antivirus 2009 a encore frappé Résolu/Fermé

Question

Bonjour,

C la merdoum, pourriez vous m'aider à m'en débarrasser et sécuriser mon pc?

Merci Cimer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59: VIRUS ALERT!, on 10/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphctstj0ejpm.exe
C:\Program Files\MicroAntivirus\microAV.exe
C:\Program Files\PC-Antispy\PC-Antispy.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\khovglwv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Documents and Settings\Elisabeth\Bureau\hello.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {1ED8C6DA-6421-4C89-A772-B757F96CA697} - C:\WINDOWS\system32\pmnmjHbb.dll
O2 - BHO: PC-Antispy Site Blocker Button - {60B244BE-559D-4269-B96E-CD264D828EC9} - C:\Program Files\PC-Antispy\ASpyStBlk.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: QXK Olive - {A6B5301C-5049-44C9-8297-FC5388309F7F} - C:\WINDOWS
kefbltdnbp.dll
O2 - BHO: {fe2a1b04-4283-d59a-2e54-5581d9ac5e7a} - {a7e5ca9d-1855-45e2-a95d-382440b1a2ef} - C:\WINDOWS\system32\fihyww.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {E5DD1D15-0067-4BF3-B3F5-1F6510A7C405} - C:\WINDOWS\system32\fccabbBt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: dkwqgnbe - {62CC302E-8074-4416-BADC-C2306E39538C} - C:\WINDOWS\dkwqgnbe.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [\YURDB1.exe] C:\Windows\system32\YURDB1.exe
O4 - HKLM\..\Run: [\YURDB2.exe] C:\Windows\system32\YURDB2.exe
O4 - HKLM\..\Run: [\YURDB3.exe] C:\Windows\system32\YURDB3.exe
O4 - HKLM\..\Run: [\YURDB4.exe] C:\Windows\system32\YURDB4.exe
O4 - HKLM\..\Run: [lphctstj0ejpm] C:\WINDOWS\system32\lphctstj0ejpm.exe
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\MicroAntivirus\microAV.exe
O4 - HKLM\..\Run: [\YURDC5.exe] C:\Windows\system32\YURDC5.exe
O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKLM\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKLM\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
O4 - HKLM\..\Run: [\YUR6.exe] C:\Windows\system32\YUR6.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PC-Antispy] "C:\Program Files\PC-Antispy\PC-Antispy.exe" hide
O4 - HKLM\..\Run: [6b89b910] rundll32.exe "C:\WINDOWS\system32\enptiavt.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [] C:\Documents and Settings\Elisabeth\Application Data\Adobe\Player.exe
O4 - HKCU\..\Run: [\YURDB1.exe] C:\Windows\system32\YURDB1.exe
O4 - HKCU\..\Run: [\YURDB2.exe] C:\Windows\system32\YURDB2.exe
O4 - HKCU\..\Run: [\YURDB3.exe] C:\Windows\system32\YURDB3.exe
O4 - HKCU\..\Run: [\YURDB4.exe] C:\Windows\system32\YURDB4.exe
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\MicroAntivirus\microAV.exe
O4 - HKCU\..\Run: [MntShHlp] C:\WINDOWS\system32\khovglwv.exe
O4 - HKCU\..\Run: [\YURDC5.exe] C:\Windows\system32\YURDC5.exe
O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe
O4 - HKCU\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe
O4 - HKCU\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe
O4 - HKCU\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe
O4 - HKCU\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
O4 - HKCU\..\Run: [\YUR6.exe] C:\Windows\system32\YUR6.exe
O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RISEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: .security
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: .security
O4 - Global Startup: Dimarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O20 - AppInit_DLLs: fihyww.dll
O20 - Winlogon Notify: pmnmjHbb - C:\WINDOWS\SYSTEM32\pmnmjHbb.dll
O21 - SSODL: dscinfoapp - {584A6E46-8882-E543-C713-08560AAB706B} - C:\Program Files\bplczke\dscinfoapp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
O23 - Service: Service Norton Protection Center (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Destrio5 · Accepted Answer

On verra après.

Destrio5 · Answer

Salut,

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) : 
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/ 

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix

caroingalls · Answer

voici


Rapport fait à  2:00:29,31, 11/10/2008
Executé à partir de C:\Documents and Settings\Elisabeth\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphctstj0ejpm.exe
C:\Program Files\MicroAntivirus\microAV.exe
C:\Program Files\PC-Antispy\PC-Antispy.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\GigaTribe\gigatribe.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fkebanrw.exe PRESENT !
C:\WINDOWS\xgpsarbm.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\1.ico PRESENT !
C:\WINDOWS\system32\2.ico PRESENT !
C:\WINDOWS\system32\MicroAV.cpl PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Elisabeth


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Elisabeth\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ELISAB~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\ELISAB~1\Bureau\MicroAntivirus.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\akl\ PRESENT !
C:\Program Files\MicroAntivirus\ PRESENT !
C:\Program Files\PCHealthCenter\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="fihyww.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport
d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


>
>



----- Fin du message transféré -----

caroingalls · Answer

voici


Rapport fait à  2:00:29,31, 11/10/2008
Executé à partir de C:\Documents and Settings\Elisabeth\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphctstj0ejpm.exe
C:\Program Files\MicroAntivirus\microAV.exe
C:\Program Files\PC-Antispy\PC-Antispy.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\GigaTribe\gigatribe.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fkebanrw.exe PRESENT !
C:\WINDOWS\xgpsarbm.dll PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\1.ico PRESENT !
C:\WINDOWS\system32\2.ico PRESENT !
C:\WINDOWS\system32\MicroAV.cpl PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Elisabeth


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Elisabeth\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ELISAB~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau

C:\DOCUME~1\ELISAB~1\Bureau\MicroAntivirus.lnk PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\akl\ PRESENT !
C:\Program Files\MicroAntivirus\ PRESENT !
C:\Program Files\PCHealthCenter\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="fihyww.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Miniport
d'ordonnancement de paquets
DNS Server Search Order: 212.27.54.252
DNS Server Search Order: 212.27.53.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}:
NameServer=212.27.54.252,212.27.53.252


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin


>
>



----- Fin du message transféré -----

Destrio5 · Answer

- Redémarre ton ordinateur en mode sans échec :
https://blog.sosordi.net/

- Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée

- Réponds O(oui) à ces deux questions si elles te sont posées

Voulez-vous nettoyer le registre ?
Corriger le fichier infecté ?

- Un rapport sera généré, sauvegarde-le sur le bureau

- Redémarre en mode normal

- Poste le rapport SmitfraudFix

caroingalls · Answer

merci d être encore là

grrrrr  chuis encore infectée, j'ai tjs un message 'alerte spyware'



SmitFraudFix v2.356
 
Rapport fait à  2:14:13,39, 11/10/2008
Executé à partir de C:\Documents and
Settings\Elisabeth\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
 
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
 
 
»»»»»»»»»»»»»»»»»»»»»»»» hosts
 
 
127.0.0.1       localhost
 
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
 
S!Ri's WS2Fix: LSP not Found.
 
