Virus win32.worm.bagkle dans mdelk.exe

Bye !

FillPCA

J'ai compris la leçon, merci encore.

Re,

Pour que tu comprennes qu'il est facile d'infecter sa machine, et beaucoup plus difficile de la nettoyer,
Parce que ton pc infecté contribue à mener des attaques contre des sites Internet sans que tu le saches,
Parce que tu contribues à spammer, et à envoyer des pubs pour le viagra dans ma boîte mail entre autres,
Pour que tu comprennes qu'il faut être prudent pour ne plus être infecté,
Pour éviter que tes numéros de compte bancaires soient piratés quand tu fais des achats en ligne.

Tu veux d'autres raisons lol ?

FillPCA

Merci énormément pour ton aide sans laquelle j'aurais été obligé de passer par un formatage.
Si je puis me permettre une dernière question, pourquoi toute cette aide qui de + à des gens qui piratent le réseau comme moi et qui ne le mérite pas forcément !!
Encore un grand merci pour cette leçon et pour les désinfections.

Bonne soirée.

Re,

La 1ère protection, c'est la prudence. Tu peux avoir toutes les protections possibles, tu sera inévitablement infecté si tu es imprudent. Je ne connais pas bit defender, mais il a plutôt bonne réputation. Kaspersky est aussi un très bon produit.
Il y a aussi des solutions gratuites efficaces. C'est ce que j'ai choisi, et je n'ai jamais été infecté, car je suis vigilant et je ne fais pas n'importe quoi.

* Lance OTmoveIT.
* Clique sur CleanUp! (le programme va télécharger un fichier texte qui servira a nettoyer les programmes que l'on a téléchargés).

NOTE : Normalement, ton firewall (parefeu) devrait te demander si OTmoveIT peut accéder à internet, Autorise le.

* Une liste apparaît dans la partie gauche d'OTmoveIT.
* Un message apparaît pour confirmer le nettoyage. Confirme.
* Les fichiers infectés qui se trouvent dans les quarantaines seront supprimés aussi.

1/ Il est fortement recommandé d'avoir tous ses logiciels de sécurité à jour, afin d'éviter les failles par lesquelles s'engouffrent les infections.
2/ Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, lopxpMH, ect.....) qui traitent des infections spécifiques et qui sont mis à jour régulièrement. Il est inutile de les garder sur ton PC.
Tu peux par contre, garder AVG Antispyware et CCleaner.
3/ /!\ Maintenant que ton PC n'est plus infecté, désactive puis réactive ta "Restauration du système" afin de créer un point de restauration sain.
Pour désactiver ou activer la Restauration du système, tu dois ouvrir une session Administrateur sous Windows XP.
Désactivation:
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer et Ok.
Activation:
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer et Ok. Redémarrer l'ordinateur.
Comment faire pour...(lettre A): https://forum.pcastuces.com/sujet.asp?f=25&s=3902
4/ Pour améliorer la sécurité de ton PC prend quelques instants pour lire:
Sécuriser son PC +WIFI (versions "hot" & "light"): https://forum.pcastuces.com/default.asp
5/ Dénonce ton infection pour faire condamner les auteurs.

Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :
- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors, sous forme de liste, un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).

*** Tes infections : Worm VanBot, Bagle, Trojan-Downloader.BAT.Ftp ***
>> https://malwarecomplaints.info/
Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections, conforme au règle du forum (âge, ville, département etc..)
Indique aussi le nom du Forum qui t'a aidé : CCM
6/ Tu peux marquer ton sujet comme résolu en cliquant sur le bouton.
7/ Je te conseille enfin de défragmenter ton PC : http://www.coupdepoucepc.com/modules/news/article.php?storyid=218

Bon surf !

FillPCA

Tools cleaner ne se lance pas, message d'erreur:

framedyn.dll est introuvable ?

Pour le PC, il tourne normalement, comme avant.

Que me conseille tu d'acheter comme antivirus ou une version free ?
Un collègue de boulot me parlait cet après midi de bit defender pour 40E ?
idem pour les spywares, quel conseil ?

Re,

P2p = pear-to-pear, dont Emule fait partie.

