S3 RescueDrv;Inventel Access Point USB Rescue Driver;C:\WINDOWS\system32\Drivers esc_dwb.sys S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys S3 viafilter;VIA USB Filter;C:\WINDOWS\system32\Drivers\viausb1.sys S3 wanusb;ECI Telecom USB ADSL WAN Modem;C:\WINDOWS\system32\DRIVERS\gwausb.sys . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-11-26 23:00:00 C:\WINDOWS\Tasks\AF9263E490021B9C.job" - c:\docume~1\anna\applic~1\inside~1\meow 4 view.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-27 00:32:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2007-11-27 0:33:44 . --- E O F ---

g!rly · Answer

re,

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216})
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\guscwddl]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\qhrwmgwr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\xxyawvu]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6PV_0001_N91M2107]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

note : regedit4 doit etre sur la premiere ligne dans le bloc note et a la fin il y a une ligne blanche

Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

Télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-click sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

    Citation :
    
C:\WINDOWS\system32\jxcbeynb.dll
C:\WINDOWS\system32\efecd.dll
C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg

Télécharge ComboScan sur ton Bureau en bas de cette pae en clickant sur download file

-> http://www.geekstogo.com/forum/files/

Ferme toutes les applications en cours : antivirus, pare-feu, etc ..
Double-clic sur comboscan.exe, dans la fenêtre qui s'affiche, clic sur OK.
Soit patient...
Le rapport Comboscan.txt s'affichera, copie et colle le contenu de ce fichier ici.

Le rapport peut-être long et en deux morceaux vérifie qu'il soit en entier.


post le rapport de otmove it et de comboscan

ps si tu ne comprends pas la manip avec "fix.reg" demande avant de commencer

@+

marina · Answer

voici le rapport 

Deckard's System Scanner v20071014.68
Run by ANNA on 2007-11-27 01:13:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
48: 2007-11-27 00:13:25 UTC - RP1220 - Deckard's System Scanner Restore Point
47: 2007-11-26 22:19:58 UTC - RP1219 - ComboFix created restore point
46: 2007-11-26 19:06:22 UTC - RP1218 - Spyware Doctor: Cleaning Threats
45: 2007-11-26 16:36:39 UTC - RP1217 - Spyware Doctor: Cleaning Threats
44: 2007-11-26 16:14:02 UTC - RP1216 - Spyware Doctor: Cleaning Threats


-- First Restore Point -- 
1: 2007-11-08 23:14:54 UTC - RP1173 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as ANNA.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:15, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\ANNA\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ANNA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll (file missing)
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

marina · Answer

Deckard's System Scanner v20071014.68
Run by ANNA on 2007-11-27 01:23:18
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as ANNA.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:23, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\ANNA\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ANNA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll (file missing)
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

marina · Answer

bonsoir je vois que tu n est plus la se que je comprend vue l heure je te remercie pour tous et je serrais reconnecter demain matin en fin tout a l heure a 7h 30 si tu peu dire si a autre chose faire et surtout se que je dois supprimer et garder , et ensuite quand je doit restaure le registre que j aie sauvgarder marci pour tous bonne soiree marina

g!rly · Answer

re,

je suis encore la

tu n´as pas rencontré de probleme en fesant le fix reg?

car les cles sont toujours la

tu as le rapport de ot_move it?

C:\_OTMoveIt\MovedFiles.

marina · Answer

je le trouve ou le rapport  ot_move it?

jlpjlp · Answer

je le trouve ou le rapport ot_move it?

tu vas dans poste de travail puis

 dans C:\_OTMoveIt\MovedFiles.

marina · Answer

il n y a rien  dommage que je ne sais pas faire le truc de te mettre la photo je te ferrais voire il n y a pas de doc texte de rapport meme mieux il n y en a plus aucun de aucun programme que dois je faire ???

marina · Answer

http://img264.imageshack.us/img264/3504/capture01sm8.jpg

jlpjlp · Answer

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216})
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\guscwddl]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\qhrwmgwr]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\xxyawvu]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6PV_0001_N91M2107]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X

note : regedit4 doit etre sur la premiere ligne dans le bloc note et a la fin il y a une ligne blanche

Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

____________________________



analyse ces fichiers sur virus total et dis lesquels sont inféctés:  https://www.virustotal.com/gui/

C:\WINDOWS\system32	nrtmwuk
C:\WINDOWS\AU_Temp
C:\WINDOWS\system32\ilsqvvyi.dll
C:\WINDOWS\system32\murnqpsp.dll
C:\Documents and Settings\ANNA
tuser.dat
C:\WINDOWS\system32\ydsrbxvb.dll
C:\WINDOWS\system32\soxeqqrx.dll
C:\WINDOWS\system32\bfeguufo

____________________

recolle un rapport hijackthis , un rapport combofix
g!rly finira 
a plus

marina · Answer

youpi j aie reussi a te mettre l apercu de l image

marina · Answer

les fichier 1 ,2 , 5 , et 8 sa dit fichier vide et les 3 , 4 , 6 , et 7 voila l analyse du virus total








Fichier ilsqvvyi.dll_ reçu le 2007.11.27 09:57:26 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 13/32 (40.63%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 11.
L'heure estimée de démarrage est entre 70 et 100 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2007.11.27.0 2007.11.27 Win-Trojan/Conhook.81472 
AntiVir 7.6.0.34 2007.11.27 TR/Dldr.ConHook.Gen 
Authentium 4.93.8 2007.11.24 - 
Avast 4.7.1074.0 2007.11.25 - 
AVG 7.5.0.503 2007.11.26 Lop 
BitDefender 7.2 2007.11.27 Trojan.Vundo.DRF 
CAT-QuickHeal 9.00 2007.11.26 - 
ClamAV 0.91.2 2007.11.26 - 
DrWeb 4.44.0.09170 2007.11.27 Trojan.Juan.25 
eSafe 7.0.15.0 2007.11.21 - 
eTrust-Vet 31.3.5329 2007.11.26 - 
Ewido 4.0 2007.11.26 - 
FileAdvisor 1 2007.11.27 - 
Fortinet 3.14.0.0 2007.11.27 - 
F-Prot 4.4.2.54 2007.11.27 - 
F-Secure 6.70.13030.0 2007.11.27 Vundo.gen51 
Ikarus T3.1.1.12 2007.11.27 - 
Kaspersky 7.0.0.125 2007.11.27 not-a-virus:AdWare.Win32.SuperJuan.h 
McAfee 5171 2007.11.26 Vundo 
Microsoft 1.3007 2007.11.27 - 
NOD32v2 2687 2007.11.26 a variant of Win32/BHO.G 
Norman 5.80.02 2007.11.26 Vundo.gen51 
Panda 9.0.0.4 2007.11.26 Suspicious file 
Prevx1 V2 2007.11.27 - 
Rising 20.20.10.00 2007.11.27 - 
Sophos 4.23.0 2007.11.27 - 
Sunbelt 2.2.907.0 2007.11.27 - 
Symantec 10 2007.11.27 - 
TheHacker 6.2.9.142 2007.11.26 - 
VBA32 3.12.2.5 2007.11.23 - 
VirusBuster 4.3.26:9 2007.11.26 Adware.Vundo.V.Gen 
Webwasher-Gateway 6.0.1 2007.11.27 Trojan.Dldr.ConHook.Gen 
Information additionnelle 
File size: 81472 bytes 
MD5: 1bbcd417c3708d82a919fd5eec631a9a 
SHA1: 9589852545024bb13a65489ee618ec90467d7dfd 






Fichier murnqpsp.dll_ reçu le 2007.11.27 10:01:14 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 11/32 (34.38%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 11.
L'heure estimée de démarrage est entre 70 et 100 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2007.11.27.0 2007.11.27 - 
AntiVir 7.6.0.34 2007.11.27 TR/Dldr.ConHook.Gen 
Authentium 4.93.8 2007.11.24 - 
Avast 4.7.1074.0 2007.11.25 - 
AVG 7.5.0.503 2007.11.26 Lop 
BitDefender 7.2 2007.11.27 Trojan.Vundo.DQZ 
CAT-QuickHeal 9.00 2007.11.27 - 
ClamAV 0.91.2 2007.11.27 - 
DrWeb 4.44.0.09170 2007.11.27 - 
eSafe 7.0.15.0 2007.11.21 - 
eTrust-Vet 31.3.5329 2007.11.26 - 
Ewido 4.0 2007.11.26 - 
FileAdvisor 1 2007.11.27 - 
Fortinet 3.14.0.0 2007.11.27 - 
F-Prot 4.4.2.54 2007.11.27 - 
F-Secure 6.70.13030.0 2007.11.27 Vundo.gen51 
Ikarus T3.1.1.12 2007.11.27 - 
Kaspersky 7.0.0.125 2007.11.27 - 
McAfee 5171 2007.11.26 Vundo 
Microsoft 1.3007 2007.11.27 - 
NOD32v2 2687 2007.11.26 Win32/BHO.G 
Norman 5.80.02 2007.11.26 Vundo.gen51 
Panda 9.0.0.4 2007.11.26 - 
Prevx1 V2 2007.11.27 Trojan.Vundo 
Rising 20.20.10.00 2007.11.27 - 
Sophos 4.23.0 2007.11.27 Troj/BHO-DY 
Sunbelt 2.2.907.0 2007.11.27 - 
Symantec 10 2007.11.27 - 
TheHacker 6.2.9.142 2007.11.26 - 
VBA32 3.12.2.5 2007.11.23 - 
VirusBuster 4.3.26:9 2007.11.26 Adware.Vundo.V.Gen 
Webwasher-Gateway 6.0.1 2007.11.27 Trojan.Dldr.ConHook.Gen 
Information additionnelle 
File size: 79936 bytes 
MD5: 870266bb7fd62ec270cd1236a79292ed 
SHA1: 83b8db44125a78aa73a64e4a14e4550e5eee2631 
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=1C63FB20402BD08238AF01BB19090100727EACD3 













Fichier ydsrbxvb.dll_ reçu le 2007.11.27 10:08:22 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 12/32 (37.5%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 13.
L'heure estimée de démarrage est entre 76 et 109 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2007.11.27.0 2007.11.27 - 
AntiVir 7.6.0.34 2007.11.27 TR/Dldr.ConHook.Gen 
Authentium 4.93.8 2007.11.24 - 
Avast 4.7.1074.0 2007.11.25 - 
AVG 7.5.0.503 2007.11.26 Lop 
BitDefender 7.2 2007.11.27 - 
CAT-QuickHeal 9.00 2007.11.27 - 
ClamAV 0.91.2 2007.11.27 - 
DrWeb 4.44.0.09170 2007.11.27 - 
eSafe 7.0.15.0 2007.11.21 - 
eTrust-Vet 31.3.5329 2007.11.26 Win32/Darksma.GN 
Ewido 4.0 2007.11.26 - 
FileAdvisor 1 2007.11.27 - 
Fortinet 3.14.0.0 2007.11.27 - 
F-Prot 4.4.2.54 2007.11.27 - 
F-Secure 6.70.13030.0 2007.11.27 Vundo.gen51 
Ikarus T3.1.1.12 2007.11.27 - 
Kaspersky 7.0.0.125 2007.11.27 - 
McAfee 5171 2007.11.26 Vundo 
Microsoft 1.3007 2007.11.27 - 
NOD32v2 2687 2007.11.26 a variant of Win32/BHO.G 
Norman 5.80.02 2007.11.26 W32/Virtumonde.IOC 
Panda 9.0.0.4 2007.11.26 Suspicious file 
Prevx1 V2 2007.11.27 Trojan.Vundo 
Rising 20.20.11.00 2007.11.27 - 
Sophos 4.23.0 2007.11.27 - 
Sunbelt 2.2.907.0 2007.11.27 - 
Symantec 10 2007.11.27 Trojan.Metajuan 
TheHacker 6.2.9.142 2007.11.26 - 
VBA32 3.12.2.5 2007.11.23 - 
VirusBuster 4.3.26:9 2007.11.26 Adware.Vundo.V.Gen 
Webwasher-Gateway 6.0.1 2007.11.27 Trojan.Dldr.ConHook.Gen 
Information additionnelle 
File size: 79424 bytes 
MD5: 397d1532673708a3c55114231c1c8674 
SHA1: a5586608dce3c3947e3a0d68a645571f304371ba 
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=9B7A8627406B82DA369B01BF79D2B500D74CA6CE 












Fichier soxeqqrx.dll_ reçu le 2007.11.27 10:21:03 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE 


Résultat: 14/32 (43.75%)
en train de charger les informations du serveur... 
Votre fichier est dans la file d'attente, en position: 12.
L'heure estimée de démarrage est entre 73 et 104 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse. 
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier. 
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 
 Formaté Impression des résultats  
Votre fichier a expiré ou n'existe pas. 
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. 
 Email:  
  

Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2007.11.27.1 2007.11.27 Win-Trojan/Xema.variant 
AntiVir 7.6.0.34 2007.11.27 TR/Vundo.AX 
Authentium 4.93.8 2007.11.24 - 
Avast 4.7.1074.0 2007.11.25 - 
AVG 7.5.0.503 2007.11.26 Lop 
BitDefender 7.2 2007.11.27 - 
CAT-QuickHeal 9.00 2007.11.27 - 
ClamAV 0.91.2 2007.11.27 - 
DrWeb 4.44.0.09170 2007.11.27 - 
eSafe 7.0.15.0 2007.11.21 - 
eTrust-Vet 31.3.5329 2007.11.26 Win32/Darksma.GF 
Ewido 4.0 2007.11.26 - 
FileAdvisor 1 2007.11.27 - 
Fortinet 3.14.0.0 2007.11.27 - 
F-Prot 4.4.2.54 2007.11.27 - 
F-Secure 6.70.13030.0 2007.11.27 Vundo.gen49 
Ikarus T3.1.1.12 2007.11.27 - 
Kaspersky 7.0.0.125 2007.11.27 - 
McAfee 5171 2007.11.26 Vundo 
Microsoft 1.3007 2007.11.27 - 
NOD32v2 2687 2007.11.26 a variant of Win32/BHO.G 
Norman 5.80.02 2007.11.26 W32/Virtumonde.IJR 
Panda 9.0.0.4 2007.11.26 Suspicious file 
Prevx1 V2 2007.11.27 Trojan.Vundo 
Rising 20.20.11.00 2007.11.27 - 
Sophos 4.23.0 2007.11.27 - 
Sunbelt 2.2.907.0 2007.11.27 - 
Symantec 10 2007.11.27 Trojan.Vundo 
TheHacker 6.2.9.142 2007.11.26 Adware/SuperJuan.f 
VBA32 3.12.2.5 2007.11.23 - 
VirusBuster 4.3.26:9 2007.11.26 Adware.Vundo.V.Gen 
Webwasher-Gateway 6.0.1 2007.11.27 Trojan.Vundo.AX 
Information additionnelle 
File size: 81472 bytes 
MD5: 34ff25856dbdaa2c89698bd01fd0af4d 
SHA1: 7242248a080b5ec233488def87e79bb75e180b52 
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5=3821B1D140B8653B3E1801BD7CDB4E00C82470DD

marina · Answer

le rapport de hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll (file missing)
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

g!rly · Answer

salut marina et jlpjlp,

remet un comboscan stp

@+

jlpjlp · Answer

slt g!rly

je te laisse poursuivre


bonne continuation a tous les deux

marina · Answer

merci a vous deux pour votre aide je vous tire mon chapeau pour la patience voila le rapport 




Deckard's System Scanner v20071014.68
Run by ANNA on 2007-11-27 10:49:39
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as ANNA.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:49, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\ANNA\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ANNA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll (file missing)
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

g!rly · Answer

on continue,

telecharge ce fichier :

http://serveur1.archive-host.com/membres/up/1366464061/marina.rar

dezip le sur ton bureau > double click dessus ( marina.reg ) et accepte la fusion avec le registre.

puis double click sur ot_move it

copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

    Citation :
    
C:\WINDOWS\system32	nrtmwuk
C:\WINDOWS\AU_Temp
C:\WINDOWS\system32\ilsqvvyi.dll
C:\WINDOWS\system32\murnqpsp.dll
C:\Documents and Settings\ANNA
tuser.dat
C:\WINDOWS\system32\ydsrbxvb.dll
C:\WINDOWS\system32\soxeqqrx.dll
C:\WINDOWS\system32\bfeguufo 

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg

puis

appuie simultanement sur la touche windows a droit de la barre d´espace (drapeau windows) et sur "e" ->une fois dans le post de travail click sur le disk c > program files >java ouvre le fichier java et click sur le fichier jre1.5.0_09 pour l´ouvrir puis ouvre le fichier bin et dedans tu recherche ceci : jucheck.exe tu double click dessus et effectue la mise a jour de java> tu veux la version 1.6.0_03
une fois la mise a jour effectuée tu va dans ajoute/suppression de program et tu supprime toutes les autres update de java, il ne doit te rester que celle que tu viens de faire : 1.6.0_03 

instale un par feu :

par feu : kerio

Kerio (pare-feu) : reste gratuit après la période d'essai en français
----> http://www.infos-du-net.com/telecharger/Firewall-Kerio-Personal,0301-390.html

Regarde ce tutoriel si tu as besoin d'aide pour l'installation et la configuration de Kerio
--> https://kerio.probb.fr/

Plus d'info :
->https://kerio.probb.fr/ 

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

et

desinstale avast et instale celui ci a la place :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

et fais un scan complet avec en regardant ce tutoriel pour regler le scanner et post le rapport ici 

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

alors post le rapport de ot_move it et celui d´antivir stp

@+

marina · Answer

j aie eut un pb quand j aie fait le copier coller de la citation effectivement sa ma demander de redemarrer et la surprise plus de fond d ecran plus de poste de travail sur le bureau plus d internet enfin la cata j aie du restaurer a hier soir 1h 23 je n est rien compris qu est qui ses passer , j aie marre surtout quand ton n y comprend rien en informatique et que on doit se parler par forum il n y a pas d autre moyen pour discuter ??? marina

g!rly · Answer

re, 

peux tu remettre un comboscan stp

on reste sur le forum c´est plus pratique pour les rapports

marina · Answer

j aie refait la manip et la pas de pb je continue 



C:\WINDOWS\system32	nrtmwuk moved successfully.
C:\WINDOWS\AU_Temp\AU_Down\product moved successfully.
C:\WINDOWS\AU_Temp\AU_Down\pattern moved successfully.
C:\WINDOWS\AU_Temp\AU_Down\engine moved successfully.
C:\WINDOWS\AU_Temp\AU_Down moved successfully.
C:\WINDOWS\AU_Temp\3\4 moved successfully.
C:\WINDOWS\AU_Temp\3 moved successfully.
C:\WINDOWS\AU_Temp\2\4 moved successfully.
C:\WINDOWS\AU_Temp\2 moved successfully.
C:\WINDOWS\AU_Temp\1\27 moved successfully.
C:\WINDOWS\AU_Temp\1 moved successfully.
C:\WINDOWS\AU_Temp moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ilsqvvyi.dll
C:\WINDOWS\system32\ilsqvvyi.dll NOT unregistered.
C:\WINDOWS\system32\ilsqvvyi.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\murnqpsp.dll
C:\WINDOWS\system32\murnqpsp.dll NOT unregistered.
C:\WINDOWS\system32\murnqpsp.dll moved successfully.
File move failed. C:\Documents and Settings\ANNA
tuser.dat scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ydsrbxvb.dll
C:\WINDOWS\system32\ydsrbxvb.dll NOT unregistered.
C:\WINDOWS\system32\ydsrbxvb.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\soxeqqrx.dll
C:\WINDOWS\system32\soxeqqrx.dll NOT unregistered.
C:\WINDOWS\system32\soxeqqrx.dll moved successfully.
C:\WINDOWS\system32\bfeguufo moved successfully.
 
Created on 11/27/2007 12:16:40

g!rly · Answer

re,

ok pour ot-move it

tu as refais ca aussi ?

telecharge ce fichier :

http://serveur1.archive-host.com/membres/up/1366464061/marina.rar

dezip le sur ton bureau > double click dessus ( marina.reg ) et accepte la fusion avec le registre.

sinon fais le et continue avec le par feu et l´antivirus

marina · Answer

Deckard's System Scanner v20071014.68
Run by ANNA on 2007-11-27 12:30:17
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
50: 2007-11-27 11:30:29 UTC - RP1222 - Deckard's System Scanner Restore Point
49: 2007-11-27 10:35:53 UTC - RP1221 - Opération de restauration
48: 2007-11-27 00:13:25 UTC - RP1220 - Deckard's System Scanner Restore Point
47: 2007-11-26 22:19:58 UTC - RP1219 - ComboFix created restore point
46: 2007-11-26 19:06:22 UTC - RP1218 - Spyware Doctor: Cleaning Threats


-- First Restore Point -- 
1: 2007-11-08 23:14:54 UTC - RP1173 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as ANNA.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31, on 27/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Multimedia\main\LaunchPd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\ANNA\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\ANNA.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: {de4192dd-7aa3-c519-af24-b7d799268b22} - {22b86299-7d7b-42fa-915c-3aa7dd2914ed} - C:\WINDOWS\system32\jxcbeynb.dll (file missing)
O2 - BHO: (no name) - {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} - C:\WINDOWS\system32\efecd.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7690710C-1A33-4D05-B860-1730FE652B77} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} - (no file)
O2 - BHO: (no name) - {B98B4120-018E-4C17-9496-7705DE0F1216} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI
O4 - HKCU\..\Run: [Ptei] "C:\PROGRA~1\SMANTE~1\attrib.exe" -vt yazb
O4 - Startup: PPControl.lnk = ?
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) - https://www.epson.eu/support/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - https://www.cult3d.com/
O16 - DPF: {4EFE4BE8-8771-4649-B3EF-D97374C8D2C2} (KeybHunterWebInterface Class) - https://particuliers.secure.lcl.fr/v_1.0/img/akl/FormProtect.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://gamekult.metaboli.fr/components/Metaboli.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

g!rly · Answer

ok pour ot-move it

refais ca aussi ?

telecharge ce fichier :

http://serveur1.archive-host.com/membres/up/1366464061/marina.rar

dezip le sur ton bureau > double click dessus ( marina.reg ) et accepte la fusion avec le registre.

et continue avec le par feu et l´antivirus

marina · Answer

je n y comprend rien ses en anglais 





27.11.2007 12:55:52 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:55:52 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.11.2007 12:55:52 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\
27.11.2007 12:55:52 - Start the Update GUI... Displaymode: 0

27.11.2007 12:55:52 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:55:52 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.11.2007 12:55:52 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\
27.11.2007 12:55:52 - Start the Update GUI... Displaymode: 0

27.11.2007 12:55:58 - Keyfile: OK [FULL Mode]

27.11.2007 12:55:58 - Avira AntiVir PersonalEdition Classic

27.11.2007 12:56:05 - Master IDX file has changed
27.11.2007 12:56:17 - Keyfile: OK [FULL Mode]

27.11.2007 12:56:17 - Downloading the product.info file from http://dl6.avgate.net/upd/idx/classic-nt-en.info.gz
27.11.2007 12:56:18 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/avadmin.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/wsctool.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:56:18 - Downloading the product.info file from http://dl6.avgate.net/upd/idx/vdf.info.gz
27.11.2007 12:56:23 - Keyfile: OK [FULL Mode]

27.11.2007 12:56:23 - Downloading the product.info file from http://dl6.avgate.net/upd/idx/specvir-nt.info.gz
27.11.2007 12:56:23 - Downloading the product.info file from http://dl6.avgate.net/upd/idx/engine.info.gz
27.11.2007 12:56:24 - Downloading the product.info file from http://dl6.avgate.net/upd/idx/engine-nt-en.info.gz
27.11.2007 12:56:25 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll 1.2.10.20 < 1.2.10.21
27.11.2007 12:56:25 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 75
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe 7.2.0.12 < 7.2.0.14
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe 7.2.0.13 < 7.2.0.16
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe 7.0.0.79 < 7.0.0.82
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccguard.dll 7.0.1.34 < 7.0.1.35
27.11.2007 12:56:25 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\ccprofil.dll 7.2.0.5 < 7.2.0.6
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe 7.0.0.34 < 7.0.0.35
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys 7.0.0.2 < 7.0.0.4
27.11.2007 12:56:26 - build.dat 9435a63d8ae0e1bec77b8634a5b0d268 != 6c345d2097f5791881eeda2797081e7c
27.11.2007 12:56:26 - ccplg.xml 472c2b02386229476b2bb7038744dd80 != 92f17221088547222489fd7dbaba9601
27.11.2007 12:56:26 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\Documents and Settings\All Users\Application Data\ Files: 1
27.11.2007 12:56:26 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
27.11.2007 12:56:26 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir0.vdf 6.35.0.1 < 6.40.0.0
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir1.vdf 6.39.0.129 < 7.0.0.0
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir2.vdf 6.39.1.43 < 7.0.1.0
27.11.2007 12:56:26 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\antivir3.vdf 6.39.1.51 < 7.0.1.11
27.11.2007 12:56:26 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
27.11.2007 12:56:26 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
27.11.2007 12:56:27 - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avewin32.dll 7.6.0.5 < 7.6.0.34
27.11.2007 12:56:27 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
27.11.2007 12:56:27 - Module: DRV Source: winwks\en\ Destination: C:\WINDOWS\SYSTEM32\drivers\ Files: 4
27.11.2007 12:56:27 - C:\WINDOWS\SYSTEM32\drivers\avipbb.sys 1.0.2.11 < 1.0.2.13
27.11.2007 12:56:27 - Minifilter is installed