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
 
GenericRenosFix by S!Ri
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
 
C:\WINDOWS\fkebanrw.exe supprimé
C:\WINDOWS\xgpsarbm.dll supprimé
xgpsarbm not found.
C:\WINDOWS\system32\1.ico supprimé
C:\WINDOWS\system32\2.ico supprimé
C:\WINDOWS\system32\MicroAV.cpl supprimé
C:\DOCUME~1\ELISAB~1\Bureau\MicroAntivirus.lnk supprimé
C:\Program Files\akl\ supprimé
C:\Program Files\MicroAntivirus\ supprimé
C:\Program Files\PCHealthCenter\ supprimé
 
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
 
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
 
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
 
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» RK
 
 
»»»»»»»»»»»»»»»»»»»»»»»» DNS
 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon]
"System"=""
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Fin
 

----- Fin du message transféré -----

caroingalls · Answer

merci d être encore là

grrrrr  chuis encore infectée, j'ai tjs un message 'alerte spyware'



SmitFraudFix v2.356
 
Rapport fait à  2:14:13,39, 11/10/2008
Executé à partir de C:\Documents and
Settings\Elisabeth\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
 
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
 
 
»»»»»»»»»»»»»»»»»»»»»»»» hosts
 
 
127.0.0.1       localhost
 
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
 
S!Ri's WS2Fix: LSP not Found.
 
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
 
GenericRenosFix by S!Ri
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
 
C:\WINDOWS\fkebanrw.exe supprimé
C:\WINDOWS\xgpsarbm.dll supprimé
xgpsarbm not found.
C:\WINDOWS\system32\1.ico supprimé
C:\WINDOWS\system32\2.ico supprimé
C:\WINDOWS\system32\MicroAV.cpl supprimé
C:\DOCUME~1\ELISAB~1\Bureau\MicroAntivirus.lnk supprimé
C:\Program Files\akl\ supprimé
C:\Program Files\MicroAntivirus\ supprimé
C:\Program Files\PCHealthCenter\ supprimé
 
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
 
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
 
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
 
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
 
 
 
»»»»»»»»»»»»»»»»»»»»»»»» RK
 
 
»»»»»»»»»»»»»»»»»»»»»»»» DNS
 
HKLM\SYSTEM\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer=212.27.54.252,212.27.53.252
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon]
"System"=""
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!
 
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Fin
 

----- Fin du message transféré -----

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

caroingalls · Answer

voili voila


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1235
Windows 5.1.2600 Service Pack 2
 
11/10/2008 02:44:24
mbam-log-2008-10-11 (02-44-24).txt
 
Type de recherche: Examen rapide
Eléments examinés: 57582
Temps écoulé: 7 minute(s), 8 second(s)
 
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 86
Valeur(s) du Registre infectée(s): 27
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 34
Fichier(s) infecté(s): 359
 
Processus mémoire infecté(s):
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Unloaded process
successfully.
 
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS\dkwqgnbe.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphctstj0ejpm.scr (Trojan.FakeAlert) -> Delete on
reboot.
 
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pmnmjhbb (Trojan.Vundo.H) -> Delete on
reboot.
HKEY_CLASSES_ROOT\CLSID\{1ed8c6da-6421-4c89-a772-b757f96ca697}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a07bd62d-05bf-4d18-bede-bdabd35222a0} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a07bd62d-05bf-4d18-bede-bdabd35222a0}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef} (Trojan.Vundo.H) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef}
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{584A6E46-8882-E543-C713-08560AAB706B}
(Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60b244be-559d-4269-b96e-cd264d828ec9}
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{60b244be-559d-4269-b96e-cd264d828ec9} (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d98
7fb6-2cb1-4189-b6a1-5e8185e9a899} (Rogue.Registry.Defender) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcantispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc-an
tispy (Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1efb6596-857c-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c247f23-8591-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35053a22-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{66833fe6-8583-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e3867a3-8586-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bdd1f04b-858b-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce32-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce33-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce34-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce35-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce36-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce37-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce38-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce39-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3a-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3b-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3c-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3d-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3e-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3f-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce40-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce41-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce42-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c74190b6-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd9da666-8594-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f08df954-8592-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet
Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslage
nt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden
Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e7630041-8cfb-4bcb-aadc-85fc3ae05c7a}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{06769b12-695b-4e66-9bdb-47a8f7a2e89c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{62cc302e-8074-4416-badc-c2306e39538c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.bdlf (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.toolbar.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
 
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b89b910
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObj
ectDelayLoad\dscinfoapp (Trojan.FakeAlert.H) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellE
xecuteHooks\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo) -> Delete
on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphctstj0ej
pm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pc-antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionhcpstj0ejpm
(Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObje
ctDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{62cc302e-8074-4416-badc-c2306e39538c} (Trojan.FakeAlert)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper
(Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
 
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification
Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fccabbbt ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication
Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccabbbt  -> Delete on
reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
 
Dossier(s) infecté(s):
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted
successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
C:\Program Files\PC-Antispy (Rogue.PCAntispy) -> Delete on reboot.
C:\Program Files\Registry Defender Platinum (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup (Rogue.RegistryDefender)
-> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-pulse
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm\Quarantine
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine (Rogue.Multiple) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\logs
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\startup
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
 
Fichier(s) infecté(s):
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	Bbbaccf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32	Bbbaccf.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\efcDTNFY.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	vaitpne.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\fchxundx.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\xdnuxhcf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32osgvyoc.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\coyvgsor.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\Program Files\bplczke\dscinfoapp.dll (Trojan.FakeAlert.H) -> Delete on
reboot.
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS
eksolda.dll (Trojan.Zlob) -> Quarantined and deleted
successfully.
C:\WINDOWS\enow.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\foytmuis.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
aemmcsc.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
nnkJCrq.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\siawjs.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\wkxnau.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
yhbrduv.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\drivers\pcantispy.sys (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\0000005739.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\0000005739[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\scan[1].exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\CAY7MRMH (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\wEvkx1zFE1[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\file[1].exe (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\upd105320[1] (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyPopUpBlk.dll (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
C:\Program Files\PC-Antispy\download.tmp (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.db (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\pcantispy.pkg (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\program.info (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\Uninstall.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\Registry Defender Platinum\Customer Support.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\INSTALL.LOG
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\install.sss
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\mscomctl.ocx
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe.manifest
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumeport.csv
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\Uninstall.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\User Guide.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup\10_10_2008.reg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-0.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-100.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-51.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-52.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-53.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-54.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-55.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-56.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-57.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-58.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-59.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-60.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-61.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-62.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-63.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-64.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-65.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-66.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-67.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-68.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-69.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-70.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-71.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-72.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-73.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-74.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-75.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-76.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-77.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-78.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-79.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-80.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-81.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-82.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-83.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-84.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-85.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-86.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-87.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-88.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-89.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-90.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-91.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-92.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-93.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-94.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-95.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-96.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-97.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-98.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-99.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-0.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-1.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-10.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-11.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-12.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-13.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-14.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-15.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-16.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-17.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-18.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-19.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-2.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-20.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-21.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-22.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-23.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-24.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-25.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-26.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-27.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-28.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-29.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-3.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-30.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-31.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-32.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-33.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-34.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-35.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-36.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-37.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-38.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-39.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-4.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-40.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-41.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-42.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-43.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-44.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-45.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-46.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-47.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-48.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-49.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-5.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-50.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-51.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-52.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-53.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-54.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-55.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-56.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-57.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-58.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-59.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-6.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-60.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-61.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-62.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files

caroingalls · Answer

voili voila


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1235
Windows 5.1.2600 Service Pack 2
 