* Télécharge Toolscleaner de A.Rothstein sur ton Bureau : http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
* Double-clique sur ToolsCleaner2.exe>Recherche puis Suppression,
* Ton Bureau va disparaître. Ceci est normal.
* S'il ne réapparait pas, fais ceci : CTRL+ALT+SUP pour faire apparaître le gestionnaire de tâches.
Rends-toi à l'onglet Processus, clique en haut à gauche sur "Fichiers" et choisis "Exécuter". Tape "explorer" et valide. Cela te fera ré-apparaître ton Bureau.
Edite ce rapport.

Comment le pc se porte-t-il ?

FillPCA

Voici le rapport move it:
C:\WINDOWS\system32\i moved successfully.
F:\e-mule\Incoming\La cave du sommelier Pro v1.01.Incl.km-dSR.zip moved successfully.
File/Folder F:\e-mule\temp\011.part not found.

OTMoveIt2 v1.0.19 log created on 02112008_211243

j'avais supprimé avant 011.part avec avg...

Effectivement tous ces virus viennent de crack que j'ai téléchargé...
Qu'entend par les p2p ?

Re,

Tu continues avec OTMoveIt.

FillPCA

Je viens de m'apercevoir que je n'avais pas fais l'action de mettre en quarantaine après l'analyse d'avgspywae, dois je recommencer les analyses Kapersky en ligne ainsi qu'HIJACKTHIS ou dois je continuer avec OTMoveIt2 ?

Re,

* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Standard List of Files/Folders to Move" :

C:\WINDOWS\system32\i
F:\e-mule\Incoming\La cave du sommelier Pro v1.01.Incl.km-dSR.zip
F:\e-mule\temp\011.part

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

Il faudra aussi se résoudre à arrêter le p2p et les cracks. Tes infections multiples viennent de là...
Comment le pc se porte-t-il ?

FillPCA

Et enfin HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:44:38, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\e-Carte Bleue\LCL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\e-Carte Bleue\Caisse Epargne\Ma e-Carte Bleue\ECB-CDE.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [eCarteBleue-CLEO] "C:\Program Files\e-Carte Bleue\LCL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" /dontopenmycards
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [eCarteBleue-CDE-P3] "C:\Program Files\e-Carte Bleue\Caisse Epargne\Ma e-Carte Bleue\ECB-CDE.exe" /dontopenmycards
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] "C:\Program Files\Logitech\Video\ISStart.exe"
O4 - HKLM\..\Run: [LogitechVideoTray] "C:\Program Files\Logitech\Video\LogiTray.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] "C:\Program Files\IncrediMail\bin\IncMail.exe" /c
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [IW_Drop_Icon] "C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" /DropDisc
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O4 - Global Startup: Logitech Harmony Remote V6.lnk = C:\Program Files\Logitech\Harmony Remote Client\HarmonyRemote.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &Search - ?p=ZNxmk142YYFR
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://F:\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akamai.net/7/1540/52/20061023/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/71365/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://audeno.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://audeno.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Voici le rapport en ligne de KAPERSKY:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 11, 2008 8:40:11 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/02/2008
Kaspersky Anti-Virus database records: 515468
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 112547
Number of viruses found: 11
Number of infected objects: 101
Number of suspicious objects: 0
Duration of the scan process: 04:32:31

