VIRUS :Win32:agent-VGV[Wrm]

Même problème que ci dessus, je post le rapport généré par hijackthis merci de votre aide par avance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:17:07, on 05/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\MESSAG~1\StartMessager.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
C:\WINDOWS\system32\iesvcmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Documents and Settings\Utilisateur\Application Data\gadcom\gadcom.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\ppcbooster\ppcb_32.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrssc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\dllhost.exe
C:\Documents and Settings\Utilisateur\Bureau\HiJackThis.exe
C:\Documents and Settings\Utilisateur\Utilisateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: C:\WINDOWS\system32\gs73gfidgf.dll - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\gs73gfidgf.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKLM\..\Run: [iesvcmon] "C:\WINDOWS\system32\iesvcmon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\csrssc.exe
O4 - HKCU\..\Run: [Utilisateur] C:\Documents and Settings\Utilisateur\Utilisateur.exe /i
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Utilisateur\Application Data\gadcom\gadcom.exe" 61A847B5BBF72813349838466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: p2pmax.lnk = C:\Program Files\p2pmax\p2pmax.exe
O4 - Startup: ppcb_32.lnk = C:\Program Files\ppcbooster\ppcb_32.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217336112116&h=398f48c0afef8c8b8101a71e4d7bed91/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game14.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4903EFF-CBEE-4F49-AA9B-CB10BAE86E1B}: NameServer = 193.252.19.3,193.252.19.4
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O22 - SharedTaskScheduler: mcb7uehuj3n8weuhejsw - {C5BF49A2-94F3-42BD-F434-3604812C897D} - C:\WINDOWS\system32\gs73gfidgf.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Merci de ton aide, je te post le contenu du fichier report.txt


[b]SDFix: Version 1.240 [/b]
Run by Utilisateur on 05/12/2008 at 10:12

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]:
TDSSserv.sys

[b]Path [/b]:
\systemroot\system32\drivers\TDSSmxoe.sys

TDSSserv.sys - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\544684~1 - Deleted
C:\Documents and Settings\Utilisateur\Application Data\gadcom\gadcom.exe - Deleted
C:\Program Files\iCheck\Uninstall.exe - Deleted
C:\Program Files\VnrBlock\xtarga.gz - Deleted
C:\WINDOWS\system32\WinCtrl32.dll - Deleted
C:\WINDOWS\system32\drivers\TDSSmxoe.sys - Deleted
C:\WINDOWS\SYSTEM32\TDSSITPE.dat - Deleted
C:\WINDOWS\SYSTEM32\TDSSWGOD.log - Deleted



Folder C:\Documents and Settings\Utilisateur\Application Data\gadcom - Removed
Folder C:\Program Files\iCheck - Removed
Folder C:\Program Files\VnrBlock - Removed


Removing Temp Files

[b]ADS Check [/b]:



[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-05 10:15:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Documents and Settings\\Utilisateur\\Bureau\\Photo nouveau terrain Alex\\Limewire\\LimeWire.exe"="C:\\Documents and Settings\\Utilisateur\\Bureau\\Photo nouveau terrain Alex\\Limewire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Utilisateur\\Bureau\\Limewire\\LimeWire.exe"="C:\\Documents and Settings\\Utilisateur\\Bureau\\Limewire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Documents and Settings\\Utilisateur\\Bureau\\Emule\\emule.exe"="C:\\Documents and Settings\\Utilisateur\\Bureau\\Emule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\WINDOWS\\system32\\userinit.exe"="C:\\WINDOWS\\system32\\userinit.exe:*:Enabled:ENABLE"
"C:\\WINDOWS\\Explorer.EXE"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:ENABLE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 4 Dec 2008 9,145 ...H. --- "C:\Documents and Settings\Utilisateur\Utilisateur.exe"
Tue 13 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

Impossible de trouver dans les périphériques celui dont le non commence par TDSS.
C'est la galère. Surtout que j'ai internet qui rame trop.

