message windows Résolu/Fermé

Question

Bonjour, a tous 

jai un gros probleme chaque foi que j'ouvre une fenetre ça me dit l'application ou la dll C:\windows\system32\wowfx.dll n'est pas une image valide pouvait vous m'aider svp

geoffrey5 · Accepted Answer

Salut !!

tu as surement une infection bagle...

Fais un rapport hijackthis pour que je puisse vérifier les infections de ton pc stp

Télécharge  hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

https://www.androidworld.fr/


Comment copier/coller le rapport :


Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".

ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.

Une explication des raccourcis clavier sont illustrés sur mon site web à cette adresse :

https://www.androidworld.fr/

blackss · Answer

je te donne le raport et je te remerci de m'aider


ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:14 , on 18/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\program Files\Clock\Clock.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program Files\Topdesk	opdesk.exe
C:\documents and settings\administrateur\local settings\application data\pbcnjav.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{89B02C7D-CBB7-46DC-8ED8-D028A6CD506B}\sign.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe
C:\Program Files\Nero\Nero 7\Core
ero.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Orange\LiveboxUtilities\LiveboxUtilities.exe
C:\Program Files\Orange\browser\browser.exe
C:\PROGRA~1\FOXITS~1\FOXITR~1\FOXITR~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lo.st
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\Drive\vsdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKCU\..\Run: [Vistadrv] "C:\Windows\Drive\vsdrv.exe"
O4 - HKCU\..\Run: [Signature] "C:\Windows\Drive\sign.exe"
O4 - HKCU\..\Run: [Horlorge] "C:\program Files\Clock\Clock.exe"
O4 - HKCU\..\Run: [Sidebar] "C:\program Files\Windows Sidebar\sidebar.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon.dll" Manager.exe
O4 - HKCU\..\Run: [3D] "C:\program Files\Topdesk	opdesk.exe"
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKCU\..\Run: [pbcnjav] "c:\documents and settings\administrateur\local settings\application data\pbcnjav.exe" pbcnjav
O4 - HKUS\S-1-5-19\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Vistadrv] C:\Windows\Drive\vsdrv.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Signature] C:\Windows\Drive\sign.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Horlorge] C:\program Files\Clock\Clock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] C:\program Files\Windows Sidebar\sidebar.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Radio Fr Solo 2.1
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217965862638&h=f62aceedee01913b908807ea7248ba8b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer = 192.168.1.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: __c00AF42C - C:\WINDOWS\system32\__c00AF42C.dat (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe (file missing)

geoffrey5 · Answer

ok...ton pc est très infecté...commence par faire ceci stp :

télécharge sur le bureau Navilog1 à cette adresse (c est le numéro 1 en bas de la page) : https://www.androidworld.fr/

Si votre antivirus s'affole , le désactiver 
=sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
=sous XP : double-clic dessus pour l'installer et le lancer 

 
Quand installé 
= taper F 
= Appuyer sur une touche jusqu' arriver aux options 
= Choisir Recherche ( = taper 1 ) 
ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes 

un rapport : fixnavi.txt 
dans ==> C : 
le copier et le coller dans la réponse

blackss · Answer

je te donne le rapport pour moi cest du marsien je te remerci pour ton aide 


Search Navipromo version 3.6.5 commencé le 18/09/2008 à 10:36:23,39

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Administrateur" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***

Favorit

*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" : 

pbcnjav.dat trouvé !
pbcnjav.exe trouvé !
pbcnjav_nav.dat trouvé !
pbcnjav_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 18/09/2008 à 10:40:23,04 ***

geoffrey5 · Answer

Salut !!

ok maintenant fais ceci stp :

- Double-Clic navilog1 
- Choisir cette fois option 2 taper 2 
note : le bureau disparaît 
-redémarrage du pc 
- mettre le rapport dans la réponse


ensuite :


Télécharge Toolbar-S&D (Team IDN) sur ton Bureau à cette adresse :

(c est le numéro 6 en bas de la page) : https://www.androidworld.fr/ 
 

* Lance l'installation du programme en exécutant le fichier téléchargé. 
* Double-clique maintenant sur le raccourci de Toolbar-S&D. 
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée. 
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche. 
* Poste le rapport généré. (C:\TB.txt)

blackss · Answer

jai dejas faits une desinfection pour un autre probleme je te donne le nouveau rapport de recherche