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.5.Crwl Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.5.gthr Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.ci Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wsb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010014.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010019.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001A.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001D.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010023.wid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy16.gthr Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf3.tmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf4.tmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_210.dat Object is locked skipped
C:\Documents and Settings\didom\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Application Data\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Temp\Perflib_Perfdata_13c0.dat Object is locked skipped
C:\Documents and Settings\didom\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\didom\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\didom\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\iwctrllog.txt Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\master.mdf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\model.mdf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\modellog.ldf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\PinnacleSys_GlobalContext.mdf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\PinnacleSys_GlobalContext_log.LDF Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Data\templog.ldf Object is locked skipped
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\LOG\ERRORLOG Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\103671.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\109343.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\1152875.exe.vir Infected: Trojan.Win32.Pakes.bwy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\1156875.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\124562.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\126390.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\128062.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\129718.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\129734.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\132718.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\15800656.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\159046.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\175859.exe.vir Infected: Trojan.Win32.Pakes.bwy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\182078.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\190078.exe.vir Infected: Trojan.Win32.Pakes.bwy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\192234.exe.vir Infected: Trojan.Win32.Pakes.bwy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\196593.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\198625.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\30306156.exe.vir Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\684937.exe.vir Infected: Trojan.Win32.Pakes.bwy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\690796.exe.vir Infected: Trojan-PSW.Win32.LdPinch.ewq skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\gcdef32.dll.vir Infected: Trojan.Win32.Agent.dwg skipped
C:\QooBox\Quarantine\Registry_backups\LEGACY_SROSA.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp skipped
C:\QooBox\Quarantine\Registry_backups\services_srosa.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP474\A0121018.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP474\A0122017.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP474\A0122054.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP474\A0122086.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP474\A0122135.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP475\A0122168.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP475\A0122169.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP475\A0122170.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP475\A0123149.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP476\A0123303.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP476\A0123304.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP476\A0123314.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP476\A0123340.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP477\A0123401.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP477\A0123438.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP477\A0123457.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123514.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123545.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123564.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123569.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123587.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP478\A0123624.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP479\A0123662.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP479\A0123666.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP480\A0123686.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP480\A0123687.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP481\A0123710.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP481\A0123713.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP485\A0124376.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP486\A0124562.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0125568.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0125571.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0125597.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0125673.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0126673.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP489\A0126824.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP489\A0126875.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP489\A0127875.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP489\A0127981.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP490\A0128049.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP490\A0129303.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0129440.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0129571.exe Infected: Trojan-Downloader.Win32.Bagle.jf skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130568.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130578.sys Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130614.exe Infected: Trojan-Downloader.Win32.Bagle.jf skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130615.EXE Infected: Trojan-Downloader.Win32.Bagle.jf skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130617.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130618.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP491\A0130619.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130629.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130631.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130635.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130636.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130661.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130664.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130670.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130676.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130677.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130686.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130738.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130757.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130809.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130822.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130842.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130846.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130854.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130865.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0131056.exe Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0131162.exe Infected: Trojan.Win32.Pakes.bwy skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0131164.exe Infected: Trojan-PSW.Win32.LdPinch.ewq skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP497\A0131497.dll Infected: Trojan.Win32.Agent.dwg skipped
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP497\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\S1A91C0D8.tmp Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\bdss.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_72c.dat Object is locked skipped
C:\WINDOWS\Temp\tmp000061b0\tmp00000000 Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\e-mule\Incoming\La cave du sommelier Pro v1.01.Incl.km-dSR.zip/Crack-FFF.exe Infected: Trojan-Dropper.Win32.KGen.do skipped
F:\e-mule\Incoming\La cave du sommelier Pro v1.01.Incl.km-dSR.zip ZIP: infected - 1 skipped
F:\e-mule\temp\011.part/ypkYwJy.com Infected: Backdoor.Win32.VanBot.ee skipped
F:\e-mule\temp\011.part RAR: infected - 1 skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP497\change.log Object is locked skipped

Scan process completed.

Voivi le scan avgs:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 06:50:53 11/02/2008

+ Résultat de l'analyse:

F:\e-mule\temp\011.part/ypkYwJy.com -> Backdoor.VanBot.ee : Aucune action entreprise.
C:\Documents and Settings\didom\Bureau\EliBaglA.exe -> Heuristic.Win32.AVKiller : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP417\A0105759.dll -> Not-A-Virus.PSWTool.Win32.Hooker.a : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP494\A0131312.dll -> Not-A-Virus.PSWTool.Win32.Hooker.a : Aucune action entreprise.
C:\Documents and Settings\didom\Cookies\didom@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
C:\Documents and Settings\didom\Cookies\didom@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\690796.exe.vir -> Trojan.LdPinch.ewq : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0131164.exe -> Trojan.LdPinch.ewq : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\1152875.exe.vir -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\175859.exe.vir -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\190078.exe.vir -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\192234.exe.vir -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\684937.exe.vir -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP487\A0125571.exe -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130635.exe -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130809.exe -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130842.exe -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0130846.exe -> Trojan.Pakes.bwy : Aucune action entreprise.
C:\System Volume Information\_restore{B0883CCF-4235-4947-9979-671DAC8B3A8E}\RP492\A0131162.exe -> Trojan.Pakes.bwy : Aucune action entreprise.