27.11.2007 12:56:27 - Minifilter is possible

27.11.2007 12:56:27 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

27.11.2007 12:56:27 - Initialize avnotify.exe

27.11.2007 12:56:27 - Starting avnotify.exe successful

27.11.2007 12:56:27 - Preparing to download files
27.11.2007 12:56:27 - 16 files need to be downloaded / copied from http://dl6.avgate.net/upd/
27.11.2007 12:56:27 - #1: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/updlib.dll.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/updlib.dll
27.11.2007 12:56:28 - #2: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/avcenter.exe.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/avcenter.exe
27.11.2007 12:56:34 - #3: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/avgnt.exe.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/avgnt.exe
27.11.2007 12:56:35 - #4: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/avguard.exe.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/avguard.exe
27.11.2007 12:56:36 - #5: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/ccguard.dll.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/ccguard.dll
27.11.2007 12:56:37 - #6: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/ccprofil.dll.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/ccprofil.dll
27.11.2007 12:56:38 - #7: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/preupd.exe.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/preupd.exe
27.11.2007 12:56:38 - #8: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/xp/avgntflt.sys.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/xp/avgntflt.sys
27.11.2007 12:56:39 - #9: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/classic-nt/build.dat.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\classic-nt/build.dat
27.11.2007 12:56:39 - #10: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/classic-nt/ccplg.xml.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\classic-nt/ccplg.xml
27.11.2007 12:56:40 - #11: Downloading and extracting http://dl6.avgate.net/upd/vdf/antivir0.vdf.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir0.vdf
27.11.2007 12:57:03 - #12: Downloading and extracting http://dl6.avgate.net/upd/vdf/antivir1.vdf.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir1.vdf
27.11.2007 12:57:09 - #13: Downloading and extracting http://dl6.avgate.net/upd/vdf/antivir2.vdf.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir2.vdf
27.11.2007 12:57:13 - #14: Downloading and extracting http://dl6.avgate.net/upd/vdf/antivir3.vdf.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir3.vdf
27.11.2007 12:57:14 - #15: Downloading and extracting http://dl6.avgate.net/upd/engine/avewin32.dll.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\engine\avewin32.dll
27.11.2007 12:57:17 - #16: Downloading and extracting http://dl6.avgate.net/upd/winwks/en/basic-nt/avipbb.sys.gz to C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/avipbb.sys
27.11.2007 12:57:29 - Service AVEService is not installed

27.11.2007 12:57:29 - Service AntiVirMailService is not installed

27.11.2007 12:57:29 - Initialize fwinst.exe

27.11.2007 12:57:29 - Initialize fwinst.exe

27.11.2007 12:57:29 - Service AntiVirFirewallService is not installed

27.11.2007 12:57:29 - Service antivirwebservice is not installed

27.11.2007 12:57:29 - Status of service AntiVirService is running

27.11.2007 12:57:29 - Initialize avgnt.exe

27.11.2007 12:57:29 - Status of service AntiVirScheduler is running

27.11.2007 12:57:29 - Minifilter is installed

27.11.2007 12:57:29 - Minifilter is possible

27.11.2007 12:57:29 - Initialize avscan.exe

27.11.2007 12:57:29 - Initialize avconfig.cpl

27.11.2007 12:57:29 - Initialize avcenter.exe

27.11.2007 12:57:29 - shell extension is installed

27.11.2007 12:57:29 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

27.11.2007 12:57:29 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

27.11.2007 12:57:29 - Service AVEService is not installed

27.11.2007 12:57:29 - Service AntiVirMailService is not installed

27.11.2007 12:57:29 - Initialize fwinst.exe

27.11.2007 12:57:29 - Initialize fwinst.exe

27.11.2007 12:57:29 - Service AntiVirFirewallService is not installed

27.11.2007 12:57:29 - shell extension is installed

27.11.2007 12:57:29 - Initialize regsvr32.exe

27.11.2007 12:57:29 - shell extension removed successfully

27.11.2007 12:57:29 - avgnt.exe closed.

27.11.2007 12:57:29 - Status of service AntiVirScheduler is running

27.11.2007 12:57:30 - Service AntiVirScheduler successfully stopped

27.11.2007 12:57:30 - Status of service AntiVirService is running

27.11.2007 12:57:31 - Service AntiVirService successfully stopped

27.11.2007 12:57:31 - Starting to install
27.11.2007 12:57:31 - Processing module SELFUPDATE Source: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:32 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\SelfUpdateTemp\update.exe --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}".Self Update helper
27.11.2007 12:57:36 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:36 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.11.2007 12:57:36 - Temp Directory: C:\WINDOWS\TEMP\Update_Temp\
27.11.2007 12:57:36 - Avira AntiVir PersonalEdition Classic

27.11.2007 12:57:36 - Self update: Copying file C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt/updlib.dll to C:\Program Files\Avira\AntiVir PersonalEdition Classic\updlib.dll
27.11.2007 12:57:36 - Executing original update application
27.11.2007 12:57:36 - Current Direcory:C:\Program Files\Avira\AntiVir PersonalEdition Classic, About to execute C:\Program Files\Avira\AntiVir PersonalEdition Classic\update.exe  --config-file="C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\update.conf" --install-path="C:\Program Files\Avira\AntiVir PersonalEdition Classic" --log-template="${DAY}.${MONTH}.${YEAR} ${HOUR}:${MINUTE}:${SECOND} - ${MSG}"  --NoSelfUpdate "--TmpDir=C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8" "--LogFile=C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\LOGFILES\Upd-2007-11-27-12-55-52.log" "--TmpFilesList=C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\ToRemove.txt".Executing original update application
27.11.2007 12:57:36 - Installation Directory: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:36 - Backup Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.11.2007 12:57:36 - Temp Directory: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\
27.11.2007 12:57:37 - Start the Update GUI... Displaymode: 0

27.11.2007 12:57:37 - Avira AntiVir PersonalEdition Classic

27.11.2007 12:57:37 - Master IDX file has changed
27.11.2007 12:57:37 - File basic-nt/2k/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/avadmin.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/avgio64.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/imp64b.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/psapi.dll's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/shlext64.dll's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/wsctool.exe's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/xp64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/2k/avgntdd.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/2k/avgntmgr.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/nt/avgntdd.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/nt/avgntmgr.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - File basic-nt/vista64/avgntflt.sys's operating system doesn't match the current one. File ignored.
27.11.2007 12:57:37 - Downloading the product.info file from http://dl4.avgate.net/upd/idx/vdf.info.gz
27.11.2007 12:57:37 - Downloading the product.info file from http://dl4.avgate.net/upd/idx/specvir-nt.info.gz
27.11.2007 12:57:37 - Downloading the product.info file from http://dl4.avgate.net/upd/idx/engine.info.gz
27.11.2007 12:57:37 - Downloading the product.info file from http://dl4.avgate.net/upd/idx/engine-nt-en.info.gz
27.11.2007 12:57:37 - Module: SELFUPDATE Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 15
27.11.2007 12:57:37 - Module: MAIN Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 75
27.11.2007 12:57:37 - Module: COMMAPPDATA Source: winwks\en\ Destination: C:\Documents and Settings\All Users\Application Data\ Files: 1
27.11.2007 12:57:37 - Module: TEXT Source: winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 3
27.11.2007 12:57:38 - Module: VDF Source: vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 4
27.11.2007 12:57:38 - Module: AVREP_NT Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
27.11.2007 12:57:38 - Module: ENGINE Source: engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 2
27.11.2007 12:57:38 - Module: ENGINE_NT_EN Source: engine
t\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\ Files: 1
27.11.2007 12:57:38 - Module: DRV Source: winwks\en\ Destination: C:\WINDOWS\SYSTEM32\drivers\ Files: 4
27.11.2007 12:57:38 - Minifilter is installed

27.11.2007 12:57:38 - Minifilter is possible

27.11.2007 12:57:38 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | FilterType

27.11.2007 12:57:38 - Preparing to download files
27.11.2007 12:57:38 - 15 files need to be downloaded / copied from http://dl4.avgate.net/upd/
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\avcenter.exe.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\avgnt.exe.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\avguard.exe.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\ccguard.dll.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\ccprofil.dll.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\preupd.exe.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\xp\avgntflt.sys.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\classic-nt\build.dat.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\classic-nt\ccplg.xml.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:38 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir0.vdf.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir1.vdf.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir2.vdf.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\antivir3.vdf.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\engine\avewin32.dll.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - File C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\basic-nt\avipbb.sys.gz already exists in temporary folder and it will not be downloaded again
27.11.2007 12:57:39 - Starting to install
27.11.2007 12:57:39 - Processing module MAIN Source: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:44 - Processing module VDF Source: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\vdf\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:50 - Processing module ENGINE Source: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\engine\ Destination: C:\Program Files\Avira\AntiVir PersonalEdition Classic\
27.11.2007 12:57:51 - Processing module DRV Source: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_474c05c8\winwks\en\ Destination: C:\WINDOWS\SYSTEM32\drivers\
27.11.2007 12:57:51 - A total of 15 files were updated
27.11.2007 12:57:51 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |UpdateInProgress

27.11.2007 12:57:51 - Minifilter is installed

27.11.2007 12:57:51 - Minifilter is possible

27.11.2007 12:57:51 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |FilterType

27.11.2007 12:57:51 - Service AVEService is not installed

27.11.2007 12:57:51 - Service AntiVirMailService is not installed

27.11.2007 12:57:51 - Initialize fwinst.exe

27.11.2007 12:57:51 - Initialize fwinst.exe

27.11.2007 12:57:51 - Service AntiVirFirewallService is not installed

27.11.2007 12:57:51 - Service antivirwebservice is not installed

27.11.2007 12:57:51 - Status of service AntiVirService is stopped

27.11.2007 12:57:51 - Initialize avgnt.exe

27.11.2007 12:57:51 - Status of service AntiVirScheduler is stopped

27.11.2007 12:57:51 - Minifilter is installed

27.11.2007 12:57:51 - Minifilter is possible

27.11.2007 12:57:51 - Initialize avscan.exe

27.11.2007 12:57:51 - Initialize avconfig.cpl

27.11.2007 12:57:51 - Initialize avcenter.exe

27.11.2007 12:57:51 - shell extension is installed

27.11.2007 12:57:51 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

27.11.2007 12:57:51 - Reading registry value successful: Software\Avira\AntiVir PersonalEdition Classic | RootkitsInstalled

27.11.2007 12:58:03 - Service AntiVirService successfully started

27.11.2007 12:58:03 - Starting avgnt.exe successful

27.11.2007 12:58:04 - Service AntiVirScheduler successfully started

27.11.2007 12:58:04 - shell extension is installed

27.11.2007 12:58:04 - Initialize regsvr32.exe

27.11.2007 12:58:05 - installation of shell extension successful

27.11.2007 12:58:05 - Cannot start the service antivirwebservice

27.11.2007 12:58:05 - Dialup: 0

27.11.2007 12:58:05 - Downloaded bytes: 0

27.11.2007 12:58:05 - Downloaded file(s): 0

27.11.2007 12:58:05 - Downloaded file(s): N/A

27.11.2007 12:58:05 - Engine version local   : 7.6.0.5

27.11.2007 12:58:05 - Engine version internet: N/A

27.11.2007 12:58:05 - 0. VDF version local   : 6.35.0.1

27.11.2007 12:58:05 - 0. VDF version internet: N/A

27.11.2007 12:58:05 - 1. VDF version local   : 6.39.0.129

27.11.2007 12:58:05 - 1. VDF version internet: N/A

27.11.2007 12:58:05 - 2. VDF version local   : 6.39.1.43

27.11.2007 12:58:05 - 2. VDF version internet: N/A

27.11.2007 12:58:05 - 3. VDF version local   : 6.39.1.51

27.11.2007 12:58:05 - 3. VDF version internet: N/A

27.11.2007 12:58:05 - Required time: 00:29

27.11.2007 12:58:05 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |LastUpdate

27.11.2007 12:58:06 - Update finished successfully

marina · Answer

re 


voila tout est installer et la sa scanne je te met le rapport des que ses fini enfin ver 16h30 car la je part au travail tres en retard  a tout a l heure tu me dirra se que je doit supprimer restaurer etc...

g!rly · Answer

marina 


effectue un scan 

regarde ceci pour te guider :

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

@+

marina · Answer

c est normal que je ne voie aucune image la seule chose que je voie ses un carree avec une croix a la place des images ???? sinon j aie fait les parametres comme l explique se site 

http://www.tutopat.com/viewtopic.php?t=2417

g!rly · Answer

tu ne dois pas accepter les cookies

va dans panneau de configuration > option internet > protection des données et regle le curseur sur moyen...

marina · Answer

me revoila je ne voie toujours pas les images et j aie fait se que tu ma dit mais ses peut etre parce que je n aies pas restaurer le registres ???? 

voila le rapport de antivir 



AntiVir PersonalEdition Classic
Report file date: mardi 27 novembre 2007  13:02

Scanning for 943200 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         ANNA
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 11:57:49
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 11:57:49
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 11:57:50
ANTIVIR3.VDF : 7.0.1.11      38400 Bytes  27/11/2007 11:57:50
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  27/11/2007 11:57:51
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 27 novembre 2007  13:02

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'LaunchPd.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CookiePatrol.exe' - '1' Module(s) have been scanned
Scan process 'PPControl.exe' - '1' Module(s) have been scanned
Scan process 'PPMemCheck.exe' - '1' Module(s) have been scanned
Scan process 'E_S4I0F2.EXE' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Mixer.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'incdsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
46 processes with 46 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'A:\'
      [NOTE]      In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '44' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\ANNA\Mes documents\Mes fichiers reþus\aswclnr.exe
      [DETECTION] Contains detection pattern of the worm WORM/Agent.CT
      [INFO]      The file was moved to '47c30c39.qua'!
C:\Program Files\a-squared Free\Quarantine\3918A08809263020BBB65C20A6FA9CCD969D7338.a2q
  [0] Archive type: ZIP
  --> System Volume Information/_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}/RP1171/A0213698.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      The file was moved to '477d1012.qua'!
C:\Program Files\a-squared Free\Quarantine\B7B61F8E2243E60B4F2360910F7350579CF2A01A.a2q
  [0] Archive type: ZIP
  --> WINDOWS/system32/awttrpn.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.dlu
      [INFO]      The file was moved to '478e1027.qua'!
C:\Program Files\a-squared Free\Quarantine\C9D0CACB7551C875077C4D1B5F346B36310EF0D4.a2q
  [0] Archive type: ZIP
  --> WINDOWS/system32/awttrpn.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.dlu
      [INFO]      The file was moved to '4790102d.qua'!
C:\Program Files\a-squared Free\Quarantine\FE320497F841CE83EA3346A9F045208B5FE1828E.a2q
  [0] Archive type: ZIP
  --> WINDOWS/system32/whffeuyf.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '477f105f.qua'!
C:\Program Files\Satsuki Decoder Pack\wmv\WMVPostpross.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was moved to '47a21c78.qua'!
C:\WINDOWS\system32\unpr.sys
      [DETECTION] Is the Trojan horse TR/Killav.CN.3
      [INFO]      The file was moved to '47bc215c.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ilsqvvyi.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47bf21dc.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\murnqpsp.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47be21e6.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\soxeqqrx.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AX
      [INFO]      The file was moved to '47c421e0.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\ydsrbxvb.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      The file was moved to '47bf21d5.qua'!
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le volume ne contient pas de système de fichiers connu. Vérifiez si tous les pilotes de système
de fichiers nécessaires sont chargés et si le volume n'est pas endommagé.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: mardi 27 novembre 2007  14:53
Used time:  1:51:18 min

The scan has been done completely.