Search Navipromo version 3.6.5 commencé le 18/09/2008 à 15:22:24,07

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Administrateur" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Administrateur\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 18/09/2008 à 15:26:47,95 ***

geoffrey5 · Answer

Pourquoi as tu refais une recherche ??^^

As tu fais la suppression avec navilog ??

blackss · Answer

non je lai faite avec toolbar sd

geoffrey5 · Answer

http://www.commentcamarche.net/forum/affich 8463192 message windows#5

blackss · Answer

le rapport de toolbar


   -----------\  ToolBar S&D 1.2.0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Administrateur ( Administrator )
   BOOT : Normal boot
   Antivirus : Kaspersky Anti-Virus 8.0.0.357 (Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total : 45 Go Free : 14 Go
   D:\ (Local Disk) - NTFS - Total : 140 Go Free : 56 Go
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
   Option : [1] ( 18/09/2008|22:34 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Bar"="https://www.orange.fr/portail?kw="
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ADMINI~1\Mes documents\Mes fichiers re‡us\LavaSoft.Ad-Aware.Pro.2007.v7.0.2.7.Incl-Crack.rar
   C:\DOCUME~1\ADMINI~1\Mes documents\Mes fichiers re‡us\Nero 8 Lite v 8.3.2.1 FR\Nero.8.2.8.0.Keygen-CiM
   C:\DOCUME~1\ADMINI~1\Mes documents\Mes fichiers re‡us\Nero 8 Lite v 8.3.2.1 FR\Nero.8.2.8.0.Keygen-CiM\Keygen.exe



   1 - "C:\ToolBar SD\TB_1.txt" - 17/09/2008|13:02 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 18/09/2008| 2:29 - Option : [2]
   3 - "C:\ToolBar SD\TB_3.txt" - 18/09/2008|22:49 - Option : [1]

   -----------\  Fin du rapport a 22:49:48,32

geoffrey5 · Answer

il faut que tu fasses la suppression avec navilog :

- Double-Clic navilog1 
- Choisir cette fois option 2 taper 2 
note : le bureau disparaît 
-redémarrage du pc 
- mettre le rapport dans la réponse

blackss · Answer

Clean Navipromo version 3.6.5 commencé le 18/09/2008 à 23:20:10,90

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Administrateur" 

Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

 
*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)
 

*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" * 



*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Administrateur\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Administrateur\menudm~1\progra~1" *** 



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Administrateur\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *


* Dans "C:\Documents and Settings\Administrateur\locals~1\applic~1" * 


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltdt absent !

*** Nettoyage terminé le 18/09/2008 à 23:24:14,84 ***

geoffrey5 · Answer

refais un nouveau rapport hijackthis pour vérifier stp

blackss · Answer

ça me le fait toujour 




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:35 , on 18/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\program Files\Clock\Clock.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program Files\Topdesk	opdesk.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{9EDACA14-E09C-4CB0-AA69-DB51E72C59F0}\sign.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.orange.fr/portail?kw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.orange.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\Drive\vsdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKCU\..\Run: [Vistadrv] "C:\Windows\Drive\vsdrv.exe"
O4 - HKCU\..\Run: [Signature] "C:\Windows\Drive\sign.exe"
O4 - HKCU\..\Run: [Horlorge] "C:\program Files\Clock\Clock.exe"
O4 - HKCU\..\Run: [Sidebar] "C:\program Files\Windows Sidebar\sidebar.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon.dll" Manager.exe
O4 - HKCU\..\Run: [3D] "C:\program Files\Topdesk	opdesk.exe"
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKUS\S-1-5-19\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Vistadrv] C:\Windows\Drive\vsdrv.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Signature] C:\Windows\Drive\sign.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Horlorge] C:\program Files\Clock\Clock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] C:\program Files\Windows Sidebar\sidebar.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Radio Fr Solo 2.1
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217965862638&h=f62aceedee01913b908807ea7248ba8b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer = 192.168.1.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: __c00AF42C - C:\WINDOWS\system32\__c00AF42C.dat (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe (file missing)

geoffrey5 · Answer

Le message d erreur que tu as toujours ??


télécharge combofix (par sUBs) à cette adresse : 

(c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

et enregistre le sur le Bureau. 

  
désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
 

ensuite envois le rapport et refais un nouveau rapport hijackthis stp

blackss · Answer

j'ai dus faire une restauration car je pouvait plus aller sur internet apres mettr servi de combofix

geoffrey5 · Answer

Tu n avais pas besoin de faire une restauration, il suffisait d aller réparer ta connexion...