11/10/2008 02:44:24
mbam-log-2008-10-11 (02-44-24).txt
 
Type de recherche: Examen rapide
Eléments examinés: 57582
Temps écoulé: 7 minute(s), 8 second(s)
 
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 86
Valeur(s) du Registre infectée(s): 27
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 34
Fichier(s) infecté(s): 359
 
Processus mémoire infecté(s):
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Unloaded process
successfully.
 
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS\dkwqgnbe.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphctstj0ejpm.scr (Trojan.FakeAlert) -> Delete on
reboot.
 
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pmnmjhbb (Trojan.Vundo.H) -> Delete on
reboot.
HKEY_CLASSES_ROOT\CLSID\{1ed8c6da-6421-4c89-a772-b757f96ca697}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a07bd62d-05bf-4d18-bede-bdabd35222a0} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a07bd62d-05bf-4d18-bede-bdabd35222a0}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef} (Trojan.Vundo.H) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef}
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{584A6E46-8882-E543-C713-08560AAB706B}
(Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60b244be-559d-4269-b96e-cd264d828ec9}
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{60b244be-559d-4269-b96e-cd264d828ec9} (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d98
7fb6-2cb1-4189-b6a1-5e8185e9a899} (Rogue.Registry.Defender) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcantispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc-an
tispy (Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1efb6596-857c-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c247f23-8591-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35053a22-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{66833fe6-8583-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e3867a3-8586-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bdd1f04b-858b-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce32-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce33-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce34-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce35-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce36-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce37-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce38-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce39-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3a-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3b-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3c-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3d-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3e-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3f-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce40-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce41-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce42-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c74190b6-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd9da666-8594-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f08df954-8592-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet
Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslage
nt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden
Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e7630041-8cfb-4bcb-aadc-85fc3ae05c7a}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{06769b12-695b-4e66-9bdb-47a8f7a2e89c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{62cc302e-8074-4416-badc-c2306e39538c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.bdlf (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.toolbar.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
 
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b89b910
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObj
ectDelayLoad\dscinfoapp (Trojan.FakeAlert.H) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellE
xecuteHooks\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo) -> Delete
on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphctstj0ej
pm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pc-antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionhcpstj0ejpm
(Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObje
ctDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{62cc302e-8074-4416-badc-c2306e39538c} (Trojan.FakeAlert)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper
(Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
 
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification
Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fccabbbt ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication
Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccabbbt  -> Delete on
reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
 
Dossier(s) infecté(s):
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted
successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
C:\Program Files\PC-Antispy (Rogue.PCAntispy) -> Delete on reboot.
C:\Program Files\Registry Defender Platinum (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup (Rogue.RegistryDefender)
-> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-pulse
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm\Quarantine
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine (Rogue.Multiple) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\logs
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\startup
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
 
Fichier(s) infecté(s):
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	Bbbaccf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32	Bbbaccf.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\efcDTNFY.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	vaitpne.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\fchxundx.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\xdnuxhcf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32osgvyoc.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\coyvgsor.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\Program Files\bplczke\dscinfoapp.dll (Trojan.FakeAlert.H) -> Delete on
reboot.
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS
eksolda.dll (Trojan.Zlob) -> Quarantined and deleted
successfully.
C:\WINDOWS\enow.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\foytmuis.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
aemmcsc.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
nnkJCrq.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\siawjs.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\wkxnau.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
yhbrduv.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\drivers\pcantispy.sys (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\0000005739.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\0000005739[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\scan[1].exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\CAY7MRMH (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\wEvkx1zFE1[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\file[1].exe (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\upd105320[1] (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyPopUpBlk.dll (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
C:\Program Files\PC-Antispy\download.tmp (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.db (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\pcantispy.pkg (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\program.info (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\Uninstall.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\Registry Defender Platinum\Customer Support.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\INSTALL.LOG
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\install.sss
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\mscomctl.ocx
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe.manifest
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumeport.csv
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\Uninstall.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\User Guide.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup\10_10_2008.reg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-0.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-100.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-51.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-52.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-53.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-54.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-55.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-56.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-57.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-58.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-59.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-60.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-61.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-62.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-63.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-64.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-65.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-66.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-67.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-68.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-69.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-70.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-71.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-72.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-73.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-74.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-75.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-76.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-77.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-78.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-79.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-80.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-81.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-82.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-83.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-84.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-85.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-86.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-87.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-88.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-89.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-90.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-91.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-92.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-93.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-94.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-95.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-96.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-97.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-98.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-99.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-0.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-1.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-10.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-11.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-12.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-13.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-14.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-15.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-16.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-17.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-18.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-19.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-2.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-20.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-21.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-22.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-23.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-24.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-25.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-26.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-27.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-28.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-29.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-3.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-30.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-31.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-32.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-33.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-34.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-35.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-36.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-37.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-38.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-39.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-4.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-40.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-41.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-42.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-43.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-44.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-45.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-46.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-47.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-48.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-49.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-5.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-50.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-51.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-52.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-53.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-54.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-55.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-56.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-57.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-58.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-59.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-6.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-60.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-61.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-62.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files

caroingalls · Answer

voili voila


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1235
Windows 5.1.2600 Service Pack 2
 
11/10/2008 02:44:24
mbam-log-2008-10-11 (02-44-24).txt
 
Type de recherche: Examen rapide
Eléments examinés: 57582
Temps écoulé: 7 minute(s), 8 second(s)
 
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 86
Valeur(s) du Registre infectée(s): 27
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 34
Fichier(s) infecté(s): 359
 
Processus mémoire infecté(s):
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Unloaded process
successfully.
 
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS\dkwqgnbe.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphctstj0ejpm.scr (Trojan.FakeAlert) -> Delete on
reboot.
 
