TR/Crypt.XPACK.Gen

Je me rends compte que j'ai trois rapports alors que je pensais n'avoir fait qu'un scan la première fois,...
Bref, ci dessous et dans l'orde les 3 rapports:

1-----------------------------


Avira AntiVir Personal
Report file date: mardi 30 septembre 2008 16:42

Scanning for 1651060 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: Szrajber
Computer name: SZRAJBER-EBD598

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:36:36
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:53:28
ANTIVIR2.VDF : 7.0.6.217 3773440 Bytes 26/09/2008 13:56:58
ANTIVIR3.VDF : 7.0.6.228 80896 Bytes 30/09/2008 09:10:40
Engineversion : 8.1.1.35
AEVDF.DLL : 8.1.0.5 102772 Bytes 02/04/2008 12:36:34
AESCRIPT.DLL : 8.1.0.76 319867 Bytes 18/09/2008 12:03:16
AESCN.DLL : 8.1.0.23 119156 Bytes 15/07/2008 13:58:46
AERDL.DLL : 8.1.1.2 438644 Bytes 18/09/2008 12:03:16
AEPACK.DLL : 8.1.2.3 364918 Bytes 24/09/2008 06:55:54
AEOFFICE.DLL : 8.1.0.25 196986 Bytes 18/09/2008 12:03:16
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 18/09/2008 12:03:16
AEHELP.DLL : 8.1.0.15 115063 Bytes 29/05/2008 12:08:42
AEGEN.DLL : 8.1.0.36 315764 Bytes 18/08/2008 16:05:36
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 12:02:16
AECORE.DLL : 8.1.1.11 172406 Bytes 03/09/2008 14:22:32
AEBB.DLL : 8.1.0.1 53617 Bytes 18/07/2008 09:20:50
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 7.0.0.1 155688 Bytes 30/06/2008 14:35:20
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, E:, H:, J:, K:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: mardi 30 septembre 2008 16:42

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Boot sector 'H:\'
[INFO] No virus was found!
Boot sector 'J:\'
[INFO] No virus was found!
Boot sector 'K:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '55' files ).


Starting the file scan:

Begin scan in 'C:\' <Windows>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\WINDOWS\Nircmd.exe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
[NOTE] The file was moved to '49544da4.qua'!
Begin scan in 'E:\' <Audio-Vidéo>
Begin scan in 'H:\' <My Passport>
Begin scan in 'J:\' <Alekss>
Begin scan in 'K:\' <ANYWAY>
K:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP568\A0071409.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '491251fd.qua'!
K:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP568\A0071410.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was moved to '49125203.qua'!


End of the scan: mardi 30 septembre 2008 18:20
Used time: 1:38:54 Hour(s)

The scan has been done completely.

4795 Scanning directories
153965 Files were scanned
3 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
3 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
153961 Files not concerned
611 Archives were scanned
1 Warnings
3 Notes

2--------------------------------------------------------


Avira AntiVir Personal
Report file date: mardi 30 septembre 2008 18:29

Scanning for 1651060 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: SZRAJBER-EBD598

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:36:36
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:53:28
ANTIVIR2.VDF : 7.0.6.217 3773440 Bytes 26/09/2008 13:56:58
ANTIVIR3.VDF : 7.0.6.228 80896 Bytes 30/09/2008 09:10:40
Engineversion : 8.1.1.35
AEVDF.DLL : 8.1.0.5 102772 Bytes 02/04/2008 12:36:34
AESCRIPT.DLL : 8.1.0.76 319867 Bytes 18/09/2008 12:03:16
AESCN.DLL : 8.1.0.23 119156 Bytes 15/07/2008 13:58:46
AERDL.DLL : 8.1.1.2 438644 Bytes 18/09/2008 12:03:16
AEPACK.DLL : 8.1.2.3 364918 Bytes 24/09/2008 06:55:54
AEOFFICE.DLL : 8.1.0.25 196986 Bytes 18/09/2008 12:03:16
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 18/09/2008 12:03:16
AEHELP.DLL : 8.1.0.15 115063 Bytes 29/05/2008 12:08:42
AEGEN.DLL : 8.1.0.36 315764 Bytes 18/08/2008 16:05:36
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 12:02:16
AECORE.DLL : 8.1.1.11 172406 Bytes 03/09/2008 14:22:32
AEBB.DLL : 8.1.0.1 53617 Bytes 18/07/2008 09:20:50
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 7.0.0.1 155688 Bytes 30/06/2008 14:35:20
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, E:, H:, J:, K:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: mardi 30 septembre 2008 18:29

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'Tablet.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
20 processes with 20 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Boot sector 'H:\'
[INFO] No virus was found!
Boot sector 'J:\'
[INFO] No virus was found!
Boot sector 'K:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '54' files ).