Tu as fais une restauration à quelle date ??


Rends toi sur ce site : 
http://www.zonavirus.com/datos/descargas/95/elibagla.asp 
tout en bas de cette page tu trouveras un outil 
à télécharger,clique sur "escargar Elibagla" (le numéro de version change au fur et à mesure des mises à jour) 
installe ce fichier sur le Bureau. 
ensuite double-clic sur Elibagla.exe 
>laisse la case "eliminar ficheros automaticamente" coché 
>clique sur"explorar" 
>laisse-le travailler 

Redémarre en mode sans échec, 

Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter. 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

relance 2 fois elibagla 

redémarre en mode normal 

>poste le rapport final qui sera dans c:\infosat.txt 

ensuite refais un nouveau rapport hijackthis stp

blackss · Answer

voila le rapport


	  Fri Sep 19 00:32:28 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Fri Sep 19 00:32:39 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   4269
Nº Total de Ficheros:      48123
Nº de Ficheros Analizados: 7634
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Fri Sep 19 00:35:45 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Fri Sep 19 00:35:51 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   4269
Nº Total de Ficheros:      48123
Nº de Ficheros Analizados: 7634
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Fri Sep 19 00:39:04 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Fri Sep 19 00:39:05 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   4270
Nº Total de Ficheros:      48127
Nº de Ficheros Analizados: 7635
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Fri Sep 19 00:41:43 2008
EliBagle v11.74  (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 18 de Septiembre del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   4270
Nº Total de Ficheros:      48127
Nº de Ficheros Analizados: 7635
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

geoffrey5 · Answer

ok maintenant fais ceci stp :

Telecharge FindyKill (de chiquitine) :

-->Fais un clic droit sur ce lien, enregistrer sous ....le bureau

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.rar

Dezippe le sur le bureau

Entre dans le dossier FindyKill

double clic sur findyKill.exe

choisi l option 1 (recheche)

---> Un rapport va souvrir, post le sur le forum

Note : Le rapport est suvegardé a la racine du disque

blackss · Answer

je peut pas le telecharger il me marque errreur 404 objet non trouver

geoffrey5 · Answer

il y a un problème sur l hébergeur, ça fait pareil avec un autre programme  :s

Télécharger sur le bureau malwarebytes à cette adresse : 

https://www.androidworld.fr/
 
&#x25B6; Voici un tuto pour bien l installer et bien l utiliser : 

https://www.androidworld.fr/

aide toi bien du tuto pour supprimer correctement ce qu il aura trouvé
 

Après l analyse, redémarrer le pc et poste le rapport !!

Et refais un nouveau rapport hijackthis stp

blackss · Answer

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1172
Windows 5.1.2600 Service Pack 2

2008-09-19 07:08:39
mbam-log-2008-09-19 (07-08-39).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 90818
Temps écoulé: 19 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 231

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00af42c (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.QHost) -> Data: wowfx.dll -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\append.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xlib254.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108953.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108954.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108955.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108956.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108957.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108968.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108969.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-63.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-52.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-53.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-54.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-60.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-61.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-62.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-64.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-65.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-66.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-67.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-68.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-69.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\A0109955.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\A0109958.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-63.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-81.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-52.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-53.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-54.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-60.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-61.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-62.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-64.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-65.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-66.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-67.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-68.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-69.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-70.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-71.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-72.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-73.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-74.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-75.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-76.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-77.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-78.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-79.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-80.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-82.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-83.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-84.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-85.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\A0109960.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\A0109966.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\A0109968.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd\altcmd.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd\uninstall.bat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mshtml90.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wowfx.dll (Trojan.QHost) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bin32\rc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

blackss · Answer

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1172
Windows 5.1.2600 Service Pack 2

2008-09-19 07:08:39
mbam-log-2008-09-19 (07-08-39).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 90818
Temps écoulé: 19 minute(s), 38 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 231