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pmnmjhbb (Trojan.Vundo.H) -> Delete on
reboot.
HKEY_CLASSES_ROOT\CLSID\{1ed8c6da-6421-4c89-a772-b757f96ca697}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a07bd62d-05bf-4d18-bede-bdabd35222a0} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a07bd62d-05bf-4d18-bede-bdabd35222a0}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef} (Trojan.Vundo.H) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef}
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{584A6E46-8882-E543-C713-08560AAB706B}
(Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60b244be-559d-4269-b96e-cd264d828ec9}
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{60b244be-559d-4269-b96e-cd264d828ec9} (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d98
7fb6-2cb1-4189-b6a1-5e8185e9a899} (Rogue.Registry.Defender) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcantispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc-an
tispy (Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1efb6596-857c-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c247f23-8591-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35053a22-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{66833fe6-8583-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e3867a3-8586-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bdd1f04b-858b-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce32-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce33-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce34-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce35-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce36-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce37-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce38-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce39-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3a-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3b-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3c-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3d-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3e-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3f-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce40-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce41-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce42-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c74190b6-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd9da666-8594-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f08df954-8592-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet
Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslage
nt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden
Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e7630041-8cfb-4bcb-aadc-85fc3ae05c7a}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{06769b12-695b-4e66-9bdb-47a8f7a2e89c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{62cc302e-8074-4416-badc-c2306e39538c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.bdlf (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.toolbar.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
 
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b89b910
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObj
ectDelayLoad\dscinfoapp (Trojan.FakeAlert.H) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellE
xecuteHooks\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo) -> Delete
on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphctstj0ej
pm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pc-antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionhcpstj0ejpm
(Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObje
ctDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{62cc302e-8074-4416-badc-c2306e39538c} (Trojan.FakeAlert)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper
(Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
 
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification
Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fccabbbt ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication
Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccabbbt  -> Delete on
reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
 
Dossier(s) infecté(s):
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted
successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
C:\Program Files\PC-Antispy (Rogue.PCAntispy) -> Delete on reboot.
C:\Program Files\Registry Defender Platinum (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup (Rogue.RegistryDefender)
-> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-pulse
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm\Quarantine
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine (Rogue.Multiple) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\logs
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\startup
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
 
Fichier(s) infecté(s):
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	Bbbaccf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32	Bbbaccf.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\efcDTNFY.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	vaitpne.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\fchxundx.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\xdnuxhcf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32osgvyoc.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\coyvgsor.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\Program Files\bplczke\dscinfoapp.dll (Trojan.FakeAlert.H) -> Delete on
reboot.
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS
eksolda.dll (Trojan.Zlob) -> Quarantined and deleted
successfully.
C:\WINDOWS\enow.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\foytmuis.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
aemmcsc.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
nnkJCrq.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\siawjs.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\wkxnau.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
yhbrduv.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\drivers\pcantispy.sys (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\0000005739.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\0000005739[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\scan[1].exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\CAY7MRMH (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\wEvkx1zFE1[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\file[1].exe (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\upd105320[1] (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyPopUpBlk.dll (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
C:\Program Files\PC-Antispy\download.tmp (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.db (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\pcantispy.pkg (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\program.info (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\Uninstall.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\Registry Defender Platinum\Customer Support.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\INSTALL.LOG
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\install.sss
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\mscomctl.ocx
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe.manifest
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumeport.csv
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\Uninstall.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\User Guide.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup\10_10_2008.reg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-0.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-100.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-51.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-52.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-53.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-54.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-55.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-56.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-57.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-58.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-59.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-60.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-61.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-62.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-63.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-64.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-65.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-66.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-67.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-68.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-69.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-70.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-71.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-72.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-73.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-74.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-75.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-76.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-77.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-78.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-79.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-80.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-81.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-82.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-83.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-84.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-85.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-86.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-87.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-88.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-89.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-90.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-91.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-92.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-93.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-94.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-95.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-96.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-97.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-98.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-99.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-0.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-1.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-10.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-11.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-12.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-13.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-14.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-15.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-16.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-17.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-18.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-19.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-2.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-20.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-21.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-22.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-23.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-24.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-25.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-26.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-27.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-28.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-29.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-3.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-30.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-31.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-32.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-33.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-34.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-35.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-36.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-37.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-38.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-39.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-4.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-40.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-41.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-42.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-43.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-44.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-45.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-46.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-47.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-48.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-49.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-5.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-50.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-51.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-52.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-53.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-54.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-55.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-56.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-57.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-58.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-59.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-6.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-60.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-61.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-62.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files

caroingalls · Answer

voili voila


Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1235
Windows 5.1.2600 Service Pack 2
 
11/10/2008 02:44:24
mbam-log-2008-10-11 (02-44-24).txt
 
Type de recherche: Examen rapide
Eléments examinés: 57582
Temps écoulé: 7 minute(s), 8 second(s)
 
Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 7
Clé(s) du Registre infectée(s): 86
Valeur(s) du Registre infectée(s): 27
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 34
Fichier(s) infecté(s): 359
 
Processus mémoire infecté(s):
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Unloaded process
successfully.
 
Module(s) mémoire infecté(s):
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS\dkwqgnbe.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\blphctstj0ejpm.scr (Trojan.FakeAlert) -> Delete on
reboot.
 
Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\pmnmjhbb (Trojan.Vundo.H) -> Delete on
reboot.
HKEY_CLASSES_ROOT\CLSID\{1ed8c6da-6421-4c89-a772-b757f96ca697}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a07bd62d-05bf-4d18-bede-bdabd35222a0} (Trojan.Vundo.H) ->
Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a07bd62d-05bf-4d18-bede-bdabd35222a0}
(Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef} (Trojan.Vundo.H) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a7e5ca9d-1855-45e2-a95d-382440b1a2ef}
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{584A6E46-8882-E543-C713-08560AAB706B}
(Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60b244be-559d-4269-b96e-cd264d828ec9}
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browse
r Helper Objects\{60b244be-559d-4269-b96e-cd264d828ec9} (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0656a137-b161-cadd-9777-e37a75727e78}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0b682cc1-fb40-4006-a5dd-99edd3c9095d}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0e1230f8-ea50-42a9-983c-d22abc2eeb4c}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9dd4258a-7138-49c4-8d34-587879a5c7a4}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8c0220d-763d-49a4-95f4-61dfdec66ee6}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{000000da-0786-4633-87c6-1aa7a4429ef1}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{54645654-2225-4455-44a1-9f4543d34545}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c7f15e1-f31a-44fd-aa1a-2ec63aaffd3a}
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d98
7fb6-2cb1-4189-b6a1-5e8185e9a899} (Rogue.Registry.Defender) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pcantispy (Rogue.PCAntispy)
-> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcantispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\pc-an
tispy (Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1efb6596-857c-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2c247f23-8591-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35053a22-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{66833fe6-8583-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e3867a3-8586-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bdd1f04b-858b-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce32-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce33-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce34-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce35-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce36-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce37-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce38-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce39-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3a-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3b-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3c-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3d-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3e-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce3f-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce40-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce41-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c27cce42-8596-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c74190b6-8589-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dd9da666-8594-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f08df954-8592-11d1-b16a-00c0f0283628}
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\PC-Antispy (Rogue.PCAntispy) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER	ypelib (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet
Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslage
nt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden
Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Servicesdriv
(Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined
and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e7630041-8cfb-4bcb-aadc-85fc3ae05c7a}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{06769b12-695b-4e66-9bdb-47a8f7a2e89c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{62cc302e-8074-4416-badc-c2306e39538c}
(Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.bdlf (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
HKEY_CLASSES_ROOT\dkwqgnbe.toolbar.1 (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
 
Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b89b910
(Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObj
ectDelayLoad\dscinfoapp (Trojan.FakeAlert.H) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellE
xecuteHooks\{1ed8c6da-6421-4c89-a772-b757f96ca697} (Trojan.Vundo) -> Delete
on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphctstj0ej
pm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pc-antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionhcpstj0ejpm
(Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb2.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb3.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdb4.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurdc5.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
(Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObje
ctDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted
successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Toolbar\{62cc302e-8074-4416-badc-c2306e39538c} (Trojan.FakeAlert)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper)
-> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper
(Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) ->
Quarantined and deleted successfully.
 
Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification
Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\fccabbbt ->
Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication
Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccabbbt  -> Delete on
reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined
and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\
NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) ->
Quarantined and deleted successfully.
 
Dossier(s) infecté(s):
C:\WINDOWS\mslagent (Adware.EGDAccess) -> Quarantined and deleted
successfully.
C:\Program Files\Inet Delivery (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted
successfully.
C:\Program Files\PC-Antispy (Rogue.PCAntispy) -> Delete on reboot.
C:\Program Files\Registry Defender Platinum (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup (Rogue.RegistryDefender)
-> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-pulse
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Datahcpstj0ejpm\Quarantine
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Elisabeth\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application Datahcpstj0ejpm
(Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine (Rogue.Multiple) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple)
-> Quarantined and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined
and deleted successfully.
C:\Documents and Settings\Christophe\Application
Datahcpstj0ejpm\Quarantine\Packages (Rogue.Multiple) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\logs
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Application Data\PC-Antispy\startup
(Rogue.PCAntispy) -> Quarantined and deleted successfully.
 
Fichier(s) infecté(s):
C:\WINDOWS\system32\pmnmjHbb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\fccabbBt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	Bbbaccf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32	Bbbaccf.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\fihyww.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\efcDTNFY.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\YFNTDcfe.ini2 (Trojan.Vundo.H) -> Quarantined and
deleted successfully.
C:\WINDOWS\system32\enptiavt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32	vaitpne.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\fchxundx.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\xdnuxhcf.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32osgvyoc.dll (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\coyvgsor.ini (Trojan.Vundo.H) -> Quarantined and deleted
successfully.
C:\Program Files\bplczke\dscinfoapp.dll (Trojan.FakeAlert.H) -> Delete on
reboot.
C:\WINDOWS\system32\lphctstj0ejpm.exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyStBlk.dll (Rogue.PCAntispy) -> Delete on
reboot.
C:\WINDOWS
eksolda.dll (Trojan.Zlob) -> Quarantined and deleted
successfully.
C:\WINDOWS\enow.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\foytmuis.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
aemmcsc.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
nnkJCrq.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\siawjs.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\wkxnau.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32
yhbrduv.dll (Trojan.Vundo) -> Quarantined and deleted
successfully.
C:\WINDOWS\system32\drivers\pcantispy.sys (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\0000005739.exe (Trojan.FakeAlert) -> Quarantined and deleted
successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\0000005739[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\8PQR4HU7\scan[1].exe (Trojan.FakeAlert) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\CAY7MRMH (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\A5BOXKNY\wEvkx1zFE1[1].exe (Trojan.FakeAlert) ->
Quarantined and deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\file[1].exe (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\Documents and Settings\Elisabeth\Local Settings\Temp\Temporary Internet
Files\Content.IE5\XVJZP1OA\upd105320[1] (Trojan.Vundo) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\2_mslagent.dll (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\mslagent.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\WINDOWS\mslagent\uninstall.exe (Adware.EGDAccess) -> Quarantined and
deleted successfully.
C:\Program Files\Inet Delivery\inetdl.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\Program Files\Inet Delivery\intdel.exe (Fake.Dropped.Malware) ->
Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and
deleted successfully.
C:\Program Files\PC-Antispy\ASpyPopUpBlk.dll (Rogue.PCAntispy) ->
Quarantined and deleted successfully.
C:\Program Files\PC-Antispy\download.tmp (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.db (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\PC-Antispy.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\pcantispy.pkg (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\program.info (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\PC-Antispy\Uninstall.exe (Rogue.PCAntispy) -> Quarantined
and deleted successfully.
C:\Program Files\Registry Defender Platinum\Customer Support.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\INSTALL.LOG
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\install.sss
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\mscomctl.ocx
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\RegistryDefender.exe.manifest
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumeport.csv
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\Uninstall.exe
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\User Guide.url
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\backup\10_10_2008.reg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinumepair-bar\scanner-repair-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-0.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-1.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-10.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-100.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-11.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-12.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-13.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-14.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-15.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-16.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-17.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-18.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-19.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-2.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-20.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-21.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-22.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-23.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-24.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-25.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-26.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-27.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-28.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-29.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-3.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-30.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-31.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-32.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-33.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-34.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-35.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-36.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-37.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-38.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-39.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-4.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-40.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-41.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-42.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-43.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-44.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-45.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-46.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-47.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-48.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-49.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-5.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-50.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-51.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-52.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-53.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-54.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-55.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-56.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-57.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-58.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-59.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-6.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-60.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-61.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-62.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-63.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-64.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-65.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-66.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-67.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-68.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-69.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-7.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-70.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-71.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-72.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-73.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-74.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-75.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-76.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-77.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-78.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-79.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-8.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-80.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-81.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-82.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-83.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-84.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-85.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-86.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-87.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-88.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-89.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-9.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-90.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-91.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-92.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-93.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-94.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-95.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-96.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-97.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-98.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender Platinum\scan-bar-100\scanner100-99.jpg
(Rogue.RegistryDefender) -> Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-0.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-1.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-10.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-11.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-12.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-13.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-14.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-15.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-16.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-17.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-18.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-19.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-2.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-20.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-21.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-22.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-23.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-24.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-25.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-26.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-27.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-28.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-29.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-3.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-30.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-31.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-32.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-33.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-34.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-35.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-36.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-37.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-38.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-39.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-4.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-40.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-41.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-42.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-43.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-44.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-45.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-46.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-47.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-48.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-49.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-5.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-50.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-51.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-52.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-53.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-54.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-55.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-56.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-57.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-58.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-59.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-6.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-60.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-61.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files\Registry Defender
Platinum\scan-bar-pulse\scannerpulse-62.jpg (Rogue.RegistryDefender) ->
Quarantined and deleted successfully.
C:\Program Files

Destrio5 · Answer

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

caroingalls · Answer

merci bcp

faut que j'avoue que je n'ai pas de antivirus et antispyware...

tu me recommandes lesquels??

je vais de ce pas faire ce que tu me dis....

caroingalls · Answer

J'ai un écran tout bleu........

(je suis sur un autre ordi)

il y avait marqué précédemment : compte rendu en cours de préparation et un truc inattendu sur la couleur????