   7605 Scanning directories
 400340 Files were scanned
     11 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     11 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 400329 Files not concerned
   2657 Archives were scanned
      1 Warnings
      1 Notes

g!rly · Answer

ok

vide la quarantaine d´antivir et refais un sacn et post le rapport ici stp

marina · Answer

voila le rapport que dois je faire maintenand 





AntiVir PersonalEdition Classic
Report file date: mardi 27 novembre 2007  16:16

Scanning for 943200 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         ANNA
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 11:57:49
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 11:57:49
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 11:57:50
ANTIVIR3.VDF : 7.0.1.11      38400 Bytes  27/11/2007 11:57:50
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  27/11/2007 11:57:51
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Use file extension list
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mardi 27 novembre 2007  16:16

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'LaunchPd.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'CookiePatrol.exe' - '1' Module(s) have been scanned
Scan process 'PPControl.exe' - '1' Module(s) have been scanned
Scan process 'PPMemCheck.exe' - '1' Module(s) have been scanned
Scan process 'E_S4I0F2.EXE' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Mixer.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'incdsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
46 processes with 46 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'A:\'
      [NOTE]      In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '44' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le volume ne contient pas de système de fichiers connu. Vérifiez si tous les pilotes de système
de fichiers nécessaires sont chargés et si le volume n'est pas endommagé.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: mardi 27 novembre 2007  17:50
Used time:  1:34:18 min

The scan has been done completely.

   7547 Scanning directories
 285126 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 285126 Files not concerned
   2642 Archives were scanned
      1 Warnings
      1 Notes

et mille merci encord marina

marina · Answer

re je te laisser le temps de faire manger ma petite famille , je tenais g!rly a te remercier et j espere que tu pourras me dire les etapes a faire pour 

1 = tous se qui et dossier otmoveit 
                                          deckard
                                          deckard 2
                                          qoobox
                                          qoobox 2
                                          vundofix backups
                                          config.msi
                                          msocache
                                          + tous les documents texte
                          tous sa sa se trouve dans c:/

2 = tous se qui est prog = hijacthis 
                                          cobifix
                                          comboscan = dss exe 
                                          otmeveit exe
                                          fix.reg
                                          marina.reg
                                          marina.rar
                     tous sa se trouve sur le bureaux + tous les rapport 

3 ensuite dois je restaurer le registres que j avais sauvarder lors du scane de hijacthis 

et ensuite je voulais te demander avant j arriver a voire les films de l ordi sue la tele et la quand je fait clique droit sur le bureau = propriete d affichage= parametre =avances = affichage = la je tombe sur la page ou il a le moniteur , la tele  etc... et bien avant j arriver a cliquer sur la tele et la rien sa reste gris je ne peu rien faire , voila merci d avance , et pour les images que tu ma dit que s etais un reglage de cookies et bien j aie fait se que tu m avais dit et rien sa na pas fonctionner , voia ja pense que je n est rien oublier mais je serrais de retour ver 22h 30 ,23 h le temps de border tous le monde merci et tout a l heure je te donner un dolipranne meme 2 si tu veut merci d avance a tout a l heure marina

marina · Answer

g!rly tu est la ?????

marina · Answer

"pour ce qui est de ca resolu = je voulais te demander avant j arriver a voire les films de l ordi sue la tele et la quand je fait clique droit sur le bureau = propriete d affichage= parametre =avances = affichage = la je tombe sur la page ou il a le moniteur , la tele etc... et bien avant j arriver a cliquer sur la tele et la rien sa reste gris je ne peu rien faire ," c etais mon fils qui etais mal connecter j aie honte pardon parcontres pour ce qui des aurtres truc s sa serrais sympa de m aider merci marina

marina · Answer

re bonsoir je n est plus aucun peripherique qui fonctionne  quand je vais dans propriete de sons tous et gris que je ne peu rien changer sa dit aucun peripherique audio ni sons ni voix enfin plus rien , mais lecteur ne fonctionne pls ni power dvd ni lecteur windows enfin rien ne fonctionne , s il te plait ne m abandonne pas merci d avance marina a +++

g!rly · Answer

salut marina,

oui tu peux supprimer tous ca :

msnfix
hijack this
ot_move it + les back up
vundofix + back up
combofix + back up
comboscan = dss exe
fix.reg
marina.reg
marina.rar 
deckard
deckard 2
qoobox
qoobox 2

ensuite dois je restaurer le registres que j avais sauvarder lors du scane de hijacthis
NON !!!

depuis quand as tu ce probleme de peripherique audio?

marina · Answer

hier mais apres tous se que l on a fait car j entendais un petit bip de antiviris quand il avait trouve les virus et la hier soir je voulais ecouter de la musique en meme temps que je te parlais et la plus rien ni image ni sons ni webcam  plus de lecteur plus rien , enfin lecteur plus que un quei fonctionne le vlc mais pas de sons voila a tout a l heure je serrais ver  10h 30 merci a tout a l heure marina

g!rly · Answer

salut marina,

si tu va dans demarrer>panneau de configuration>outil system>gestionnaire de peripherique

tu devrais voire quels peripheriques sont absent 

puis regarde ceci pour te guider :

https://support.microsoft.com/fr-fr/help/283658

dis moi quoi

@+

marina · Answer

http://img508.imageshack.us/img508/9839/capture01gp7.jpg



voici  mon gestionnaire de peripherique quend je clique dessus et je fait mise a jour dans celui de audion sons sa me dit que il n y a rien de mieux que ce installer mais rien ne fonctionne ni ma webcamme quand je vut la faire fonctionner voila le message que j aie comme message merci d avance si tu a une solution marina 

http://img413.imageshack.us/img413/791/capture02zr3.jpg

g!rly · Answer

re,

appuie sur le petit plus a coté de tes peripheriques pour developper, si tu voie des triangles jaunes avec un point d´exclamation c´est que le peripherique est absent...

dis moi quoi

@+

marina · Answer

je viens de cliquer sur tous il n y a ps de triangle jaune il  n y a rien normal , sa ne viens pas peut etre que je n est pas supprimer le fichier de sauvegarde du registre ???

g!rly · Answer

tu as le cd d´installation de windows?
non ca ne vien pas du fichier de sauvegarde du registre

marina · Answer

non le magasin pms informatique ne me la jamais donner

marina · Answer

http://img440.imageshack.us/img440/1471/capture01fr0.jpg



et la j aie sa quand je demarre mon pc sa viens de la ????

g!rly · Answer

je ne sais pas ce que signifie ce message,
c´est bien embetant ca que tu n´es pas le cd de windows, tu ne peux pas aller au magasin que tu site pour l´avoir, car ils auraient du te le donner
@+

marina · Answer

gros pb sa fait 2 ans qu il a fermer

g!rly · Answer

ah oui je voie...
je seche litterallement
je ne voie pas comment resoudre ce probleme

marina · Answer

je viens de faire une restauration systeme a lundi apres installation de tous le pb que tu m avait dit et la tous refonctionne le seul hik srs que avast et revenue donc je le supprimerais en faisans f8 et la pour plus de securite je suis entrain de scanner avec antivir voire qui n y est rien qui sois revenue , je te tiens au courant tout a l heure des que ses fini merci d avance marina 


puis je supprimer le dossier de sauvegarde de registre ou je dois le conserver ???

Utilisateur anonyme · Answer

bonjour vous avez 2 virus tres puissant  1-( not-a-virus : adware.win32.virtumonde.aps ) 2-( cheval de troie- trojan.win32.obFuscated.KP ) ne télécharger rien ne fais rien ok il ya une seul soulition pour supremer les 2  virus puissant ok telecharger bitdefender interent security  ou windows live onecare parceque j'avais le meme probleme que vous et c t regler a 100%1000 avec les deux antivirus ok

g!rly · Answer

marina,

esperons que l´infection n´est pas revenue...

post le rapport d´antivir

@+

Utilisateur anonyme · Answer

ecoute bien vous etes infecte par les 2 virus juska maitenant vous avez rien supprimer et vous etes toujours infecter fais un scan online avec bitdefender vous trouver plein de fichier infecter fais le parceque j'avais le meme probleme que vous merci

g!rly · Answer

bandji

arrete de dire des conneries stp

Utilisateur anonyme · Answer

c la verite c pas des conneries ok fais le scane online avec bitdefender vous trouver plein de choses  bye

marina · Answer

bonjour bandji mais excuce moi mais jusqu a present je ne t aie pas bcp vue les seul son jlpjlp et surtout g!rly donc ne m en veut pas , g!rly je suis entrain de refaire un 2eme scanne pour etre sur mais pour le moment rien des que s est fini je te met le rapport a tout a l heure marina sa prend au moins 2h donc a toute  a l heure

g!rly · Answer

ok marina
@+

marina · Answer

AntiVir PersonalEdition Classic
Report file date: 2007-11-28  21:40

Scanning for 949143 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  2007-09-19 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  2007-08-23 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  2007-08-16 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  2007-08-14 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  2007-07-18 11:57:49
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  2007-09-13 11:57:49
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  2007-11-23 11:57:50
ANTIVIR3.VDF : 7.0.1.17     118784 Bytes  2007-11-28 15:17:42
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  2007-11-28 15:17:43
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  2007-02-26 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  2007-07-18 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  2007-04-16 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  2007-08-03 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  2007-07-18 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  2007-07-18 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  2007-03-08 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  2007-08-07 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  2007-08-21 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  2007-07-23 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Use file extension list
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 2007-11-28  21:40