Voici le rapport:

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1463
Windows 5.1.2600 Service Pack 2

05/12/2008 11:27:11
mbam-log-2008-12-05 (11-27-11).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 80755
Temps écoulé: 18 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 6
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 11

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\cont_globaladsolution (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\winantispyware 2006 scanner (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Documents and Settings\Utilisateur\Application Data\WinAntiSpyware 2006 (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Application Data\WinAntiSpyware 2006\Logs (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP278\A0030652.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\A0030669.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030800.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030837.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030847.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\nohh06760.exe (Adware.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSncur.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Utilisateur\Application Data\WinAntiSpyware 2006\Logs\update.log (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cont_globaladsolution-remove.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\components\nsglobaladsolution.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSqxnr.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:59, on 05/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\MESSAG~1\StartMessager.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\p2pmax\p2pmax.exe
C:\Program Files\ppcbooster\ppcb_32.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Utilisateur\Bureau\HiJackThis.exe
C:\Documents and Settings\Utilisateur\Utilisateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\UTILIS~1\LOCALS~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Utilisateur] C:\Documents and Settings\Utilisateur\Utilisateur.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: p2pmax.lnk = C:\Program Files\p2pmax\p2pmax.exe
O4 - Startup: ppcb_32.lnk = C:\Program Files\ppcbooster\ppcb_32.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217336112116&h=398f48c0afef8c8b8101a71e4d7bed91/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game14.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4903EFF-CBEE-4F49-AA9B-CB10BAE86E1B}: NameServer = 193.252.19.3,193.252.19.4
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

pour p2max:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.5.0 2008.12.05 -
AntiVir 7.9.0.41 2008.12.05 -
Authentium 5.1.0.4 2008.12.05 -
Avast 4.8.1281.0 2008.12.04 -
AVG 8.0.0.199 2008.12.05 -
BitDefender 7.2 2008.12.05 Generic.Malware.N!.930437B5
CAT-QuickHeal 10.00 2008.12.05 -
ClamAV 0.94.1 2008.12.05 -
Comodo 682 2008.12.04 -
DrWeb 4.44.0.09170 2008.12.05 -
eSafe 7.0.17.0 2008.12.04 -
eTrust-Vet 31.6.6243 2008.12.04 -
Ewido 4.0 2008.12.04 -
F-Prot 4.4.4.56 2008.12.04 -
F-Secure 8.0.14332.0 2008.12.05 -
Fortinet 3.117.0.0 2008.12.05 -
GData 19 2008.12.05 Generic.Malware.N!.930437B5
Ikarus T3.1.1.45.0 2008.12.05 Win32.SuspectCrc
K7AntiVirus 7.10.543 2008.12.04 -
Kaspersky 7.0.0.125 2008.12.05 -
McAfee 5454 2008.12.04 -
McAfee+Artemis 5454 2008.12.04 -
Microsoft 1.4205 2008.12.05 -
NOD32 3666 2008.12.05 -
Norman 5.80.02 2008.12.04 -
Panda 9.0.0.4 2008.12.04 -
PCTools 4.4.2.0 2008.12.04 -
Prevx1 V2 2008.12.05 -
Rising 21.06.42.00 2008.12.05 -
SecureWeb-Gateway 6.7.6 2008.12.05 -
Sophos 4.36.0 2008.12.05 -
Sunbelt 3.1.1832.2 2008.12.01 -
Symantec 10 2008.12.05 W32.SillyP2P
TheHacker 6.3.1.2.176 2008.12.05 -
TrendMicro 8.700.0.1004 2008.12.05 -
VBA32 3.12.8.10 2008.12.05 -
ViRobot 2008.12.5.1502 2008.12.05 -
VirusBuster 4.5.11.0 2008.12.04 -
Information additionnelle
File size: 10240 bytes
MD5...: ec50c8f7a398cb6fd942fc041e304afa
SHA1..: ccd01fdc81de79dc717d83b0e094ccc25fe0904e
SHA256: 9ee7b9a5f32059736bfa05ed2c440f7c02a9f6a70a499f84f394d3fab186c266
SHA512: a8be7a1e534fe673112c8cf02357f52a4861f0246fb81621cc35e3b3d58b704c
ca135e232cd60730c2ce30782e8d101393f56518ac48fec0c20f4fe83556030e
ssdeep: 192:xzyumPyrRiBjgyLhBsDILzdp+lH6dCf4eAbT:PSTBwQzdolHlf4Hb
PEiD..: -
TrID..: File type identification
Generic CIL Executable (.NET, Mono, etc.) (94.8%)
Generic Win/DOS Executable (2.5%)
DOS Executable Generic (2.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x403dbe
timedatestamp.....: 0x493481e9 (Tue Dec 02 00:31:37 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x2000 0x1dc4 0x1e00 5.48 e5351e45642092e12bc32f28d918455e
.rsrc 0x4000 0x530 0x600 3.89 4d54a22fa06298f3e976f0dc5038ccde
.reloc 0x6000 0xc 0x200 0.08 e3b966e504328804122b028b5f24c63e

( 1 imports )
> mscoree.dll: _CorExeMain

( 0 exports )