Destrio5 · Answer

Quitte ComboFix.

caroingalls · Answer

j ai redemarré l'ordi et cela me fait un écran bleu qd je rentre ds ma session (j'avais un programme en cours, j'imagine combofix)?

Destrio5 · Answer

Oui.

caroingalls · Answer

j ai regardé le gestionnaire de traitement, il n y a aps de process en cours....

Destrio5 · Answer

Regarde s'il y a un rapport : C:\ComboFix.txt

caroingalls · Answer

Du coup, j'ai fermé ma session et suis revenue dessus et c était bon ComboFix 08-10-06.05 - Elisabeth 2008-10-11 3:11:48.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1563 [GMT 2:00] Lancé depuis: C:\Documents and Settings\Elisabeth\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Elisabeth\Application Data\Adobe\crc.dat C:\WINDOWS\system32\_000002_.tmp.dll C:\WINDOWS\system32\_000003_.tmp.dll C:\WINDOWS\system32\_000004_.tmp.dll C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000007_.tmp.dll C:\WINDOWS\system32\_000008_.tmp.dll C:\WINDOWS\system32\_000009_.tmp.dll C:\WINDOWS\system32\_000012_.tmp.dll C:\WINDOWS\system32\_000013_.tmp.dll C:\WINDOWS\system32\_000019_.tmp.dll C:\WINDOWS\system32\2.tmp C:\WINDOWS\system32\3.tmp C:\WINDOWS\system32\4.tmp C:\WINDOWS\system32\5.tmp C:\WINDOWS\system32\6.tmp C:\WINDOWS\system32\B.tmp C:\WINDOWS\system32\D.tmp D:\Autorun.inf ----- BITS: Il y a peut-être des sites infectés ----- hxxp://78.157.143.198 . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-11 au 2008-10-11 )))))))))))))))))))))))))))))))))))) . 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\Elisabeth\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-11 02:34 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-11 01:19 . 2008-10-11 02:14 5,530 --a------ C:\WINDOWS\system32 mp.reg 2008-10-10 21:33 . 2008-10-10 21:34 d-------- C:\Documents and Settings\Christophe\.housecall6.6 2008-10-10 20:49 . 2008-10-10 20:53 d-------- C:\Program Files\Spyware Doctor 2008-10-10 20:49 . 2008-10-10 20:49 d-------- C:\Documents and Settings\Christophe\Application Data\PC Tools 2008-10-10 20:49 . 2008-10-10 22:08 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-10 20:49 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-10-10 20:49 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-10-10 20:49 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-10-10 20:49 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-10-06 20:36 . 2008-10-06 20:36 121 ---hs---- C:\WINDOWS\system32\euxsywxs.ini 2008-10-04 08:11 . 2008-10-04 08:11 d-------- C:\Documents and Settings\Christophe\Application Data\TmpRecentIcons 2008-10-04 07:42 . 2008-10-04 08:11 121 ---hs---- C:\WINDOWS\system32\peyicrfd.ini 2008-10-04 01:04 . 2008-10-04 07:41 121 ---hs---- C:\WINDOWS\system32\sohvthmf.ini 2008-10-04 00:59 . 2008-10-11 02:46 d-------- C:\Program Files\bplczke 2008-10-04 00:59 . 2008-10-04 07:42 d-------- C:\Documents and Settings\All Users\Application Data\gxwhuvqp 2008-10-01 20:40 . 2008-10-01 20:40 d-------- C:\Program Files\GigaTribe 2008-10-01 20:40 . 2008-10-01 22:16 d-------- C:\Documents and Settings\Elisabeth\Application Data\GigaTribe 2008-10-01 20:40 . 2008-10-01 20:40 1,719,687 --a------ C:\gigatribe_setup.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-11 01:09 --------- d-----w C:\Documents and Settings\Elisabeth\Application Data\uTorrent 2008-10-11 00:35 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-10-10 19:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-10-01 13:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe 2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe 2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-01-23 10:18 46,568 -c--a-w C:\Documents and Settings\Christophe\Application Data\GDIPFONTCACHEV1.DAT 2007-09-25 20:29 9,520,925 -c--a-w C:\Program Files\WinZip.exe 2007-08-29 20:51 46,568 -c--a-w C:\Documents and Settings\Elisabeth\Application Data\GDIPFONTCACHEV1.DAT . ----- Fin du message transféré -----

caroingalls · Answer

Du coup, j'ai fermé ma session et suis revenue dessus et c était bon ComboFix 08-10-06.05 - Elisabeth 2008-10-11 3:11:48.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1563 [GMT 2:00] Lancé depuis: C:\Documents and Settings\Elisabeth\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Elisabeth\Application Data\Adobe\crc.dat C:\WINDOWS\system32\_000002_.tmp.dll C:\WINDOWS\system32\_000003_.tmp.dll C:\WINDOWS\system32\_000004_.tmp.dll C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000007_.tmp.dll C:\WINDOWS\system32\_000008_.tmp.dll C:\WINDOWS\system32\_000009_.tmp.dll C:\WINDOWS\system32\_000012_.tmp.dll C:\WINDOWS\system32\_000013_.tmp.dll C:\WINDOWS\system32\_000019_.tmp.dll C:\WINDOWS\system32\2.tmp C:\WINDOWS\system32\3.tmp C:\WINDOWS\system32\4.tmp C:\WINDOWS\system32\5.tmp C:\WINDOWS\system32\6.tmp C:\WINDOWS\system32\B.tmp C:\WINDOWS\system32\D.tmp D:\Autorun.inf ----- BITS: Il y a peut-être des sites infectés ----- hxxp://78.157.143.198 . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-11 au 2008-10-11 )))))))))))))))))))))))))))))))))))) . 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\Elisabeth\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-11 02:34 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-11 01:19 . 2008-10-11 02:14 5,530 --a------ C:\WINDOWS\system32 mp.reg 2008-10-10 21:33 . 2008-10-10 21:34 d-------- C:\Documents and Settings\Christophe\.housecall6.6 2008-10-10 20:49 . 2008-10-10 20:53 d-------- C:\Program Files\Spyware Doctor 2008-10-10 20:49 . 2008-10-10 20:49 d-------- C:\Documents and Settings\Christophe\Application Data\PC Tools 2008-10-10 20:49 . 2008-10-10 22:08 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-10 20:49 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-10-10 20:49 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-10-10 20:49 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-10-10 20:49 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-10-06 20:36 . 2008-10-06 20:36 121 ---hs---- C:\WINDOWS\system32\euxsywxs.ini 2008-10-04 08:11 . 2008-10-04 08:11 d-------- C:\Documents and Settings\Christophe\Application Data\TmpRecentIcons 2008-10-04 07:42 . 2008-10-04 08:11 121 ---hs---- C:\WINDOWS\system32\peyicrfd.ini 2008-10-04 01:04 . 2008-10-04 07:41 121 ---hs---- C:\WINDOWS\system32\sohvthmf.ini 2008-10-04 00:59 . 2008-10-11 02:46 d-------- C:\Program Files\bplczke 2008-10-04 00:59 . 2008-10-04 07:42 d-------- C:\Documents and Settings\All Users\Application Data\gxwhuvqp 2008-10-01 20:40 . 2008-10-01 20:40 d-------- C:\Program Files\GigaTribe 2008-10-01 20:40 . 2008-10-01 22:16 d-------- C:\Documents and Settings\Elisabeth\Application Data\GigaTribe 2008-10-01 20:40 . 2008-10-01 20:40 1,719,687 --a------ C:\gigatribe_setup.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-11 01:09 --------- d-----w C:\Documents and Settings\Elisabeth\Application Data\uTorrent 2008-10-11 00:35 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-10-10 19:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-10-01 13:51 87,552 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\o4Patch.exe 2008-09-19 10:26 82,944 ----a-w C:\WINDOWS\system32\IEDFix.C.exe 2008-09-08 21:38 88,576 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-18 10:19 82,432 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-01-23 10:18 46,568 -c--a-w C:\Documents and Settings\Christophe\Application Data\GDIPFONTCACHEV1.DAT 2007-09-25 20:29 9,520,925 -c--a-w C:\Program Files\WinZip.exe 2007-08-29 20:51 46,568 -c--a-w C:\Documents and Settings\Elisabeth\Application Data\GDIPFONTCACHEV1.DAT . ----- Fin du message transféré -----