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'E_S4I0F2.EXE' - '1' Module(s) have been scanned
Scan process 'LaunchPd.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CookiePatrol.exe' - '1' Module(s) have been scanned
Scan process 'PPControl.exe' - '1' Module(s) have been scanned
Scan process 'PPMemCheck.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Mixer.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'incdsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
49 processes with 49 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '38' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Program Files\Satsuki Decoder Pack\wmv\WMVPostpross.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      A backup was created as '47a3e1a1.qua'  ( QUARANTINE )
C:\Program Files\SecCenter\scprot4.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '47bde1b7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1174\A0213840.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe331.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1175\A0213947.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe337.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1175\A0214060.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe33b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1175\A0214076.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe33c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1175\A0214091.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe33d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1175\A0214107.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '460085b6.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1183\A0214529.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe351.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1184\A0214542.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe352.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1184\A0214566.exe
      [DETECTION] Is the Trojan horse TR/Dialer.VUY.4
      [INFO]      A backup was created as '477fe353.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1184\A0214567.exe
      [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
      [INFO]      A backup was created as '460085dc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0216559.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe357.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0216560.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085d0.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0216562.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe359.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217543.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe358.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217544.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085d2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217545.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe35b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217546.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085d4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217548.exe
      [DETECTION] Is the Trojan horse TR/Click.Costrat.BY
      [INFO]      A backup was created as '477fe35d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0217555.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe35a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0218547.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085d6.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0218548.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe35f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0218549.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085e8.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1185\A0218555.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe35c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218562.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe35e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218568.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085d7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218569.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe350.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218570.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe361.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218578.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ea.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218604.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe360.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218605.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe363.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218606.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ec.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0218607.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe365.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0219604.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe362.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0219605.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085eb.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0219606.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe364.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1186\A0219607.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ee.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1187\A0219622.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe367.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1187\A0219623.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ed.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1187\A0219624.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe366.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1187\A0219625.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ef.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1187\A0219632.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe378.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219661.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219662.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe37a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219663.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219664.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085e0.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219679.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe369.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219727.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe36a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219728.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085e3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219729.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe36c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219733.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe36b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219738.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085e4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219741.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085e5.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219742.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe36e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219785.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085e7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219786.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085e9.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219787.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe36f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219788.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f8.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219795.exe
      [DETECTION] Is the Trojan horse TR/Click.Costrat.BY
      [INFO]      A backup was created as '477fe371.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219796.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe370.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219797.exe
      [DETECTION] Contains detection pattern of the worm WORM/Ntech.P
      [INFO]      A backup was created as '460085f9.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219802.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      A backup was created as '477fe372.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219803.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085fa.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219804.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe373.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219808.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085fb.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219811.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe374.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219814.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085fd.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0219817.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '460085fc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0220787.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe375.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0220788.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe376.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0220789.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085ff.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0220790.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe088.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221782.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008601.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221783.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085fe.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221784.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe377.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221785.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f0.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221799.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe08a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221822.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe379.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221823.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221824.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe37b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1188\A0221825.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe37c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221832.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221833.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe37d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221834.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f5.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221835.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe37e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221838.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '460085f7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1189\A0221839.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '460085f6.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1190\A0222108.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe388.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1190\A0222109.exe
      [DETECTION] Contains detection pattern of the worm WORM/PoeBot.IN
      [INFO]      A backup was created as '46008501.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1191\A0222430.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.593920
      [INFO]      A backup was created as '477fe397.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1191\A0222449.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe398.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222790.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.593920
      [INFO]      A backup was created as '477fe3a6.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222809.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3a7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222822.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008520.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222823.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3a8.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222824.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008521.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1192\A0222825.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3aa.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222840.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008523.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222841.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3ac.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222842.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008525.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222844.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3ae.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222872.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3ad.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222873.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008526.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222912.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3af.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222913.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008538.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222917.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3b0.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222920.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008539.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222923.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3b1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222926.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '4600853a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222930.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3b3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222941.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3b2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0222942.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '4600853b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223077.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3ba.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223078.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008533.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223079.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3bc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223080.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008535.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223087.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3bb.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223088.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008534.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223089.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3be.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1193\A0223094.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008537.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223116.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3bd.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223117.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008536.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223118.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3b4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223119.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600853d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223185.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3c1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223188.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3c2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223191.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '4600854b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223194.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3c4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223198.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3c3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223209.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600854c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223210.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '4600854d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223346.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3ca.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223347.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008543.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223348.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3cc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223349.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3cb.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223355.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008544.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223358.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3cd.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223361.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '46008545.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1194\A0223364.exe
      [DETECTION] Contains detection pattern of the Windows virus W32/Virut.AX
      [INFO]      A backup was created as '477fe3ce.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223388.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008546.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223389.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3cf.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223390.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008547.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223391.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3c0.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223472.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3d1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223483.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3d2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223484.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '4600855b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223620.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223621.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600856b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223622.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1195\A0223623.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600856c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1196\A0223631.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e4.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1196\A0223632.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600856d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1196\A0223633.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e6.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1196\A0223634.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600856f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0223638.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e5.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0223639.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600856e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0223640.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e7.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0223641.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3f8.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0224615.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008571.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0224616.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008560.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0224617.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e9.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1197\A0224618.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008562.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224620.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3e8.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224621.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3eb.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224622.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008564.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224623.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3ed.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224654.dll
      [DETECTION] Is the Trojan horse TR/Vundo.DQE
      [INFO]      A backup was created as '477fe3f1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224655.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AX
      [INFO]      A backup was created as '477fe3f2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224656.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '4600857b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224856.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe3fa.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224867.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008573.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0224868.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '477fe3fc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0226003.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe401.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0226004.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe402.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0226005.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600828b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0226006.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe404.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0226999.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe403.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0227000.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600828c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0227001.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe405.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1198\A0227002.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '4600828e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227015.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe40b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227016.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe40c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227017.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46008285.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227018.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe40e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227026.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe40d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227050.dll
      [DETECTION] Is the Trojan horse TR/Vundo.DQE
      [INFO]      A backup was created as '46008287.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227051.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AX
      [INFO]      A backup was created as '477fe400.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227052.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46008289.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227244.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe415.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227255.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '477fe416.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227390.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe41c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227392.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46e14a2d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227393.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe41d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227394.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '46e14a2e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227401.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '477fe41f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227402.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      A backup was created as '477fe41e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227405.dll
      [DETECTION] Is the Trojan horse TR/Vundo.DQE
      [INFO]      A backup was created as '46e14a2f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227406.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      A backup was created as '46e14a31.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1199\A0227408.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      A backup was created as '46e14a10.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1200\A0228956.exe
      [DETECTION] Contains detection pattern of the worm WORM/PoeBot.IN
      [INFO]      A backup was created as '477fe430.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1200\A0228958.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a01.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1205\A0229181.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      A backup was created as '477fe43d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1207\A0229275.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '477fe444.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230493.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe452.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230495.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a63.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230583.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe456.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230584.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a67.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230587.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe457.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230625.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe45a.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230627.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a6b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1211\A0230628.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe45c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0230783.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe462.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0230785.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a53.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0230863.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe466.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0230864.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14a57.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0230867.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe468.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1212\A0231120.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      A backup was created as '477fe46c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1213\A0233255.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      A backup was created as '477fe478.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0233310.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      A backup was created as '477fe47c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0233311.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [INFO]      A backup was created as '477fe47d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0233314.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XDR.Gen
      [INFO]      A backup was created as '46e14a4e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0233316.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [INFO]      A backup was created as '477fe47f.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0234233.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Zlob.Gen
      [INFO]      A backup was created as '477fe47e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1215\A0234300.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      A backup was created as '477fe481.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1216\A0235362.sys
      [DETECTION] Is the Trojan horse TR/Rootkit.Gen
      [INFO]      A backup was created as '477fe485.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236381.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe48b.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236382.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      A backup was created as '46e14abc.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236383.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe48d.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236384.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '46e14abe.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236385.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe48c.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236386.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      A backup was created as '46e14abd.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1218\A0236387.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      A backup was created as '477fe48e.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1219\A0236406.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      A backup was created as '46e14abf.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1219\A0236433.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe490.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239150.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      A backup was created as '477fe4b1.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239151.sys
      [DETECTION] Is the Trojan horse TR/Killav.CN.3
      [INFO]      A backup was created as '46e14a82.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239152.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '477fe4b3.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239153.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '46e14a84.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239154.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AX
      [INFO]      A backup was created as '477fe4b2.qua'  ( QUARANTINE )
C:\System Volume Information\_restore{F83C86E5-A660-4AAF-A8AB-89059C4CB1AD}\RP1228\A0239155.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen
      [INFO]      A backup was created as '46e14a83.qua'  ( QUARANTINE )
C:\WINDOWS\system32\ilsqvvyi.dll
      [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen

Utilisateur anonyme · Answer

alors je vous avez dit que vous avez plein de choses vous avez plus de  22 fichier infecter ecoute bien vous avez que bitdefender ou windows live onecare qui peux suppremer les 2 virus puissant ou vous formater votre pc parceque d c  20 jour votre pc ne demarre meme pas ok et vous avez pas le choix

Utilisateur anonyme · Answer

votre base de registre et infecter vous avez plus de 450 CLés et sous clés infecter  paraport au fichier windows32  les 2 virus  puissant que entrain de changer la base de registre ( cles et sous cles )  et vous avez plus de 22 fichier  de windows 32 infecter

marina · Answer

bandji pour que tu ne dise pas que je t ecoute pas j aie fait un scane avec bitdefender et rien il na trouver aucun virus voila donc je en comprend pas le rapport de antivir , parcontre g!rly j aie du desinstaller antivir et remettre avast car ses lui qui m avait tous supprimer ou alors il y a eut un pb car la preuve la il ma trouver 247 virus et il n arreter de faire des bip sans arret en me disant quarantaine ou supprimer excetera, enorme non si tu veut toujours m aider je suis la a reecouter t aie conseille merci d avance marina

jalobservateur · Answer

Allo  marina,
Je ne veux pas intervenir plus que je le ferai là ok 
Tu as fais une erreur de supprimer Antivir!
Il ne chiale pas pour rien crois-le !
Avast tu oublies ok.
Remets Antivir en vitesse et pour lui calmer les nerfs, regardes bien ou sont la plupart de tes virus !!!
----------------------------
C:\System Volume Information\_restore
Tu dois désactiver la restoration du systême.
Tu as de graves infections.
Quand la quantité de virus sera sous contrôle, tu créeras un point de restoration ,mais attend G!rly ou jlpjlp ok.

TR/Dldr.ConHook.Gen  Ceci peut foutre en l'air ta machine et Antivir l'avait emprisonné.
Alors fais ceci.
Et attends le retour des helpers.
Jal

Utilisateur anonyme · Answer

marina vous avez rien suppremer ni avec avast ni avec antivir pour les 2 virus puissant ok  je sais tres bien pourquoi que vous n'avais rien suppremer ( vous avez 2 virus tres tres tres puissant ils ont infecter la base de registre ) et votre C:\WINDOWS\system32

g!rly · Answer

marina,

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique. 

post un nouveau comfix stp

@+

marina · Answer

AntiVir PersonalEdition Classic
Report file date: 2007-11-29  12:00

Scanning for 953069 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  2007-09-19 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  2007-08-23 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  2007-08-16 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  2007-08-14 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  2007-09-13 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  2007-11-23 08:31:47
ANTIVIR3.VDF : 7.0.1.21     163840 Bytes  2007-11-29 08:47:48
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  2007-11-29 08:31:49
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  2007-02-26 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  2007-07-18 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  2007-04-16 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  2007-08-03 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  2007-07-18 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  2007-07-18 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  2007-03-08 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  2007-08-07 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  2007-08-21 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  2007-07-23 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 2007-11-29  12:00

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'E_S4I0F2.EXE' - '1' Module(s) have been scanned
Scan process 'LaunchPd.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CookiePatrol.exe' - '1' Module(s) have been scanned
Scan process 'PPControl.exe' - '1' Module(s) have been scanned
Scan process 'PPMemCheck.exe' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Mixer.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'incdsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
46 processes with 46 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'A:\'
      [NOTE]      In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '37' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: 2007-11-29  13:55
Used time:  1:55:25 min

The scan has been done completely.

   7650 Scanning directories
 375824 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 375824 Files not concerned
   3037 Archives were scanned
      1 Warnings
      1 Notes

g!rly · Answer

bon ca a l´air ok ;-)
comment ca va de ton coté?