ATENTION ATTENTION: Virus




pour ppcbooster:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.12.5.0 2008.12.05 -
AntiVir 7.9.0.41 2008.12.05 HEUR/Malware
Authentium 5.1.0.4 2008.12.05 -
Avast 4.8.1281.0 2008.12.04 -
AVG 8.0.0.199 2008.12.05 -
BitDefender 7.2 2008.12.05 Trojan.Generic.1214843
CAT-QuickHeal 10.00 2008.12.05 -
ClamAV 0.94.1 2008.12.05 -
Comodo 682 2008.12.04 -
DrWeb 4.44.0.09170 2008.12.05 -
eSafe 7.0.17.0 2008.12.04 -
eTrust-Vet 31.6.6243 2008.12.04 -
Ewido 4.0 2008.12.04 -
F-Prot 4.4.4.56 2008.12.04 -
F-Secure 8.0.14332.0 2008.12.05 Trojan-Downloader.Win32.Agent.aswp
Fortinet 3.117.0.0 2008.12.05 -
GData 19 2008.12.05 Trojan.Generic.1214843
Ikarus T3.1.1.45.0 2008.12.05 -
K7AntiVirus 7.10.543 2008.12.04 -
Kaspersky 7.0.0.125 2008.12.05 Trojan-Downloader.Win32.Agent.aswp
McAfee 5454 2008.12.04 -
McAfee+Artemis 5454 2008.12.04 -
Microsoft 1.4205 2008.12.05 TrojanDownloader:Win32/Lwsta
NOD32 3666 2008.12.05 -
Norman 5.80.02 2008.12.04 -
Panda 9.0.0.4 2008.12.04 -
PCTools 4.4.2.0 2008.12.04 -
Prevx1 V2 2008.12.05 -
Rising 21.06.42.00 2008.12.05 -
SecureWeb-Gateway 6.7.6 2008.12.05 Heuristic.Malware
Sophos 4.36.0 2008.12.05 -
Sunbelt 3.1.1832.2 2008.12.01 Trojan-Dropper.Win32.VB!cobra (v)
Symantec 10 2008.12.05 -
TheHacker 6.3.1.2.176 2008.12.05 -
TrendMicro 8.700.0.1004 2008.12.05 -
VBA32 3.12.8.10 2008.12.05 -
ViRobot 2008.12.5.1502 2008.12.05 -
VirusBuster 4.5.11.0 2008.12.04 -
Information additionnelle
File size: 24576 bytes
MD5...: 47ebaf3d0dab9b7f6911b88d0d84fe98
SHA1..: 51afcf5761bf16e6acda6f543f2cc5d10fa93bda
SHA256: 38938b41ffec63be6c0badd2061643a70118f86f706e0feb8afa009ed587f0bf
SHA512: c0e52c22814582c0d12dbb00fbfe69c21cf98bc581d8c4ec9c3132aef4e8adb6
1702f6ca1f882fb08775f5eeb09727900dce989db21bfbf5adfbe1aa62a6f466
ssdeep: 192:/TRktk/cao5gZG/He37uSQYAZAy4GxOEblQ17EPZPIiDsSQLf:/TRk24gZP3
7uFYry4+bxG7E6iDsSQLf
PEiD..: -
TrID..: File type identification
Win32 Executable Microsoft Visual Basic 6 (90.9%)
Win32 Executable Generic (6.1%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401374
timedatestamp.....: 0x4935537c (Tue Dec 02 15:25:48 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x23c0 0x3000 4.37 4db2343d41f15fcd7ded05c240927c4c
.data 0x4000 0xa50 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x5000 0x8e0 0x1000 1.90 8a12bbdf66772da142e6a750a4110597

( 1 imports )
> MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaStrI4, __vbaFreeVar, __vbaLenBstr, _adj_fdiv_m64, _adj_fprem1,

__vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i,

_adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, -, __vbaGenerateBoundsError, __vbaStrCmp, __vbaObjVar,

DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler,

__vbaStrToUnicode, -, _adj_fprem, _adj_fdivr_m64, -, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow,

__vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -,

__vbaVarSetVar, __vbaLateMemCall, __vbaAryLock, __vbaStrToAnsi, __vbaVarDup, __vbaVarCopy, -, _CIatan, __vbaStrMove,

_allmul, _CItan, __vbaAryUnlock, _CIexp, __vbaFreeObj, __vbaFreeStr

( 0 exports )
CWSandbox info: <a

href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=47ebaf3d0dab9b7f6911b88d0d84fe98'

target='_blank'>http://research.sunbelt-software.com/...




pour Utilisateur:

MD5: 216a7e18a3b1f0aabe5ffde6fc74ca9c
First received: 2008.12.04 17:09:58 (CET)
Date 2008.12.04 17:09:52 (CET) [<1D]
Résultats 7/37
Permalink: analisis/e0c2962f3e578ba269c022003dab4ea5

Je suis désolé mais ça ne marche pas.
Si je prend "C:\Documents and Settings\Utilisateur\Utilisateur.exe" cela me répond ce que j'ai envoyé...