Destrio5 · Answer

/!\ Seul caroingalls peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
C:\WINDOWS\system32	mp.reg 
C:\WINDOWS\system32\euxsywxs.ini 
C:\WINDOWS\system32\peyicrfd.ini 
C:\WINDOWS\system32\sohvthmf.ini
C:\WINDOWS\system32\VACFix.exe     
C:\WINDOWS\system32\o4Patch.exe 
C:\WINDOWS\system32\IEDFix.C.exe  
C:\WINDOWS\system32\AntiXPVSTFix.exe 
 
Folder::
C:\Documents and Settings\All Users\Application Data\gxwhuvqp 






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

caroingalls · Answer

je suis si infectée que ça? sinon le pc a redémarré tout seul.... puis une fenêtre find3m avec rapport en cours de préparation (hors sujet : je ne peux pas répondre sur votre forum sur le portable que ns sommes en train de réparer car il me marque que le navigateur n'accepte pas les cookies, j ai le truc antispam avec les lettres à copier qui ne s affiche pas) ComboFix 08-10-06.05 - Elisabeth 2008-10-11 3:57:24.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1594 [GMT 2:00] Lancé depuis: C:\Documents and Settings\Elisabeth\Bureau\ComboFix.exe Commutateurs utilisés :: C:\Documents and Settings\Elisabeth\Bureau\CFScript.txt * Un nouveau point de restauration a été créé [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] FILE :: C:\WINDOWS\system32\AntiXPVSTFix.exe C:\WINDOWS\system32\euxsywxs.ini C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\o4Patch.exe C:\WINDOWS\system32\peyicrfd.ini C:\WINDOWS\system32\sohvthmf.ini C:\WINDOWS\system32 mp.reg C:\WINDOWS\system32\VACFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\gxwhuvqp C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe.bak C:\WINDOWS\system32\AntiXPVSTFix.exe C:\WINDOWS\system32\euxsywxs.ini C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\o4Patch.exe C:\WINDOWS\system32\peyicrfd.ini C:\WINDOWS\system32\sohvthmf.ini C:\WINDOWS\system32 mp.reg C:\WINDOWS\system32\VACFix.exe . ---- Previous Run ------- . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\Elisabeth\Application Data\Adobe\crc.dat C:\WINDOWS\system32\_000002_.tmp.dll C:\WINDOWS\system32\_000003_.tmp.dll C:\WINDOWS\system32\_000004_.tmp.dll C:\WINDOWS\system32\_000006_.tmp.dll C:\WINDOWS\system32\_000007_.tmp.dll C:\WINDOWS\system32\_000008_.tmp.dll C:\WINDOWS\system32\_000009_.tmp.dll C:\WINDOWS\system32\_000012_.tmp.dll C:\WINDOWS\system32\_000013_.tmp.dll C:\WINDOWS\system32\_000019_.tmp.dll C:\WINDOWS\system32\2.tmp C:\WINDOWS\system32\3.tmp C:\WINDOWS\system32\4.tmp C:\WINDOWS\system32\5.tmp C:\WINDOWS\system32\6.tmp C:\WINDOWS\system32\B.tmp C:\WINDOWS\system32\D.tmp D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés du 2008-09-11 au 2008-10-11 )))))))))))))))))))))))))))))))))))) . 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\Elisabeth\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-10-11 02:34 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-11 02:34 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-11 02:34 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-11 01:16 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-10-11 01:16 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-11 01:16 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-10-11 01:16 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-10-11 01:16 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-10-11 01:16 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-10-11 01:16 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-10-10 21:33 . 2008-10-10 21:34 d-------- C:\Documents and Settings\Christophe\.housecall6.6 2008-10-10 20:49 . 2008-10-10 20:53 d-------- C:\Program Files\Spyware Doctor 2008-10-10 20:49 . 2008-10-10 20:49 d-------- C:\Documents and Settings\Christophe\Application Data\PC Tools 2008-10-10 20:49 . 2008-10-10 22:08 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-10 20:49 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-10-10 20:49 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-10-10 20:49 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-10-10 20:49 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-10-04 08:11 . 2008-10-04 08:11 d-------- C:\Documents and Settings\Christophe\Application Data\TmpRecentIcons 2008-10-04 00:59 . 2008-10-11 02:46 d-------- C:\Program Files\bplczke 2008-10-01 20:40 . 2008-10-01 20:40 d-------- C:\Program Files\GigaTribe 2008-10-01 20:40 . 2008-10-01 22:16 d-------- C:\Documents and Settings\Elisabeth\Application Data\GigaTribe 2008-10-01 20:40 . 2008-10-01 20:40 1,719,687 --a------ C:\gigatribe_setup.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-11 01:59 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-10-11 01:09 --------- d-----w C:\Documents and Settings\Elisabeth\Application Data\uTorrent 2008-10-10 19:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-01-23 10:18 46,568 -c--a-w C:\Documents and Settings\Christophe\Application Data\GDIPFONTCACHEV1.DAT 2007-09-25 20:29 9,520,925 -c--a-w C:\Program Files\WinZip.exe 2007-08-29 20:51 46,568 -c--a-w C:\Documents and Settings\Elisabeth\Application Data\GDIPFONTCACHEV1.DAT . ----- Fin du message transféré -----