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00af42c (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.QHost) -> Data: wowfx.dll -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\WINDOWS\system32\append.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xlib254.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108953.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108954.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108955.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108956.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108957.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108968.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\A0108969.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-63.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-52.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-53.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-54.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-60.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-61.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-62.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-64.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-65.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-66.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-67.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-68.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-69.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP580\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\A0109955.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\A0109958.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-63.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-81.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-52.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-53.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-54.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-60.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-61.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-62.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-64.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-65.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-66.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-67.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-68.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-69.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-70.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-71.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-72.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-73.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-74.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-75.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-76.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-77.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-78.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-79.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-80.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-82.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-83.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-84.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-85.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP581\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\A0109960.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\A0109966.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP582\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\A0109968.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-27.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-45.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-1.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-10.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-11.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-12.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-13.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-14.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-15.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-16.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-17.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-18.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-19.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-2.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-20.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-21.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-22.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-23.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-24.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-25.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-26.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-28.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-29.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-3.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-30.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-31.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-32.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-33.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-34.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-35.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-36.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-37.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-38.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-39.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-4.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-40.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-41.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-42.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-43.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-44.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-46.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-47.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-48.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-49.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-5.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-50.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-51.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-55.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-56.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-57.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-58.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-59.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-6.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-7.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-8.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{D84C33C0-3A50-40A9-B62E-4B620230C09C}\RP583\snapshot\MFEX-9.DAT (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd\altcmd.inf (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\altcmd\uninstall.bat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk (Rogue.Antispyware) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mshtml90.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wowfx.dll (Trojan.QHost) -> Quarantined and deleted successfully.
C:\Documents and Settings\Bin32\rc.exe (Trojan.Agent) -> Quarantined and deleted successfully.

geoffrey5 · Answer

waouw !! Quel beau travail il a fait  ;-)

fais ceci maintenant pour vérifier stp :

Option 1 - Recherche :


télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) : 

https://www.androidworld.fr/

* Ensuite double clique sur smitfraudfix puis exécuter

* Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

(attention : N utilises pas l option 2 si je ne te l ai pas demandé !!)

* copier/coller le rapport dans la réponse.


Un tutoriel sonore et animé est à ta disposition sur le site.



(Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, 
cet utilitaire pourrait arrêter des logiciels de sécurité.)

blackss · Answer

SmitFraudFix v2.352

Rapport fait à  7:29:02.21, 2008-09-19
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\program Files\Clock\Clock.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program Files\Topdesk	opdesk.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{B767116D-B25E-45D6-B61E-6C7637C9625D}\sign.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Orange\browser\browser.exe
C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\sav\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!



»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.11

Description: NVIDIA nForce Networking Controller - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

geoffrey5 · Answer

ok maintenant fais ceci stp :

Option 2 - Nettoyage :


Redémarrer l'ordinateur en mode sans échec (tapoter rapidement la touche F8 au démarrage du pc pour obtenir le menu des options avancées).

Double cliquer sur smitfraudfix

Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

Enregistre le rapport sur ton bureau


Redémarrer en mode normal et poster le rapport. 

ensuite refais un nouveau rapport hijackthis stp

blackss · Answer

SmitFraudFix v2.352

Rapport fait à  7:49:39.46, 2008-09-19
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\Program Files\sav\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CS2\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer=192.168.1.11
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