Fin du rapport

J'ai nettoyé avec ccleaner, il m'a supprimés pas mal de fichier et avg est en train d'analyser.

Oui, c'est bien ce que faisait mais après plusieurs tenttive, il l'a pris. Voici le rapport avec le script:

ComboFix 08-02.05.3 - didom 2008-02-10 21:38:08.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.421 [GMT 1:00]
Endroit: C:\Documents and Settings\didom\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\didom\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE
C:\WINDOWS\system32\gcdef32.dll
C:\WINDOWS\system32\ltocx13n.ocx
C:\WINDOWS\system32\sfx32mon.dll
C:\WINDOWS\system32\wmm32.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\_detmp.1\
C:\WINDOWS\_detmp.2\
C:\WINDOWS\system32\gcdef32.dll
C:\WINDOWS\system32\ltocx13n.ocx
C:\WINDOWS\system32\sfx32mon.dll
C:\WINDOWS\system32\wmm32.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-10 to 2008-02-10 ))))))))))))))))))))))))))))))))))))
.

2008-02-15 18:20 . 2008-02-15 18:20 <REP> d-------- C:\Documents and Settings\didom\Application Data\My Games
2008-02-10 18:32 . 2008-02-10 18:32 <REP> d-------- C:\Documents and Settings\didom\Application Data\Bitdefender
2008-02-10 15:44 . 2008-02-10 21:36 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-02-10 15:40 . 2008-02-10 15:40 <REP> d-------- C:\Program Files\Softwin
2008-02-10 15:40 . 2008-02-10 15:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-02-10 15:39 . 2008-02-10 15:40 <REP> d-------- C:\Program Files\Fichiers communs\Softwin
2008-02-10 14:06 . 2008-02-10 14:06 <REP> d-------- C:\Program Files\Trend Micro
2008-02-10 13:48 . 2008-02-10 13:48 <REP> d-------- C:\Deckard
2008-02-10 13:04 . 2004-08-20 00:09 400,896 --a------ C:\kmd.exe
2008-02-09 16:49 . 2008-02-09 16:50 <REP> d-------- C:\wd
2008-02-09 15:15 . 2008-02-09 15:15 <REP> d--h----- C:\Documents and Settings\audrey\Voisinage réseau
2008-02-09 15:15 . 2008-02-09 15:15 <REP> d--h----- C:\Documents and Settings\audrey\Voisinage d'impression
2008-02-09 15:15 . 2008-02-09 15:15 <REP> d--h----- C:\Documents and Settings\audrey\Modèles
2008-02-09 15:15 . 2008-02-09 15:15 <REP> dr------- C:\Documents and Settings\audrey\Mes documents
2008-02-09 15:15 . 2008-02-09 15:15 <REP> dr------- C:\Documents and Settings\audrey\Menu Démarrer
2008-02-09 15:15 . 2008-02-09 15:15 <REP> dr------- C:\Documents and Settings\audrey\Favoris
2008-02-07 18:48 . 2008-02-07 18:48 <REP> d-------- C:\Program Files\Alwil Software