Destrio5 · Answer

---> Redémarre le PC

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Poste un nouveau rapport HijackThis

caroingalls · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:24, on 2008-10-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus
avapsvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security
Console\NSCSRVCE.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\Documents and Settings\Elisabeth\Bureau\hello.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
https://www8.hp.com/fr/fr/home.html
pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} -
c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7}
- c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program
Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B}
- c:\Program Files\Norton Internet Security\Norton
AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless
Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut]
CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Fichiers communs\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program
Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software
Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default
Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program
Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program
Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers
communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m
"C:\Program Files\Fichiers communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program
Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [swg] C:\Program
Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MntShHlp] C:\WINDOWS\system32\khovglwv.exe
O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and
Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and
Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
(User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
(User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE
(User 'Default user')
O4 - Startup: .security
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: .security
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk =
C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O14 - IERESET.INF:
START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
=FR_FR&c=64&bd=pavilion&pf=laptop
O17 -
HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}
: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program
Files\Fichiers communs\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation
- c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation
(ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet
Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation -
c:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - c:\Program Files\Fichiers communs\Symantec
Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program
Files\Norton Internet Security\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program
Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - c:\Program Files\Fichiers
communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. -
C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service
(LightScribeService) - Hewlett-Packard Company - C:\Program
Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation -
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation -
C:\Program Files\Fichiers communs\Symantec
Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) -
Symantec Corporation - c:\Program Files\Norton Internet Security\Norton
AntiVirus
avapsvc.exe
O23 - Service: Service Norton Protection Center (NSCService) - Symantec
Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security
Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA
Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec
Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation -
c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools -
C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools -
C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - c:\Program Files\Fichiers communs\Symantec
Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
c:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program
Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

caroingalls · Answer

destrio,

je vais me coucher

à bientot, mon pc est guéri?

caroingalls · Answer

et merci bcp de ton aide !!!!!

Destrio5 · Answer

Bonne nuit, on en reparlera demain.

caroingalls · Answer

hello !

depuis j'ai installé avira 
j'ai scanné avec avira et malwarebytes - c est ok

pourriez vous me confirmer?

je vs mets la log de hijackthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:12, on 2008-10-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\GigaTribe\gigatribe.exe
C:\Documents and Settings\Elisabeth\Bureau\hello.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MntShHlp] C:\WINDOWS\system32\khovglwv.exe
O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: .security
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: .security
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Poste un nouveau rapport HijackThis

caroingalls · Answer

voilou

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:04, on 2008-10-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\Elisabeth\Bureau\hello.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: .security
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: .security
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

caroingalls · Answer

voilou

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:04, on 2008-10-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MICROS~3\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\Elisabeth\Bureau\hello.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: .security
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: .security
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

Destrio5 · Answer

C'est bizarre.

Destrio5 · Answer

Par exemple, tu me dis que tu as désinstallé Norton alors qu'il est là.

caroingalls · Answer

j'ai desinstallé norton antivirus périmé depuis 2006
mais je suis allée sur ajout/suppr de programmes, il reste le liveupdate de symantec et sa notice

je dois aussi le virer?

Destrio5 · Answer

---> Utilise ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

Destrio5 · Answer

Je vois Antivir et non AVG.

Destrio5 · Answer

Poste un nouveau rapport HijackThis.

Destrio5 · Answer

---> Mets à jour Internet Explorer :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=fr

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"     

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe     

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"     

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime     

O4 - HKLM\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe 

O4 - HKCU\..\Policies\Explorer\Run: [kl7dyH9S5N] C:\Documents and Settings\All Users\Application Data\gxwhuvqp\slizwrsh.exe 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')     

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')     

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')     

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')     

O4 - Startup: .security 

O4 - Global Startup: .security 

O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)     

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Télécharge OTMoveIt2 à partir du lien ci-dessous : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste List Of Files/Folders to Move.


C:\Documents and Settings\All Users\Application Data\gxwhuvqp\


---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES. 

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles. 

---> Redémarre ton et poste un dernier rapport HijackThis

caroingalls · Answer

voici le rapport tomove

Folder C:\Documents and Settings\All Users\Application Data\gxwhuvqp\ not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 10092008_021429

caroingalls · Answer

voici le rapport hijackthis et pour moi, dodo...

A demain pour de nouvelles aventures et merci pour ton aide

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:20, on 2008-10-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Elisabeth\Bureau\hello.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Destrio5 · Answer

Pour finir :

---> Télécharge Tools Cleaner sur ton bureau.
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
Clique sur Recherche et laisse le scan agir.
Clique sur Suppression pour finaliser. 
Tu peux, si tu le souhaites, te servir des Options facultatives.
Clique sur Quitter pour obtenir le rapport. 
Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

---> Tiens à jour Windows

---> Un scan complet avec Antivir et MBAM serait une bonne idée (Pas en même temps)

Des questions ?

caroingalls · Answer

je ferai la suite demain...

Good night, destrio !!!

Destrio5 · Answer

Tu peux supprimer Tools Cleaner et ComboFix.

Bonne nuit ;)

caroingalls · Answer

question :

ce pignouf AVG.EXE est toujours là sur mon bureau.......et impossible à désinstaller

qd je vais ds propriétés :

avg setup self extractor based on 7 zip
version 8 0 0 2
version du produit 8 0 0 0
securite : ce fichier provient d un autre ordinateur et peut éventuellement être bloqué pour protéger cet ordinateur
nom du fichier d origine  7zS.sfx
nom du produit AVG antivirus systeme
nom interne  7zS


ça te dit quelque chose?

A demain

Destrio5 · Answer

---> Essaie ceci :
http://www.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe

caroingalls · Answer

hello,

j ai fait tout ce que tu m as demandé, voici le rapport hijack;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:02, on 2008-10-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Documents and Settings\Elisabeth\Bureau\Jack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.msn.com/fr-fr?cobrand=hp-notebook.msn.com&ocid=HPDHP&pc=HPNTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{5044E2B4-2EB7-43F3-9A9E-759F75E8D180}: NameServer = 212.27.54.252,212.27.53.252
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

Destrio5 · Answer

"ça y est, mon pc est en pleine forme?"
---> A toi de me le dire.

"qu utilises tu comme parefeu? j ai celui de windows"
---> Moi aussi.

"je suis bien protégée?"
---> A toi de faire attention sur Internet.

caroingalls · Answer

merci pour ton aide précieuse

Destrio5 · Answer

- Redémarre ton ordinateur en mode sans échec :
https://blog.sosordi.net/

- Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée

- Réponds O(oui) à ces deux questions si elles te sont posées

Voulez-vous nettoyer le registre ?
Corriger le fichier infecté ?

- Un rapport sera généré, sauvegarde-le sur le bureau

- Redémarre en mode normal

- Poste le rapport SmitfraudFix

Destrio5 · Answer

C'est mieux ?

caroingalls · Answer

oui, disparition de virus alert, j'ai retrouvé explorateur ds le menu démarrer...

pourquoi malware trouve tjs des fichiers infectés??

Destrio5 · Answer

C'est normal, tu as appuyé sur Supprimer la sélection ?

caroingalls · Answer

non et c ok maintenant que je l'ai fait !!!!

merci pour tout, destrio sur ton fidèle destrier !!!

(il est tps que je me pieute...)

Destrio5 · Answer

Bonne nuit ;)

Destrio5 · Answer

"O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll"
---> Il est à jour.

Destrio5 · Answer

Ce n'est pas grave ;)

Antivirus 2009 a encore frappé

58 réponses

Discussions similaires