Starting the file scan:

Begin scan in 'C:\' <Windows>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076814.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076815.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076844.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076849.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076850.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076903.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076908.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076909.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076917.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076918.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076926.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076938.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076939.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076957.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076963.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076964.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077011.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077016.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077017.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077064.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077069.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077070.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077076.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077077.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077087.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077092.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077093.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077101.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077102.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077110.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077111.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077135.EXE
[DETECTION] Contains recognition pattern of the APPL/PsExec.E application
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077150.exe
[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077159.com
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077177.exe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077202.EXE
[DETECTION] Contains recognition pattern of the APPL/PsExec.E application
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077217.exe
[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077226.com
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077246.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP270\A0077281.exe
[0] Archive type: RAR SFX (self extracting)
--> 32788R22FWJFW\hidec.exe
[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program
--> 32788R22FWJFW\NirCmd.cfexe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
--> 32788R22FWJFW\nircmd.com
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
--> 32788R22FWJFW\NirCmdC.cfexe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.1.B application
--> 32788R22FWJFW\psexec.cfexe
[1] Archive type: RSRC
--> Object
[DETECTION] Contains recognition pattern of the APPL/PsExec.E application
[NOTE] The file was moved to '4912587e.qua'!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP271\A0077368.exe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
[NOTE] The file was deleted!
Begin scan in 'E:\' <Audio-Vidéo>
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076816.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076817.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076851.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076852.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076910.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076911.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076919.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076920.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076940.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076941.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076965.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0076966.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077018.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077019.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077071.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077072.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077078.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077079.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077094.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077095.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077103.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077104.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
E:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077247.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
Begin scan in 'H:\' <My Passport>
H:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP610\A0080875.exe
[0] Archive type: RAR SFX (self extracting)
--> 32788R22FWJFW\hidec.exe
[DETECTION] Contains recognition pattern of the SPR/Tool.Hide.A program
--> 32788R22FWJFW\NirCmd.cfexe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
--> 32788R22FWJFW\nircmd.com
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.2.B application
--> 32788R22FWJFW\NirCmdC.cfexe
[DETECTION] Contains recognition pattern of the APPL/NirCmd.E.1.B application
--> 32788R22FWJFW\psexec.cfexe
[1] Archive type: RSRC
--> Object
[DETECTION] Contains recognition pattern of the APPL/PsExec.E application
[NOTE] The file was moved to '49125ba2.qua'!
Begin scan in 'J:\' <Alekss>
J:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP564\A0070243.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP595\A0073100.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{004AA4CB-CEFA-470B-84B6-7AE41AC1EA5D}\RP595\A0073101.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076885.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076886.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077020.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP266\A0077021.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077097.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP267\A0077098.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077107.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP268\A0077108.inf
[DETECTION] Contains recognition pattern of the WORM/Autorun.dtv worm
[NOTE] The file was deleted!
J:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP269\A0077249.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
J:\System Volume Information\_restore{B8A10E0C-7E71-439D-A903-AEC5A643C375}\RP402\A0096390.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
Begin scan in 'K:\' <ANYWAY>


End of the scan: mardi 30 septembre 2008 19:03
Used time: 33:54 Minute(s)

The scan has been done completely.

4864 Scanning directories
155048 Files were scanned
86 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
76 files were deleted
0 files were repaired
2 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
154961 Files not concerned
614 Archives were scanned
1 Warnings
78 Notes

3------------------------------------------------------------------------------


Avira AntiVir Personal
Report file date: mardi 30 septembre 2008 18:29

Scanning for 1651060 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: SZRAJBER-EBD598