blackss · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:58:46, on 2008-09-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Orange\Systray\SystrayApp.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\program Files\Clock\Clock.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\1\AlertModule.exe
C:\program Files\Topdesk	opdesk.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\{CFDB73F0-C324-45B0-A6E9-3EC6F041331B}\sign.exe
C:\program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Orange\Launcher\Launcher.exe
C:\Program Files\Orange\Deskboard\deskboard.exe
C:\Program Files\Orange\connectivity\connectivitymanager.exe
C:\Program Files\Orange\browser\browser.exe
C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Vistadrv] C:\WINDOWS\Drive\vsdrv.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SystrayORAHSS] "C:\Program Files\Orange\Systray\SystrayApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [Vistadrv] "C:\Windows\Drive\vsdrv.exe"
O4 - HKCU\..\Run: [Signature] "C:\Windows\Drive\sign.exe"
O4 - HKCU\..\Run: [Horlorge] "C:\program Files\Clock\Clock.exe"
O4 - HKCU\..\Run: [Sidebar] "C:\program Files\Windows Sidebar\sidebar.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon.dll" Manager.exe
O4 - HKCU\..\Run: [3D] "C:\program Files\Topdesk	opdesk.exe"
O4 - HKCU\..\Run: [MsgCenterExe] "C:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe"  -osboot
O4 - HKUS\S-1-5-19\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Vistadrv] C:\Windows\Drive\vsdrv.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Signature] C:\Windows\Drive\sign.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Horlorge] C:\program Files\Clock\Clock.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] C:\program Files\Windows Sidebar\sidebar.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [3D] C:\program Files\Topdesk	opdesk.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Radio Fr Solo 2.1
O4 - Startup: YesMessenger.lnk = C:\Program Files\YesMessenger\YesMessenger.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://www.orange.fr/portail
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1217965862638&h=f62aceedee01913b908807ea7248ba8b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{24368A92-8C59-4422-B684-B2DD37A56BF9}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9F28C925-6ACB-4651-AF88-9F88910FFA3E}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF941B1A-4AB9-4BEA-B64E-4CC48FE88EE6}: NameServer = 192.168.1.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{DAE5727E-AB9F-41EB-8BB5-0A77115488F4}: NameServer = 192.168.1.1
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe (file missing)

blackss · Answer

jai plus mon fond d'ecrant cest normal ou pas ?

geoffrey5 · Answer

relance hijackthis en cliquant sur scan only et coches ces lignes stp :

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)     
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k 
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe     
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"     
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"     

puis tu cliques sur fix checked.

je vois que tu as 2 antivirus : kaspersky et bitdefender...Ne jamais installer 2 antivirus sur le meme pc !

Lequel utilises tu ??

geoffrey5 · Answer

C était quoi comme fond d'écran ??

blackss · Answer

j'utilise kaspersky jai retrouver mon fond d'ecrant ça l'avait enlever cest normal?

geoffrey5 · Answer

Tu avais un fichier infecté que smitfraudfix a supprimé...C est surement à cause de ca.

Vas voir dans ajout/suppression de programmes si bitdefender s y trouve...Et désinstalles le stp

blackss · Answer

il est supprimer bitdefender une fois fini j'efface hijackthis ;novilog; combofix; malwarebytes; lopsd; toolbar smitfraudfix;elibagla ou pas ?

geoffrey5 · Answer

On va y venir...est ce que tu as encore des problèmes ??

blackss · Answer

oui je suis chez orange et quand je met mon naviguateur en route ça me met internet explorer je suis aller voir dans conexion reseau et il y a marquer orange HSS peripherique non disponible

geoffrey5 · Answer

ok...Je te propose d aller créer un nouveau topic dans la rubrique "internet" en y expliquant ton problème...

Quelqu un viendra surement t aider pour résoudre ce problème..

Si tu n as plus d autres problèmes, tu peux faire ceci pour terminer stp :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :  

&#x25B6; Télécharge toolscleaner sur ton Bureau : 

(c est le numéro 15 en bas de la page) : https://www.androidworld.fr/ 

&#x25B6; Double-clique sur ToolsCleaner2.exe et laisse le travailler 
&#x25B6; Clique sur Recherche et laisse le scan se terminer. 
&#x25B6; Clique sur Suppression pour finaliser. 
&#x25B6; Tu peux, si tu le souhaites, te servir des Options facultatives. 
&#x25B6; Clique sur Quitter, pour que le rapport puisse se créer. 
&#x25B6; Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse




Désactive et réactive la Restauration du système :
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration en cliquant sur démarrer => tous les programmes => accessoires =>

outils systeme => restauration du systeme => créer un point de restauration => tu mets un nom

(exemple : après désinfection sur CCM) puis tu valides.

blackss · Answer

jai supprimer mais je trouve pas le rapport 
il reste combofix;elibagla;toolcleaner2 malwarebytes je les supprimes ou pas ?

geoffrey5 · Answer

ok...tu peux supprimer elibagla et combofix.

Mais gardes malwarebytes c est un excellent logiciel...Tu pourras faire de temps en temps une mise à jour et une analyse...

blackss · Answer

merci pour ton aide

geoffrey5 · Answer

Mais de rien blackss, je t ai aidé avec plaisir  ;-)

Bonne journée @+

Message windows

41 réponses

Discussions similaires