Problème, je trouve bien le scan online je clique sur I Agree mais après je ne trouve pas le click here to scan...Pas de nouvelle fenêtre qui s'ouvre.

D'accord moi j'étais sous mozilla...c réglé

l analyse est longue donc je t envoie ca des que c'est fini

Encore merci de m aider

voila les résultats: (y en a pour longtemps ou pas?)


Statistics

Time


00:50:56

Files


170219

Folders


3630

Boot Sectors


0

Archives


2291

Packed Files


9327







Results

Identified Viruses


8

Infected Files


20

Suspect Files


0

Warnings


0

Disinfected


0

Deleted Files


20







Engines Info

Virus Definitions


2330176

Engine build


AVCORE v1.7 (build 8314.19) (i386) (Sep 29 2008 17:19:14)

Scan plugins


17

Archive plugins


44

Unpack plugins


7

E-mail plugins


6

System plugins


4







Scan Settings

First Action


Disinfect

Second Action


Delete

Heuristics


Yes

Enable Warnings


Yes

Scanned Extensions


*;

Exclude Extensions




Scan Emails


Yes

Scan Archives


Yes

Scan Packed


Yes

Scan Files


Yes

Scan Boot


Yes








Scanned File


Status

C:\Program Files\p2pmax\p2pmax.exe


Infected with: Generic.Malware.N!.930437B5

C:\Program Files\p2pmax\p2pmax.exe


Disinfection failed

C:\Program Files\p2pmax\p2pmax.exe


Deleted

C:\Program Files\ppcbooster\ppcb_32.exe


Infected with: Trojan.Generic.1214843

C:\Program Files\ppcbooster\ppcb_32.exe


Deleted

C:\SDFix\backups\backups.zip=>backups/gadcom.exe


Infected with: Trojan.Generic.1215518

C:\SDFix\backups\backups.zip=>backups/gadcom.exe


Deleted

C:\SDFix\backups\backups.zip


Updated

C:\SDFix\backups\backups.zip=>backups/WinCtrl32.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\SDFix\backups\backups.zip=>backups/WinCtrl32.dll


Deleted

C:\SDFix\backups\backups.zip


Updated

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP278\A0030647.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP278\A0030647.dll


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\A0030662.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\A0030662.dll


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-1.DAT


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-1.DAT


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-2.DAT


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-2.DAT


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-3.DAT


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP279\snapshot\MFEX-3.DAT


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030816.exe


Infected with: Trojan.Generic.1196846

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030816.exe


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030824.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030824.dll


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030834.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030834.dll


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030851.dll


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030851.dll


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030906.exe


Infected with: Generic.Malware.N!.930437B5

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030906.exe


Disinfection failed

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030906.exe


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030907.exe


Infected with: Trojan.Generic.1214843

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\A0030907.exe


Deleted

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\snapshot\MFEX-1.DAT


Infected with: Trojan.Dropper.Kobcka.Gen.1

C:\System Volume Information\_restore{E5FBBD91-8129-46D0-A702-DCAAD4A611F5}\RP280\snapshot\MFEX-1.DAT


Deleted

C:\WINDOWS\c20232.exe


Infected with: Dropped:Generic.Malware.N!.930437B5

C:\WINDOWS\c20232.exe


Disinfection failed

C:\WINDOWS\c20232.exe


Deleted

C:\WINDOWS\gu58826.exe


Infected with: Trojan.VB.Agent.CF

C:\WINDOWS\gu58826.exe


Deleted

C:\WINDOWS\pn8.exe


Infected with: Dropped:Trojan.Peed.579

C:\WINDOWS\pn8.exe


Disinfection failed

C:\WINDOWS\pn8.exe


Deleted

C:\WINDOWS\vtj708346.exe=>(NSIS o)=>zlib_nsis0002


Infected with: Trojan.Generic.1214843

C:\WINDOWS\vtj708346.exe=>(NSIS o)=>zlib_nsis0002


Deleted

C:\WINDOWS\vtj708346.exe=>(NSIS o)


Update failed