marina · Answer

pardon je n avais pas vue que tu m avez demander un combifix voila le rapport , sinon sa a l air d aller je ne sais pas se qui ses passer quand antivir avez trouvez 247 virus donc je l avez enlever mais se matin se que j aie fait ses qu il me rester le symbole d avast encord donc j aie demarrer en mode echec et la je me suis apercu qu il etait mal supprimer , donc je les fait comme il faut j aie reintaller antivir il en a trouver 8 que j aie supprimer dans la quarentaine et j aie rescaner et tous aller bien , parcontre pendant le scanne de combofix il y a eut de alerte comme quoi il avait stoper un win 32 je ne me rappel plus se qui suiver mais c etais pour envoyer je ne sais pas ou donc j aie autoriser , j espere que j aie bien fait ?????merci pour tous et surtout de ta patience marina it moi si sa te parer tous bon ??? ComboFix 07-11-19.4C - ANNA 2007-11-29 16:50:19.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.227 [GMT 1:00] Running from: C:\Documents and Settings\ANNA\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\SecCenter C:\Program Files\smante~1 C:\Program Files\smante~1\S?mantec\ . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-28 to 2007-11-29 )))))))))))))))))))))))))))))))))))) . 2007-11-29 09:29 d-------- C:\Program Files\Avira 2007-11-29 01:25 d-------- C:\WINDOWS\BDOSCAN8 2007-11-29 01:20 d-------- C:\Program Files\BitDefender 2007-11-29 00:09 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-29 00:09 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-28 14:47 d-------- C:\WINDOWS\AU_Temp 2007-11-28 00:11 d-------- C:\Program Files\SLD CODEC PACK 1(3).5 2007-11-27 23:28 334 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-11-27 12:42 d-------- C:\Program Files\Sunbelt Software 2007-11-26 23:29 467,632 --a------ C:\WINDOWS\system32\perfh040.dat 2007-11-26 23:29 74,326 --a------ C:\WINDOWS\system32\perfc040.dat 2007-11-26 20:39 d-------- C:\Program Files\Trend Micro 2007-11-26 17:09 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-26 17:09 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-26 17:09 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-26 17:09 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-26 17:08 d-------- C:\Program Files\Spyware Doctor 2007-11-26 13:06 143 --a------ C:\WINDOWS\system32\mcrh.tmp 2007-11-24 14:01 1,352,957 ---hs---- C:\WINDOWS\system32\hnhkavvt.ini 2007-11-22 17:18 1,004,368 ---hs---- C:\WINDOWS\system32\pgykbnbu.ini 2007-11-22 17:08 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-18 18:55 737,138 ---hs---- C:\WINDOWS\system32 iojyxbp.ini 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Modèles 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-12 18:21 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Favoris 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-12 14:51 582,995 ---hs---- C:\WINDOWS\system32\qkbqbdcs.ini 2007-11-12 13:54 d-------- C:\Program Files\Runtime Software 2007-11-12 10:56 1,024 --a------ C:\WINDOWS\system32\drivers\DCF1518D-AE04-44E5-A398-2B2579435BD4.cxv 2007-11-12 10:22 10,240 --a------ C:\WINDOWS\system32\drivers\63C1D9DE-045B-4F3E-A220-8CAB6453DA8F.cxv 2007-11-12 10:18 d-------- C:\Program Files\STOPzilla! 2007-11-12 10:18 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2007-11-12 02:29 d-------- C:\Program Files exunuxy 2007-11-12 02:21 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-12 01:39 d-------- C:\Documents and Settings\ANNA\Application Data\PC Tools 2007-11-10 02:36 d-------- C:\Program Files\RegCleaner 2007-11-10 02:06 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-11-10 01:22 d-------- C:\Documents and Settings\ANNA\Application Data\MSNInstaller 2007-11-10 01:14 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2007-11-10 01:03 d-------- C:\Program Files\Microsoft Windows OneCare Live 2007-11-10 00:39 d-------- C:\Program Files\Windows Live 2007-11-10 00:39 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-11-10 00:39 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-11-09 01:08 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-09 00:32 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-11-09 00:32 267,845 --a------ C:\WINDOWS sc.exe 2007-11-09 00:31 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-11-09 00:31 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-11-09 00:31 69,689 --a------ C:\WINDOWS\UNZIP.DLL . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 15:47 --------- d-----w C:\Program Files\Wanadoo 2007-11-29 15:47 --------- d-----w C:\Program Files\PestPatrol 2007-11-29 15:11 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-11-28 13:47 --------- d-----w C:\Documents and Settings\ANNA\Application Data\uTorrent 2007-11-28 13:46 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-11-28 13:39 --------- d-----w C:\Program Files\Google 2007-11-27 23:20 --------- d-----w C:\Program Files\DivX 2007-11-27 13:26 --------- d-----w C:\Program Files\Java 2007-11-27 11:53 --------- d-----w C:\Program Files\PowerArchiver 2007-11-27 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI MMC 2007-11-26 19:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-26 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-24 23:48 86,094 ----a-w C:\WINDOWS\BPMNT.dll 2007-11-24 23:48 71,749 ----a-w C:\WINDOWS\hcextoutput.dll 2007-11-22 15:48 --------- d-----w C:\Program Files\LogProtect 2007-11-12 21:35 --------- d-----w C:\Program Files\eMule 2007-11-12 20:56 --------- d-----w C:\Program Files\a-squared Free 2007-11-12 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-12 18:26 --------- d-----w C:\Program Files\Ontrack 2007-11-12 11:06 --------- d-----w C:\Program Files\Ahead 2007-11-12 11:06 --------- d-----w C:\Documents and Settings\ANNA\Application Data\Ahead 2007-11-12 10:10 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-11-11 23:53 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-11-10 00:55 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-11-10 00:43 --------- d-----w C:\Program Files\MSN Messenger 2007-11-09 23:33 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-11-08 17:00 --------- d-----w C:\Program Files\Macrogaming 2007-11-08 15:09 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-08 20:52 --------- d-----w C:\Program Files\Wizards of the Coast 2007-09-14 08:37 45,192 ----a-w C:\WINDOWS\system32\MsgPlusLoader.dll 2006-04-19 21:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] C:\WINDOWS\system32\jxcbeynb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}] C:\WINDOWS\system32\efecd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATI Launchpad"="C:\Program Files\ATI Multimedia\main\LaunchPd.exe" [2002-05-02 09:57] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 13:50] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:54] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 21:41] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "WINSOS VERIFY"="C:\Program Files\Winsos\WINSOS.exe" [] "Ptei"="C:\PROGRA~1\SMANTE~1\attrib.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 17:06] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "C-Media Mixer"="Mixer.exe" [2001-12-07 16:24 C:\WINDOWS\Mixer.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-14 17:29] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2003-08-05 09:11] "PestPatrol Control Center"="C:\Program Files\PESTPA~1\PPControl.exe" [2003-08-05 09:11] "CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2003-08-05 09:11] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 09:31] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] C:\Documents and Settings\ANNA\Menu D‚marrer\Programmes\D‚marrage\ PPControl.lnk - C:\Documents and Settings\ANNA\Application Data\Microsoft\Installer\{FA1B3B7A-98D0-4F54-B555-7711A6E54544}\IconFA1B3B7A.exe [2005-03-23 00:49:53] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-13 01:44:38] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\xxyawvu] xxyawvu.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UWA6PV_0001_N91M2107] C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr [1].exe -nag R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys S0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys S2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINDOWS\system32\DRIVERS\CINEMSUP.SYS S3 AX88172;ASIX AX88172 USB2 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88172.sys S3 oUltraf;oUltraf;\??\C:\DOCUME~1\ANNA\LOCALS~1\Temp\oUltraf.sys S3 pgfilter;pgfilter;\??\C:\Program Files\PeerGuardian2\pgfilter.sys S3 RescueDrv;Inventel Access Point USB Rescue Driver;C:\WINDOWS\system32\Drivers esc_dwb.sys S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys S3 viafilter;VIA USB Filter;C:\WINDOWS\system32\Drivers\viausb1.sys S3 wanusb;ECI Telecom USB ADSL WAN Modem;C:\WINDOWS\system32\DRIVERS\gwausb.sys *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-11-29 15:00:00 C:\WINDOWS\Tasks\AF9263E490021B9C.job" - c:\docume~1\anna\applic~1\inside~1\meow 4 view.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 16:55:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run EPSON Stylus Photo R300 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"?????E????????????a?w????????????????p????????????????????b?w????p???????????8???????????h??w????p???????z??wp???????????)??|??????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 16:57:26 . --- E O F ---

marina · Answer

a j aie oublier quend je surf sur internet defois antivir se met a emettre des bip est ce normal ??? pas depuis que je les reintallais merci d avance marina

marina · Answer

merci pour ton intervention jalobservateur et un grand merci a   jlpjlp et surtout a toi g!rly je ne sais pas se que j aurais fait sans toi , parcontre qui est ce bandji j aie rien contre lui mais il a l air de aimer contre dire les decisions , enfin merci marina

g!rly · Answer

marina,

je vais te reecrir un script car vu que tu as fais la restauration system les clefs sont revenues

Utilisateur anonyme · Answer

ecoute bien marina quand je te dit que tu es toujour infecter parceque je suis un vrai programateur de lenguage informatique je connais tres bien l'informatique et le system et je suis un editeur et createur des logiciels informatique et je suis pas contre toi ok mais je te dis la verite tu es toujours infecter dans ta base de regestre a ce jour dommage tu m'ecoute meme pas bonne chance

marina · Answer

tu veut dire quoi te reecrire un srypte , je ne comprend se que tu veut dire ou faire allusion , puis je mettre resolu dans la session merci encord

g!rly · Answer

re,

nettoie tes fichiers temporaires avec ceci : atf cleaner, regarde le tuto...

http://www.infosecu.fr/atf.html

telecharge le ici :

http://serveur1.archive-host.com/membres/up/1366464061/ATF-Cleaner.rar

telecharge ce fichier :

http://serveur1.archive-host.com/membres/up/1366464061/marina.rar

dezip le sur ton bureau > double click dessus ( marina.reg ) et accepte la fusion avec le registre.

puis double click sur ot_move it

copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\AU_Temp
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\hnhkavvt.ini
C:\WINDOWS\system32\pgykbnbu.ini
C:\WINDOWS\system32
iojyxbp.ini
C:\WINDOWS\system32\qkbqbdcs.ini
C:\WINDOWS\system32\jxcbeynb.dll
C:\WINDOWS\system32\efecd.dll
C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg

peux tu me dire ce que c´est : C:\Program Filesexunuxy

as tu installé messenger plus avec le sponssor?

http://theroot.chez-alice.fr/imgs/tuto/msgplus.jpg

post le rapport de ot_move it

@+

jalobservateur · Answer

Allo  bandji!
Alors, tu devrais immédiatement lui faire part de tes connaissances en lui expliquant sciemment : Comment et par quel mécanisme un Rootkits s'introduit dans une machine et ou il se loge .
De plus lui expliquer comment les vers, les trojans downloader réussisent à introduirent des codes malicieux et parviennent à exécuter des.exe et même introduire de malicieux codes afin de clôner ceux-ci.
Il serait aussi instructif de connaitre le noyau Windows et la façon de protéger ses failles.
Si tu pouvais lui expliquer ceci ,dans un langage imagé, cela serait apprécié.
Merci ! Jal ;-)

marina · Answer

pour se qui est de msn plus oui je les mais je ne telecharger jamais le sponsor mais peut etre que par mais garde il se soit installer voila le rapport de move it merci a tout a l heure , 







C:\WINDOWS\AU_Temp\AU_Down\product moved successfully.
C:\WINDOWS\AU_Temp\AU_Down\pattern moved successfully.
C:\WINDOWS\AU_Temp\AU_Down\engine moved successfully.
C:\WINDOWS\AU_Temp\AU_Down moved successfully.
C:\WINDOWS\AU_Temp\3\4 moved successfully.
C:\WINDOWS\AU_Temp\3 moved successfully.
C:\WINDOWS\AU_Temp\2\4 moved successfully.
C:\WINDOWS\AU_Temp\2 moved successfully.
C:\WINDOWS\AU_Temp\1\27 moved successfully.
C:\WINDOWS\AU_Temp\1 moved successfully.
C:\WINDOWS\AU_Temp moved successfully.
C:\WINDOWS\system32\mcrh.tmp moved successfully.
C:\WINDOWS\system32\hnhkavvt.ini moved successfully.
C:\WINDOWS\system32\pgykbnbu.ini moved successfully.
C:\WINDOWS\system32
iojyxbp.ini moved successfully.
C:\WINDOWS\system32\qkbqbdcs.ini moved successfully.
File/Folder C:\WINDOWS\system32\jxcbeynb.dll not found.
File/Folder C:\WINDOWS\system32\efecd.dll not found.
File/Folder C:\DOCUME~1\ANNA\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\O9GJSB8B\WinAntiVirusPro2006FreeInstall_fr not found.
 
Created on 11/29/2007 19:01:39

g!rly · Answer

peux tu refaire un combofix et poster le rapport

Utilisateur anonyme · Answer

ok Un virus est un petit programme informatique situé dans le corps d'un autre, qui, lorsqu'on l'exécute, se charge en mémoire et exécute les instructions que son auteur a programmé. 

« Tout programme d'ordinateur capable d'infecter un autre programme 
d'ordinateur en le modifiant de façon à ce qu'il puisse à son tour se reproduire. » 
Le véritable nom donné aux virus est CPA soit Code Auto-Propageable, mais par analogie avec le domaine médical, le nom de "virus" leur a été donné. 

Les virus résidents (appelés TSR en anglais pour Terminate and stay resident) se chargent dans la mémoire vive de l'ordinateur afin d'infecter les fichiers exécutables lancés par l'utilisateur. Les virus non résidants infectent les programmes présents sur le disque dur dès leur exécution. 

Le champ d'application des virus va de la simple balle de ping-pong qui traverse l'écran au virus destructeur de données, ce dernier étant la forme de virus la plus dangereuse. Ainsi, étant donné qu'il existe une vaste gamme de virus ayant des actions aussi diverses que variées, les virus ne sont pas classés selon leurs dégâts mais selon leur mode de propagation et d'infection. le virus système ou amorce s’attaque à au système ou à la zone d’amorçage du disque dur ou d’une disquette. Certains virus attaquent par exemple le boot secteur. C’est la première chose qu’un ordinateur charge en mémoire à partir du disque et exécute quand il est allumé. En attaquant cette zone de disque, le virus peut obtenir le contrôle immédiat de l’ordinateur. Les fichiers : Un virus peut attaquer des nombreux fichiers. En général, il ne connaît que la structure d’un type de fichier et parfois même d’un seul fichier, ce qui lui permet de vraiment s’adapter à ces fichiers et d’être plus facilement invisible. Aujourd’hui ce sont les fichiers transitant par l’Internet qui sont le plus visé. Les macro : le développement des outils de bureautique a permis l’explosion de ces fichiers qui se propagent en général avec des fichiers de données.Spyware : tout logiciel introduit sur un dispositif et qui emploie la connexion Internet d'un utilisateur ou tout autre moyen ou support à son insu ou sans sa permission explicite et éclairée, pour collecter des informations, peu importe qu'il y ait ou non un rapprochement entre ces informations et l'identification du dit utilisateur.

