Plantage après infection.

Avira AntiVir Personal
Report file date: mardi 16 décembre 2008 20:08

Scanning for 1094481 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: SPT-72F6FFC7CEB

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 25/11/2008 12:47:58
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 12:56:48
ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 17:30:21
ANTIVIR2.VDF : 7.1.0.230 156160 Bytes 14/12/2008 17:51:46
ANTIVIR3.VDF : 7.1.0.243 114176 Bytes 16/12/2008 17:51:48
Engineversion : 8.2.0.45
AEVDF.DLL : 8.1.0.6 102772 Bytes 15/10/2008 11:47:40
AESCRIPT.DLL : 8.1.1.19 336252 Bytes 11/12/2008 17:29:56
AESCN.DLL : 8.1.1.5 123251 Bytes 09/11/2008 12:47:31
AERDL.DLL : 8.1.1.3 438645 Bytes 05/11/2008 12:48:52
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 12:47:24
AEOFFICE.DLL : 8.1.0.33 196987 Bytes 11/12/2008 17:29:55
AEHEUR.DLL : 8.1.0.75 1524087 Bytes 11/12/2008 17:29:54
AEHELP.DLL : 8.1.2.0 119159 Bytes 19/11/2008 12:47:12
AEGEN.DLL : 8.1.1.8 323956 Bytes 11/12/2008 17:29:51
AEEMU.DLL : 8.1.0.9 393588 Bytes 15/10/2008 11:47:30
AECORE.DLL : 8.1.5.2 172405 Bytes 29/11/2008 12:47:12
AEBB.DLL : 8.1.0.3 53618 Bytes 15/10/2008 11:47:28
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 25/09/2008 10:26:34
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: d:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: mardi 16 décembre 2008 20:08

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'DkService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'logonui.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'savedump.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
25 processes with 25 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '51' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\spt\Mes documents\TomTom\HOME\Downloads\navcore_7.163.8493.go.cab
[0] Archive type: CAB (Microsoft)
--> data.chk
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'D:\'
D:\Program Files\FindyKill.exe
[DETECTION] Contains recognition pattern of the DR/Tool.PsKill.K.37 dropper
[NOTE] The file was moved to '49b6057d.qua'!
D:\Program Files\Scrapbook Factory Deluxe 3.0 (ISO)\ScrapbookFactoryDlx3.0-cd1\SFW\Pictur~1.cab
[0] Archive type: CAB (Microsoft)
--> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\Program Files\SFW\Pictur~1.cab
[0] Archive type: CAB (Microsoft)
--> Global_VC_IRT_f0.3CE1F932_C090_11D2_977B_006097C4DE24
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\System Volume Information\_restore{6FD41D85-FFE5-4650-9BB3-4FA7C0297A45}\RP9\A0010521.exe
[DETECTION] Contains recognition pattern of the DR/Tool.PsKill.K.37 dropper
[NOTE] The file was moved to '4978091b.qua'!


End of the scan: mardi 16 décembre 2008 21:00
Used time: 52:31 Minute(s)

The scan has been done completely.

9433 Scanning directories
622292 Files were scanned
2 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
2 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
622289 Files not concerned
10841 Archives were scanned
4 Warnings
2 Notes

Voilà le rapport

Oui, j'ai tout supprimé et tout se passait bien jusqu'à ce matin où il s'est planté. le fichier qui posait problème était un temp mais je suppose qu'il y a encore qqchose qui ne va pas qqpart.
Bon WE