2008-02-05 20:28 . 2006-11-26 19:50 121,788 --a------ C:\WINDOWS\_detmp.1
2008-02-05 20:28 . 1999-04-13 14:26 77,824 --a------ C:\WINDOWS\_detmp.2
2008-02-03 21:19 . 2008-02-03 21:19 <REP> d-------- C:\Documents and Settings\didom\Application Data\LivingActor
2008-02-03 21:18 . 2008-02-03 21:18 <REP> d-------- C:\Program Files\LivingActor
2008-02-03 21:18 . 2008-02-03 21:34 <REP> d-------- C:\Program Files\La cave du sommelier
2008-02-03 18:22 . 2003-09-04 13:17 917,504 --a------ C:\WINDOWS\system32\Flash.ocx
2008-02-03 18:22 . 2000-09-27 16:05 557,328 --a------ C:\WINDOWS\system32\dao360.dll
2008-02-03 18:22 . 2002-02-28 13:19 202,008 --a------ C:\WINDOWS\system32\PrntPRO2.dll
2008-02-03 18:22 . 2002-10-24 16:10 35,328 --a------ C:\WINDOWS\system32\lttwn13n.dll
2008-02-03 18:22 . 1998-07-13 01:00 34,816 --a------ C:\WINDOWS\system32\DBGRDFR.DLL
2008-02-03 15:15 . 2002-02-13 16:59 21,747 --a------ C:\WINDOWS\emme.wri
2008-02-03 15:14 . 2008-02-03 18:22 <REP> d-------- C:\emme
2008-02-03 07:52 . 2008-02-03 20:02 <REP> d-------- C:\Program Files\JeroboamV5
2008-02-03 07:52 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2008-02-03 07:52 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL
2008-02-03 07:52 . 2008-02-03 20:01 13,030 --a------ C:\PDOXUSRS.NET
2008-02-02 22:15 . 2008-02-02 22:15 <REP> d-------- C:\Program Files\Le Cavoir 3.7
2008-02-02 22:00 . 2004-08-19 16:09 536,576 --a------ C:\WINDOWS\system32\msado15.dll
2008-02-02 22:00 . 2004-08-19 16:09 200,704 --a------ C:\WINDOWS\system32\MSADOX.DLL
2008-02-02 22:00 . 2004-08-19 16:09 102,400 --a------ C:\WINDOWS\system32\MSJRO.DLL
2008-02-02 22:00 . 2004-08-03 22:21 81,920 --a------ C:\WINDOWS\system32\MSADO27.TLB
2008-02-02 22:00 . 1998-07-13 00:00 34,304 --a------ C:\WINDOWS\system32\Rchtxfr.dll
2008-02-02 22:00 . 1998-07-13 00:00 15,360 --a------ C:\WINDOWS\system32\INETFR.DLL
2008-01-22 20:34 . 2008-01-22 20:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\tpfmon
2008-01-22 20:27 . 2008-01-22 20:27 <REP> d-------- C:\Program Files\AXMA
2008-01-13 14:17 . 2008-01-13 14:17 8,192 --ahs---- C:\WINDOWS\Thumbs.db
2008-01-12 18:19 . 2008-01-12 18:19 <REP> d-------- C:\Documents and Settings\hp\Application Data\Windows Desktop Search
2008-01-12 18:18 . 2008-01-12 18:18 <REP> d-------- C:\Documents and Settings\audrey.PAVILION\Application Data\Windows Desktop Search