Utilisateur anonyme · Answer

On garde à l’esprit qu’un virus informatique n’est rien d’autre qu’un programme. Il est constitué d’un sous-programme indispensable, et parfois d’autres sous-programmes tel qu’une partie destructrice, ou une routine pour le protéger contre les anti-virus. Le programme indispensable est le programme de reproduction. Il contient une partie pour la recherche qui lui permet de localiser de nouveaux fichiers ou de nouvelles zones d’action sur le disque. Il s’assure qu’il n’a pas déjà infecté le fichier choisi. Une partie reproduction qui permet d’accrocher le virus au fichier sélectionné. Cette partie est suffisante pour avoir un virus. Prenons l’exemple de l’infection d’un programme .EXE :

g!rly · Answer

si c´est pour faire un copie/collé d´une page web mets le lien ca prendra moins de place...

marina · Answer

voici le rapport , dit moi kerio me donne des messages " tentative d intrusion bloquee" = c:\windows\systeme32\svchost.exe . dois je autoriser l envoie ???? ComboFix 07-11-19.4C - ANNA 2007-11-29 20:08:04.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.159 [GMT 1:00] Running from: C:\Documents and Settings\ANNA\Bureau\ComboFix.exe . ((((((((((((((((((((((((((((( Fichiers créés 2007-10-28 to 2007-11-29 )))))))))))))))))))))))))))))))))))) . 2007-11-29 09:29 d-------- C:\Program Files\Avira 2007-11-29 01:25 d-------- C:\WINDOWS\BDOSCAN8 2007-11-29 01:20 d-------- C:\Program Files\BitDefender 2007-11-29 00:09 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-11-29 00:09 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-11-28 00:11 d-------- C:\Program Files\SLD CODEC PACK 1(3).5 2007-11-27 23:28 334 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-11-27 12:42 d-------- C:\Program Files\Sunbelt Software 2007-11-26 23:29 467,632 --a------ C:\WINDOWS\system32\perfh040.dat 2007-11-26 23:29 74,326 --a------ C:\WINDOWS\system32\perfc040.dat 2007-11-26 20:39 d-------- C:\Program Files\Trend Micro 2007-11-26 17:09 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-11-26 17:09 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-11-26 17:09 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-11-26 17:09 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-11-26 17:08 d-------- C:\Program Files\Spyware Doctor 2007-11-22 17:08 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression 2007-11-12 18:21 d--h----- C:\Documents and Settings\Administrateur\Modèles 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Mes documents 2007-11-12 18:21 dr------- C:\Documents and Settings\Administrateur\Menu Démarrer 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Favoris 2007-11-12 18:21 d-------- C:\Documents and Settings\Administrateur\Bureau 2007-11-12 13:54 d-------- C:\Program Files\Runtime Software 2007-11-12 10:56 1,024 --a------ C:\WINDOWS\system32\drivers\DCF1518D-AE04-44E5-A398-2B2579435BD4.cxv 2007-11-12 10:22 10,240 --a------ C:\WINDOWS\system32\drivers\63C1D9DE-045B-4F3E-A220-8CAB6453DA8F.cxv 2007-11-12 10:18 d-------- C:\Program Files\STOPzilla! 2007-11-12 10:18 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla! 2007-11-12 02:29 d-------- C:\Program Files exunuxy 2007-11-12 02:21 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-11-12 01:39 d-------- C:\Documents and Settings\ANNA\Application Data\PC Tools 2007-11-10 02:36 d-------- C:\Program Files\RegCleaner 2007-11-10 02:06 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-11-10 01:22 d-------- C:\Documents and Settings\ANNA\Application Data\MSNInstaller 2007-11-10 01:14 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2007-11-10 01:03 d-------- C:\Program Files\Microsoft Windows OneCare Live 2007-11-10 00:39 d-------- C:\Program Files\Windows Live 2007-11-10 00:39 d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller 2007-11-10 00:39 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2007-11-09 01:08 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-11-09 00:32 1,163,344 --a------ C:\WINDOWS\vsapi32.dll 2007-11-09 00:32 267,845 --a------ C:\WINDOWS sc.exe 2007-11-09 00:31 507,904 --a------ C:\WINDOWS\TMUPDATE.DLL 2007-11-09 00:31 286,720 --a------ C:\WINDOWS\PATCH.EXE 2007-11-09 00:31 69,689 --a------ C:\WINDOWS\UNZIP.DLL . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 19:05 --------- d-----w C:\Program Files\PestPatrol 2007-11-29 17:56 --------- d-----w C:\Program Files\PowerArchiver 2007-11-29 15:47 --------- d-----w C:\Program Files\Wanadoo 2007-11-29 15:11 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-11-28 13:47 --------- d-----w C:\Documents and Settings\ANNA\Application Data\uTorrent 2007-11-28 13:46 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-11-28 13:39 --------- d-----w C:\Program Files\Google 2007-11-27 23:20 --------- d-----w C:\Program Files\DivX 2007-11-27 13:26 --------- d-----w C:\Program Files\Java 2007-11-27 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI MMC 2007-11-26 19:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2007-11-26 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-24 23:48 86,094 ----a-w C:\WINDOWS\BPMNT.dll 2007-11-24 23:48 71,749 ----a-w C:\WINDOWS\hcextoutput.dll 2007-11-22 15:48 --------- d-----w C:\Program Files\LogProtect 2007-11-12 21:35 --------- d-----w C:\Program Files\eMule 2007-11-12 20:56 --------- d-----w C:\Program Files\a-squared Free 2007-11-12 18:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-12 18:26 --------- d-----w C:\Program Files\Ontrack 2007-11-12 11:06 --------- d-----w C:\Program Files\Ahead 2007-11-12 11:06 --------- d-----w C:\Documents and Settings\ANNA\Application Data\Ahead 2007-11-12 10:10 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2007-11-11 23:53 46,080 ----a-w C:\WINDOWS\system32\ftp.exe 2007-11-10 00:55 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-11-10 00:43 --------- d-----w C:\Program Files\MSN Messenger 2007-11-09 23:33 --------- d-----w C:\Program Files\Windows Live Toolbar 2007-11-08 17:00 --------- d-----w C:\Program Files\Macrogaming 2007-11-08 15:09 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared 2007-10-18 10:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll 2007-10-08 20:52 --------- d-----w C:\Program Files\Wizards of the Coast 2007-09-14 08:37 45,192 ----a-w C:\WINDOWS\system32\MsgPlusLoader.dll 2006-04-19 21:41 278,528 ----a-w C:\Program Files\Fichiers communs\FDEUnInstaller.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-29_16.56.07.04 ))))))))))))))))))))))))))))))))))))))))) . - 2006-05-25 00:21:00 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2007-11-29 17:08:42 77,824 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] C:\WINDOWS\system32\jxcbeynb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}] C:\WINDOWS\system32\efecd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATI Launchpad"="C:\Program Files\ATI Multimedia\main\LaunchPd.exe" [2002-05-02 09:57] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 13:50] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:54] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 21:41] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34] "WINSOS VERIFY"="C:\Program Files\Winsos\WINSOS.exe" [] "Ptei"="C:\PROGRA~1\SMANTE~1\attrib.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 17:06] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24] "C-Media Mixer"="Mixer.exe" [2001-12-07 16:24 C:\WINDOWS\Mixer.exe] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-14 17:29] "LVCOMS"="C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54] "EPSON Stylus Photo R300 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.exe" [2003-09-11 04:00] "PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2003-08-05 09:11] "PestPatrol Control Center"="C:\Program Files\PESTPA~1\PPControl.exe" [2003-08-05 09:11] "CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2003-08-05 09:11] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-09 01:17] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-29 09:31] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] C:\Documents and Settings\ANNA\Menu D‚marrer\Programmes\D‚marrage\ PPControl.lnk - C:\Documents and Settings\ANNA\Application Data\Microsoft\Installer\{FA1B3B7A-98D0-4F54-B555-7711A6E54544}\IconFA1B3B7A.exe [2005-03-23 00:49:53] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-11-13 01:44:38] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" R3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys S0 UNPR;UNPR;C:\WINDOWS\system32\unpr.sys S2 CINEMSUP;Software Cinemaster NT4.0 Driver;C:\WINDOWS\system32\DRIVERS\CINEMSUP.SYS S3 AX88172;ASIX AX88172 USB2 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88172.sys S3 oUltraf;oUltraf;\??\C:\DOCUME~1\ANNA\LOCALS~1\Temp\oUltraf.sys S3 pgfilter;pgfilter;\??\C:\Program Files\PeerGuardian2\pgfilter.sys S3 RescueDrv;Inventel Access Point USB Rescue Driver;C:\WINDOWS\system32\Drivers esc_dwb.sys S3 USBSHGX;SHARP GSM GPRS USB Driver 2.1.0;C:\WINDOWS\system32\DRIVERS\usbgx_2.sys S3 viafilter;VIA USB Filter;C:\WINDOWS\system32\Drivers\viausb1.sys S3 wanusb;ECI Telecom USB ADSL WAN Modem;C:\WINDOWS\system32\DRIVERS\gwausb.sys *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2007-11-29 19:00:00 C:\WINDOWS\Tasks\AF9263E490021B9C.job" - c:\docume~1\anna\applic~1\inside~1\meow 4 view.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 20:13:16 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run EPSON Stylus Photo R300 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"?????E????????????a?w????????????????p????????????????????b?w????p???????????8???????????h??w????p???????z??wp???????????)??|??????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 20:15:24 C:\ComboFix2.txt ... 2007-11-29 16:57 . --- E O F ---

g!rly · Answer

oui tu peux l´autoriser

comment ca va pour le moment?

marina · Answer

TOUS TRES BIEN QUE PENSE TU Y EST ARRIVER ????

g!rly · Answer

re,

bon on reste comme ca pour le moment

tiens moi au courrant dans quelques jours...

@+

Utilisateur anonyme · Answer

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 
C:\WINDOWS\system32\jxcbeynb.dll

marina · Answer

ok je te tiens au courant disons dans 1 semaine , et pour le dossier que tu fait allusion au dessus celui la  "C:\Program Files\rexunuxy " je fait quoi ???

et c est quoi le fichier que bandji parle     "HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 
C:\WINDOWS\system32\jxcbeynb.dll

c est quoi je de faire quelque chose tiens moi au courant g!rly a +++ et encord mille merci pour ton aide marina

g!rly · Answer

re,

il y a quoi dans ce dossier? rexunuxy ?

pour ceci :

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
C:\WINDOWS\system32\jxcbeynb.dll 

j´ai tenté de fixer le registre mais la ligne revient sans cesse

mais le fichier n´est plus present 

c´est pour cela que je t´ai demandé de me tenir au courrant

...

Utilisateur anonyme · Answer

tu es toujours infecté dans la base de registre

g!rly · Answer

serieux si t´as une solution fais la savoir bandji mais arrete de venir poluer mes posts. pour ne rien dire...

g!rly · Answer

marina peux tu faire ceci 

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

Utilisateur anonyme · Answer

g!rly  sa se voi maitenant  que tu connais  rien dommage pour marina elle infecte et tu entrain de lui dire que bla bla bla

marina · Answer

pour se qui est rexunuxy le dossier etais vide donc je les suprimais, je fait la manip que tu ma dit et je donne le rapport 


 bandji je voulais te dire que au lieu de dire que je suis infecter tu na cas faire comme g!rly lui il agit il me dit de faire sa de telecharger sa enfin il fait , il ne parle pas sans rien faire , voila donc si tu a des conseille dit et puis voila , car j aie scanner comme tu disais avec bidefender et rien alors que soit disant j etais infecter , sur ce a tout a l heure marina

marina · Answer

voici le rapport parcontre je n est pas eut de message d erreur ni ecran bleu 




[11/29/2007, 22:41:05] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\ANNA\Bureau\VirtumundoBeGone.exe" )
[11/29/2007, 22:41:07] - Detected System Information:
[11/29/2007, 22:41:07] -  Windows Version: 5.1.2600, Service Pack 2
[11/29/2007, 22:41:07] -  Current Username: ANNA (Admin)
[11/29/2007, 22:41:07] -  Windows is in NORMAL mode.
[11/29/2007, 22:41:07] - Searching for Browser Helper Objects:
[11/29/2007, 22:41:07] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/29/2007, 22:41:07] -  BHO 2: {22b86299-7d7b-42fa-915c-3aa7dd2914ed} ()
[11/29/2007, 22:41:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/29/2007, 22:41:07] -  Checking for HKLM\...\Winlogon\Notify\jxcbeynb
[11/29/2007, 22:41:07] -  Key not found: HKLM\...\Winlogon\Notify\jxcbeynb, continuing.
[11/29/2007, 22:41:07] -  BHO 3: {2C45DAA2-2ABF-4D05-A606-D4A85AE2074E} ()
[11/29/2007, 22:41:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/29/2007, 22:41:07] -  Checking for HKLM\...\Winlogon\Notify\efecd
[11/29/2007, 22:41:07] -  Key not found: HKLM\...\Winlogon\Notify\efecd, continuing.
[11/29/2007, 22:41:07] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/29/2007, 22:41:07] -  BHO 5: {7690710C-1A33-4D05-B860-1730FE652B77} ()
[11/29/2007, 22:41:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/29/2007, 22:41:07] -  No filename found. Continuing.
[11/29/2007, 22:41:07] -  BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/29/2007, 22:41:07] -  BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[11/29/2007, 22:41:07] -  BHO 8: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/29/2007, 22:41:07] -  BHO 9: {B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A} ()
[11/29/2007, 22:41:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/29/2007, 22:41:07] -  No filename found. Continuing.
[11/29/2007, 22:41:07] -  BHO 10: {B98B4120-018E-4C17-9496-7705DE0F1216} ()
[11/29/2007, 22:41:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/29/2007, 22:41:07] -  No filename found. Continuing.
[11/29/2007, 22:41:07] - Finished Searching Browser Helper Objects
[11/29/2007, 22:41:07] - Finishing up...
[11/29/2007, 22:41:07] - Nothing found! Exiting...