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 12:36:36
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:53:28
ANTIVIR2.VDF : 7.0.6.217 3773440 Bytes 26/09/2008 13:56:58
ANTIVIR3.VDF : 7.0.6.228 80896 Bytes 30/09/2008 09:10:40
Engineversion : 8.1.1.35
AEVDF.DLL : 8.1.0.5 102772 Bytes 02/04/2008 12:36:34
AESCRIPT.DLL : 8.1.0.76 319867 Bytes 18/09/2008 12:03:16
AESCN.DLL : 8.1.0.23 119156 Bytes 15/07/2008 13:58:46
AERDL.DLL : 8.1.1.2 438644 Bytes 18/09/2008 12:03:16
AEPACK.DLL : 8.1.2.3 364918 Bytes 24/09/2008 06:55:54
AEOFFICE.DLL : 8.1.0.25 196986 Bytes 18/09/2008 12:03:16
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 18/09/2008 12:03:16
AEHELP.DLL : 8.1.0.15 115063 Bytes 29/05/2008 12:08:42
AEGEN.DLL : 8.1.0.36 315764 Bytes 18/08/2008 16:05:36
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 12:02:16
AECORE.DLL : 8.1.1.11 172406 Bytes 03/09/2008 14:22:32
AEBB.DLL : 8.1.0.1 53617 Bytes 18/07/2008 09:20:50
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 7.0.0.1 155688 Bytes 30/06/2008 14:35:20
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, E:, H:, J:, K:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: mardi 30 septembre 2008 18:29

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'Tablet.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
20 processes with 20 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Boot sector 'H:\'
[INFO] No virus was found!
Boot sector 'J:\'
[INFO] No virus was found!
Boot sector 'K:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '54' files ).


Starting the file scan:

Begin scan in 'C:\' <Windows>
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076814.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was deleted!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076844.dll
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{8188D0DC-C06C-44BD-AD3E-5542C5E397A2}\RP265\A0076849.com
[WARNING] The file could not be opened!
Begin scan in 'E:\' <Audio-Vidéo>
Begin scan in 'H:\' <My Passport>
Begin scan in 'J:\' <Alekss>
Begin scan in 'K:\' <ANYWAY>


End of the scan: mardi 30 septembre 2008 19:12
Used time: 43:12 Minute(s)

The scan has been done completely.

4864 Scanning directories
154770 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
1 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
3 Files cannot be scanned
154766 Files not concerned
612 Archives were scanned
3 Warnings
1 Notes

je te remercie mille fois pour tout !!!

Ouf,

Je te remercie d'avoir pris le temps de me répondre...
Bien, j'ai donc trop d'antivirus sur le pc connecté à internet, heureuse d'avoir au moins appris ça aujourd'hui (c'est que ça fait tellement paniquer l'idée du virus...) !!!
Quel antivirus et firewall dois-je garder selon toi ?

juste un "essais de réponse", je ne sais pas si je t'ai répondu directement lors de ma première réponse. C'est ma première sur un forum.

Ok, pas de soucis.
Je choisis donc 1 seul et unique antivirus pour l'ordi connecté à internet.
Et comment est ce que je fais pour me débarrasser des virus sur l'ordi non connecté ? J'ai vu dans d'autres discussions que pour se débarrasser complétement du Cheval de trois Crypt.XPACK.Gen c'était pas si simple que ça, et la façon de procéder a l'air de dépendre du rapport HiJackThis. Saurais tu me dire ce qu'il en est ?
Merci

Super, je te remercie de me venir en aide...
Par contre, ma grande question est de savoir si je peux faire tout cela sur l'ordi non connecté à internet; si je télécharge Combofix via ce PC et que j'importe et installe ensuite le logiciel sur le pC non connecté, je n'aurais pas les mise à jour, non ?

VOILà le rapport !

ComboFix 08-09-27.05 - Szrajber 2008-09-28 20:20:04.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.738 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Szrajber\Bureau\ComboFix.exe
Commutateurs utilisés :: C:\Documents and Settings\Szrajber\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
I:\g83816.com
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\g83816.com

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-28 au 2008-09-28 ))))))))))))))))))))))))))))))))))))
.

2008-09-27 17:24 . 2008-09-27 17:24 <REP> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2002-07-26 15:02 153,088 ----a-w C:\Program Files\UNWISE.EXE
1999-10-12 15:45 30,208 ----a-w C:\Program Files\DeCSS.exe
1999-10-12 15:27 1,562 ----a-w C:\Program Files\readme.txt
1999-02-02 17:10 57,344 ----a-w C:\Program Files\wnaspi32.w2k.dll
1998-05-11 18:01 36,864 ----a-w C:\Program Files\Wnaspi32.w98.dll
.