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 20:05 --------- d-----w C:\Program Files\eMule
2008-02-10 19:12 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-02-10 11:26 --------- d-----w C:\Documents and Settings\didom\Application Data\Canon
2008-02-09 07:43 --------- d-----w C:\Program Files\Logitech
2008-02-09 07:24 --------- d-----w C:\Program Files\Steinberg
2008-02-09 07:22 --------- d-----w C:\Program Files\Visual Data
2008-02-09 07:19 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-02-09 07:19 --------- d-----w C:\Program Files\Windows Live
2008-02-09 07:18 --------- d-----w C:\Program Files\WinAVI Video Converter
2008-02-09 07:13 --------- d-----w C:\Program Files\PlayFirst
2008-02-09 07:13 --------- d-----w C:\Program Files\Incredijeux
2008-02-05 19:33 --------- d-----w C:\Program Files\ACAD2000
2008-02-03 07:27 --------- d-----w C:\Program Files\Micro Application
2008-02-03 07:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\4D
2008-01-25 12:19 --------- d-----w C:\Documents and Settings\didom\Application Data\Autodesk
2008-01-21 16:19 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-01-21 16:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-19 19:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-19 19:11 --------- d-----w C:\Program Files\Fichiers communs\Oberon Media
2008-01-19 06:42 89,984 ----a-w C:\Documents and Settings\didom\Application Data\GDIPFONTCACHEV1.DAT
2008-01-13 07:56 --------- d-----w C:\Program Files\Lavasoft
2008-01-13 07:16 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-01-13 07:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-09 20:14 --------- d-----w C:\Program Files\MSXML 6.0
2008-01-08 20:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-01-08 20:06 --------- d-----w C:\Program Files\AutoCAD 2008
2008-01-08 19:55 --------- d-----w C:\Program Files\Fichiers communs\Autodesk Shared
2008-01-08 19:44 --------- d-----w C:\Program Files\Autodesk
2007-12-27 08:49 --------- d-----w C:\Program Files\Les Outils SEAC
2007-12-27 08:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-27 08:45 --------- d-----w C:\Program Files\ATI Technologies
2007-12-27 08:13 --------- d-----w C:\Program Files\e-bat
2007-12-27 08:12 --------- d-----w C:\Program Files\GameSpy Arcade
2007-12-27 08:12 --------- d-----w C:\Program Files\FitKids
2007-12-27 08:12 --------- d-----w C:\Program Files\Fichiers communs\Jasc Software Inc
2007-12-27 08:12 --------- d-----w C:\Program Files\Fichiers communs\FotoWire
2007-12-27 08:12 --------- d-----w C:\Documents and Settings\didom\Application Data\FotoWire
2007-12-27 08:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\Disney Interactive
2007-12-27 08:10 --------- d-----w C:\Program Files\SmartSound Software
2007-12-27 08:10 --------- d-----w C:\Program Files\Fichiers communs\Sandlot Shared
2007-12-27 08:10 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-12-27 08:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2007-12-27 08:09 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-27 08:09 --------- d-----w C:\Program Files\Fichiers communs\L&H
2007-12-27 06:58 --------- d-----w C:\Program Files\Fichiers communs\Ahead
2007-12-25 14:22 --------- d-----w C:\Program Files\Ouaps
2007-12-25 14:21 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-12 12:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fugazo
2006-11-23 14:35 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2005-08-14 10:32 3 ----a-w C:\Documents and Settings\didom\InstallDialer.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-11 10:02 204843]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 11:46 196608]
"IW_Drop_Icon"="C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2005-06-29 10:34 1346560]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 15:34 57344 C:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 21:10 335872]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"eCarteBleue-CLEO"="C:\Program Files\e-Carte Bleue\LCL\e-Carte Bleue VISA Cleo\ECB-CLEO.exe" [2006-02-07 10:07 200704]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608]
"eCarteBleue-CDE-P3"="C:\Program Files\e-Carte Bleue\Caisse Epargne\Ma e-Carte Bleue\ECB-CDE.exe" [2002-12-20 09:20 184320]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-05-21 19:11 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-06-01 11:09 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-06-01 11:03 217088]
"PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [2004-03-11 00:26 406016]
"CloneCDElbyCDFL"="C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" [2001-12-06 13:09 45056]
"BDMCon"="C:\Program Files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 16:48 290816]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 15:49 69632]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 02:12 483328]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-25 15:28:28 108544]
Lancement rapide d'Adobe Acrobat.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [2008-02-10 20:14:14 25214]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll

R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys [2004-09-01 13:50]
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys [2005-02-10 10:55]
R3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 20:16]
S3 C-Dilla;C-Dilla;C:\WINDOWS\system32\drivers\CDANT.SYS [2003-04-01 09:23]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-10 20:00:50 C:\WINDOWS\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_PAVILION_didom.job"
- C:\WINDOWS\system32\mobsync.exeC /Schedule=
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-10 21:40:55
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\gcdef32.dll
.
Temps d'accomplissement: 2008-02-10 21:42:31
ComboFix-quarantined-files.txt 2008-02-10 20:42:04
ComboFix2.txt 2008-02-10 12:40:59
.
2008-02-03 18:54:48 --- E O F ---

Ca marche pas en renommant j'essaie de supprimmer et télécharger à nouveau combo

Re,
Peux-tu ré-essayer en redonnant le nom véritable de combofix ? Sinon, supprime cette version du bureau et re-télécharge combofix.

FillPCA