Utilisateur anonyme · Answer

j'ai bcp de solution mais je te dis rien parceque tu ne veut pas m'ecoute ok  mais ta plein cles et sous cles infecté dans ta base de registre

marina · Answer

a mon avis tu ti connais en informatique comme moi ne le prend pas mal , car tu dit que je ne t ecoute pas ses faux tu ma dit de scanner avec bidefender se que j aie fait et le rapport etais nikel voila , donc si tu veut que l on te prenne au serieux agis marina

g!rly · Answer

re,

fais encore ceci :

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(x)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\jxcbeynb]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\efecd]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note : REGEDIT4 est sur la premiere ligne et il y a une ligne blanche a la fin
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

telecharge jv16 et effectue un nettoyage de ta base de registre :

https://www.zebulon.fr/telechargements/utilitaires/nettoyeurs/jv16.html

tuto : (ps ne supprime que les clefs en vert)

https://www.zebulon.fr/dossiers/windows/57-base-de-registre.html/5

ps : merci d´avoir mis les points sur i avec bandji

tiens moi au courrant

@+

Utilisateur anonyme · Answer

marina ne fais jamais ca parceque tu resque  endommagé  c:\windows\system32\config\system   fait très attention 

g!rly, tu es un vrai fou malade tu veut endommagé son c:\windows\system32\config\system   ( c:\windows\system32\config\system   ) c le vrai system de la base de registre ok

g!rly · Answer

bandji pour la derniere fois, peux tu arreter de poster sur mes topiks!!!

j´ai l´impression que tu ne voie pas claire :

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\jxcbeynb]

est une cle relative a winlogon

comme celle ci :

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\efecd] 

celles si font partie des bho : browser help object :

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2C45DAA2-2ABF-4D05-A606-D4A85AE2074E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7690710C-1A33-4D05-B860-1730FE652B77}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B83082CA-29DB-4B4D-BA3A-E2BD0902DA7A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B98B4120-018E-4C17-9496-7705DE0F1216}]

regarde le rapport de combofix celui de hijack this et celui de virtumundobegonne pour comprendre 

et manque de pot tu avais mentionner ceci plus haut :  

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
C:\WINDOWS\system32\jxcbeynb.dll

je l´efface ici :

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\jxcbeynb]

y a aucune cle que je fais effacer qui se rapport a ce que tu mentionne

je ne voie meme pas d´ou tu sort ca?

c:\windows\system32\config\system

tu dis que des conneries et donne des doutes aux personnes que j´essaie d´aider

alors arrete

marina · Answer

bonjour g!rly sache que moi personnellement tu ne me donne aucun doute j aie fait tous se que tu ma dit meme le nettoyage de registre d hier soir , je voulais te le dire hier soir mais je n arrivais plus a me connecter mais que "commentsamarche " et j aie reeut la cnnection ici que la maintenand voila , sinon tous va bien , je te dit pas le nombre de petit point verre qu il y avait dans le nettoyage de registres il restais meme des point rouge que j aie supprimer meme si tu m avait dit de ne pas le faire , mais dans le lien qui explique que tu ma donner sa dit que si on voie des pg qui ne sont plus on peu les effacer , s etais le cas " avast " voila est ce que je doit faire autre chose ???? mille merci et n ecoute pas et surtout ne t  enerve pas a cause de bandji , tu sais je vais lui dire se que je dit a mais enfants " au lieu de dire sa se n est pas bien , sa non plus etc... mais qu il ne font rein a part donner des ordres on dirait des chef , et bien je leur repond que les chez ses comme des livres dans une bibliotheque ,au plus ils sont haut au plus ils prennent la poussieres et ne serve a rein , donc qu ils agisses au lieu d avoir tous dans la bouche et pas dans le fait accomplie " et ses le cas de bandji , ne fait pas si ne fait pas sa , mais on na guere vue de lien au d explication a faire , voila ne demoralise aps g!rly on a besoin de gens comme toi a ++ marina

g!rly · Answer

bonjour marina,

oui le site etait en "derrangement" hier soir, c´est vrai...

je suis bien contente que tu ai pu netoyer le registre comme il fallait ;-)

quand a bandji, tu as tout a fait raison;  c´est un parasite, mais je ne vais pas m´ettendre sur son cas pour ne pas lui donner trop d´importance....

merci de m´avoir fait confience ;-)

embrasse tes enfants de ma part :D

bonne continuation`

ps : et si jamais, au grand jamais tu recevait une alerte, tu sais ou t´adresser...

bye`

marina · Answer

mille merci pour tous juste une question dois je supprimer les programme que tu ma fait telecharger + les fix.reg +marina.reg , en veriter si je dois les garder se n est pas un pb j aie fait un dossier ou j aie tousmis dedans et a l abri 
et dois je mettre resolu dans le forum ou ses toi ??
MERCI POUR TOUS ET TOI AUSSI EMBRASSE TES ENFANTS SI TU EN NA SI TU EN A APS JE PENSE QUE TU A QLQ 1 A EMBRASSER DE MAPART A ++ MARINA

Utilisateur anonyme · Answer

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 
C:\WINDOWS\system32\jxcbeynb.dll 

TU ES toujour infecte juska maitenant ok fais un scanne pour la dernierre fois avec antivir tu va trouve plein de choses ok fais le scanne

g!rly · Answer

re,

oui, un oublie de ma part; oups !

supprime tous les outils que nous avons utilisés + les quarrantaines et les fix.reg...

oui je ne m´anquerais pas d´embrasser les miens, merci ;-)

de rien...

david2005 · Answer

bonjour j'ai bien vu vous  interventions et vos raports 

madame marina vous avez fais une grand erreur  pourquoi vous avez changer votre ( c:\windows\system32\config\system  ) c la base de registre pour toute configiration d'aplication de system .

cette cles de la basse de registre et infecté 
HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 
C:\WINDOWS\system32\jxcbeynb.dll .

bandji il a dit la verité 
 vous etes infecté

g!rly · Answer

merci de relire les rapports et les actions avant de dire n´importe quoi
...

marina · Answer

merci g!rly , laisse les ont ne va pas  encord se justifier je suis majeur et j aie fait se que tu ma dit point barre et pour bandji que tu ne dise pas que je ne t ecoute pas voici le derniere rapport d antivir , et je te promet je ne les pas trafiquer pour qu il dise qu il n y a pas de virus sur ce tres bonne fin journee a tous marina 




 

AntiVir PersonalEdition Classic
Report file date: vendredi 30 novembre 2007  14:00

Scanning for 955308 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 08:31:47
ANTIVIR3.VDF : 7.0.1.28     197632 Bytes  30/11/2007 10:53:12
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  29/11/2007 08:31:49
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Drives
Configuration file...............: c:\program files\avira\antivir personaledition classic\alldrives.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: F:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 30 novembre 2007  14:00

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'imapi.exe' - '1' Module(s) have been scanned
Scan process 'nero.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'LaunchPd.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CookiePatrol.exe' - '1' Module(s) have been scanned
Scan process 'PPControl.exe' - '1' Module(s) have been scanned
Scan process 'PPMemCheck.exe' - '1' Module(s) have been scanned
Scan process 'E_S4I0F2.EXE' - '1' Module(s) have been scanned
Scan process 'LVComS.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'Mixer.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'incdsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
49 processes with 49 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'A:\'
      [NOTE]      In the drive 'A:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '45' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.



End of the scan: vendredi 30 novembre 2007  15:32
Used time:  1:32:52 min

The scan has been done completely.

   7746 Scanning directories
 375234 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 375234 Files not concerned
   2441 Archives were scanned
      1 Warnings
      1 Notes

jalobservateur · Answer

Bonjour les files !!!!
Vous avez bien bossé!!
Surtout sous pression et vous avez assuré! Bravo! ;-)
Marina: Changes cette option pour 'on'.  : Search for rootkits..............: off 
Config de Antivir.
Puis je sais que c'est pénible ...mais refais un scan total avec Antivir, cette-dernière fois en MSE Mode Sans Echec.

G!rly, XX voilà! 
Jal

marina · Answer

jalobservateur, okje vais refaire un scanne en mse ,  je pense que quand tu dit de mettre "on" au lieu de off ses dans scanne et ses de cocher enface car je n est pas "on " et off , voila des que j aie le rapport donc a peu pret dans 2h je vous fait un copier coller , et vous avez bien bossee ses a g!rly que l on doit dire merci ,a tout a l heure marina

g!rly · Answer

re,

merci jal pour ton intervention

marina

une fois antivir ouvert click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level
...

jalobservateur · Answer

Exactement!!!
Il est mieux de scanner en 'High Detection' et possiblement obtenir des faux positfs, que de Scanner 'Low' et de ne pas Obtenir de Vrais Négatifs! LOlll!
;-)

david2005 · Answer

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Expert1 · Answer

expert (  c:\windows\system32\config\system ) 

La base de registre est partagée en différentes sections logiques. Elles sont généralement connues par les noms les définissant quand on y accède via l'interface graphique de Windows; les noms commencent tous par 'HKEY' (une abréviation de Handle to a KEY, gestionnaire de clé).

Les 2 HKEY de base sont :

HKEY_LOCAL_MACHINE (HKLM) contient les informations qui sont générales à tous les utilisateurs de l'ordinateur : 
Matériel 
Sécurité 
SAM (Security Account Manager) 
Logicielle, la sous-branche "Classes" correspond à HKEY_CLASSES_ROOT 
Système, elle contient notamment la sous-branche CurrentControlSet (NB : CurrentControlSet\Control\Class contient des informations sur les classes). 
HKEY_USERS contient les informations spécifiques à chaque utilisateur. La sous-branche correspondant à l'utilisateur courant est l'équivalent de HKEY_CURRENT_USER. 
Les 5 autres HKEY sont

HKEY_CURRENT_CONFIG contient des informations qui sont mises à jour en temps réel, elles sont régénérées après chaque boot. 
HKEY_CLASSES_ROOT (HKCR) contient les informations sur les applications enregistrées ; cela inclut entre autre les associations entre extensions de fichiers et identifiants de classe d'objet OLE, ce qui permet de lancer automatiquement l'exécutable correspondant. Cela correspond à HKEY_LOCAL_MACHINE\SOFTWARE\Classes. Exemple : ".bat" et "XML" sont respectivement associés à "batfile" et "XML script engine". 
HKEY_CURRENT_USER (HKCU) contient les informations concernant l'utilisateur connecté. Ce n'est qu'une sous-branche de HKEY_USERS. 
HKEY_PERFORMANCE_DATA généré dynamiquement (REGEDIT ne l'affiche pas) 
HKEY_DYN_DATA généré dynamiquement (REGEDIT ne l'affiche pas) 
Chacune de ces clés est divisée en sous-clé(s), qui peuvent contenir d'autre(s) sous-clé(s) et ainsi de suite, constituant toute une arborescence.

jalobservateur · Answer

https://fr.wikipedia.org/wiki/Base_de_registre
Merci Wikimedia !!!

g!rly · Answer

wikipedia, balot lol

jalobservateur · Answer

;-) Le Net... Une mine de ressources.
http://www.commentcamarche.net/faq/sujet 3610 internet forums qu est ce qu un troll

Expert1 · Answer

oui c vrai cette cles de  basse de registre et infecté 

HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22b86299-7d7b-42fa-915c-3aa7dd2914ed}] 
C:\WINDOWS\system32\jxcbeynb.dll 
 
ta plein de code infecte que ton antivirus a rien detecte change ton antivirus 

je suis desole mais tu es infecte

marina · Answer

voila le rapport , dois je laisser les reglage d antivir que vous m avez donnes merci d avanve 




AntiVir PersonalEdition Classic
Report file date: vendredi 30 novembre 2007  20:30

Scanning for 955308 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         ANNA
Computer name:    UNICORNI-47B451

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.0     1393152 Bytes  23/11/2007 08:31:47
ANTIVIR3.VDF : 7.0.1.28     197632 Bytes  30/11/2007 10:53:12
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  29/11/2007 08:31:49
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: vendredi 30 novembre 2007  20:30

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '44' files ).


Starting the file scan:

Begin scan in 'C:\' <Disque local>
C:\pagefile.sys
      [WARNING]   The file could not be opened!


End of the scan: vendredi 30 novembre 2007  22:38
Used time:  2:08:39 min

The scan has been done completely.

   7734 Scanning directories
 375020 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 375020 Files not concerned
   2441 Archives were scanned
      1 Warnings
      1 Notes

g!rly · Answer

bon cette fois ci c´est ok lol

oui laisse les reglages

bonne soirée

marina · Answer

mille merci pour ton aide , je en sias pas se que j aurais fait sans toi et biensur les autres qui sont intervenues ,je te tire mon chapeau bravi*o a tres bientot ( enfin pour t aider a aider quelqu un ) lol bis marina

g!rly · Answer

merci ;-)
...

marina · Answer

bonsoir tous le monde voila 15jours que mon pc tourne et je touche du bois tres dure ,tous fonctionne correctement voila merci a tous et passer de tres bonne fete de noel  , et soyer sache sinon le 24 a minuit il passera sans s arreter , bis a tous et en particuler a g!rly ciao marina

g!rly · Answer

salut marina;

je suis bien contente d enttendre que tout va bien .-)

passe egalement de joyeuses fetes !

ps : j essaie d etre sage, t inkiet :D

ciao*

jalobservateur · Answer

Ouais c ce qu'elle dit 'sage Hummmm!!! passons!
Salut G!rly ;-)

g!rly · Answer

salut jal

je suis arrive en france .-)

je suis sage t inkiet .-)

c est ton rapport combofix en mp < question

a+

jalobservateur · Answer

Non Girly. un indicateur bizarre ? 
Il y a eu maintes infections sur cette machine jadis voilà !

g!rly · Answer

ok

je regarderais plus tard alors, de retour en finlande...

je fais une breve apparition sur le forum...

bonne fetes !!!

a+

jalobservateur · Answer

Je t'en souhaite de superbes G!rly!
Et j'ai bien apprécié nos échanges nocturnes, Loll!
T'es un fichu oiseau de nuit toi!.
Prends soin de toi ! @+

g!rly · Answer

kisses.
prends soins .-)

Alert security =triangle jaune - Page 8

Discussions similaires

Newsletters