((((((((((((((((((((((((((((( snapshot@2008-09-28_19.27.51.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-28 17:26:33 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-09-28 17:28:01 52,764 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-09-28 17:26:33 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-09-28 17:28:01 63,614 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-09-28 17:26:33 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-09-28 17:28:01 380,350 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-09-28 17:26:33 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-09-28 17:28:01 445,016 ----a-w C:\WINDOWS\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360]
"InstantTray"="C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2004-09-02 770048]
"IW_Drop_Icon"="C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2004-07-30 1123840]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 406016]
"USB2Check"="C:\WINDOWS\system32\PCLECoInst.dll" [2004-09-21 73728]
"AdobeVersionCue"="C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-22 1732608]
"USBToolTip"="C:\Program Files\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe" [2004-04-23 192512]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-07-05 C:\WINDOWS\ALCWZRD.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= vdrcodec.dll
"VIDC.DVSD"= RALCodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Liquid.6\\Program\\RM.exe"=
"C:\\Program Files\\Liquid.6\\Program\\Studiou.mod"=

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys [2003-08-01 29239]
R1 vobcom;vobcom;C:\WINDOWS\system32\drivers\vobcom.sys [2001-10-04 9728]
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-07-06 188416]
R2 NwSapAgent;Agent SAP;C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2004-08-03 62976]
S3 PinnacleMarvinPro;Pinnacle Systems Liquid Edition PRO Device;C:\WINDOWS\system32\DRIVERS\MarvinPro.sys [2004-09-28 1714176]
S3 Umiapode;Umiapode;C:\WINDOWS\system32\drivers\partmgr.sys [2004-08-05 18688]
.
Contenu du dossier 'Tâches planifiées'
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-28 20:22:18
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

PROCESSUS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
------------------------ Autres processus actifs ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Heure de fin: 2008-09-28 20:23:29 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-09-28 18:23:26
ComboFix2.txt 2008-09-28 17:28:12

Avant-CF: 71ÿ921ÿ442ÿ816 octets libres
Après-CF: 71,911,251,968 octets libres

108

C'est ok, de mon côté j'ai bien suivi à la lettre tout ce que tu m'as dis de faire
Est ce que je te remercie BEAUCOUP BEAUCOUP tout de suite ou est ce qu'il y a encore quelque chose à faire ?
Et, question subsidiaire : est ce qu'on se débarrasse définitivement des virus et autres méchancetés lorsqu'on formate un disque, une clé usb ?

Bonsoir " Destrio5 ", et j'espère sans rancunes /// OK

Sois attentif à ce que j'écris => c'est important !!
Je risque même de poster à Jeff ,( WebMaster sur CCM en tant que privé), mais en respectant les désirs d'sUBs , puis sur la section "contributeur" de CCM

...En fait sur CCM, vous utilisez de "puissants" outils comme Combo//Avenger/etc... => etes vous formé à ces outils
?
Déjà Sarra, a bien déparée en donnant des infos privées, comme Afiged =>ils sont tous les deux exclus , des forums privés.

...Revenons à notre helpé :
C:\autorun.inf
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo0.dll
E:\Autorun.inf
H:\Autorun.inf
I:\autorun.inf
J:\Autorun.inf

...Pas besoin de combo pour cela => un simple CCM.reg aurait tout nettoyé, de plus visible dès son 1er log
....Un outil "générique" aussi //VS Lazzzy/Narco, aurait fait le boulot !

Cordialement

...

Re Destrio5

...Je suis comme toi "membre sur CCM", donc aucun problème pour me joindre en MP

Efface ton adresse eMail, sur un forum "public" /// OK

Cordialement

Re, ça c'est nouveau /// MDR

... Voir avec "Serge" Modérateur sur CCM , j'ai envoyé par MP, il y a 2 semaines, une notification dans ce sens, mais à ce soir, le MP envoyé à Serge n'est pas lu ( ouvert ) =>CQFD ???

...Bien à demain, j'ai le job qui va bien m'occuper, toute la journée
Cordialement

Re

...J'essaie de voir cela ce soir avec "Serge" , c'est dans ma configue sur CCM que cela merdouille, tu n'y es pour rien / OK

...De toute façon, je ne publierai pas mes adresses eMail sur un forum "public"
A demain // DSL => je vais dormir