Win32:Delf-HQH

Salut,

voici le rapport combo

ComboFix 08-02-25.3 - ELODIE 2008-03-04 23:10:54.2 - NTFSx86
Endroit: C:\Documents and Settings\ELODIE\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\mmhr3.exe
C:\WINDOWS\mmoc2.exe
C:\WINDOWS\system32\22335628441.dll
C:\WINDOWS\system32\22455299941.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2008-02-04 to 2008-03-04 ))))))))))))))))))))))))))))))))))))
.

2008-03-03 22:27 . 2008-03-03 22:27 <REP> d-------- C:\WINDOWS\LastGood
2008-03-03 22:27 . 2008-03-03 23:32 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-03 20:40 . 2008-03-03 20:40 <REP> d-------- C:\Documents and Settings\ELODIE\Application Data\Grisoft
2008-03-03 20:40 . 2008-03-03 20:40 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-03 20:40 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 20:04 . 2008-03-03 20:05 <REP> d-------- C:\Program Files\CCleaner
2008-02-29 18:31 . 2008-02-29 18:31 19,968 --a------ C:\WINDOWS\mmmega.exe
2008-02-29 18:31 . 2008-02-29 18:31 19,968 --a------ C:\WINDOWS\mm_tmpmega.exe
2008-02-28 00:04 . 2008-02-28 00:05 <REP> d-------- C:\WINDOWS\ERUNT
2008-02-28 00:04 . 2008-02-28 00:14 <REP> d-------- C:\SDFix
2008-02-27 20:00 . 2008-02-27 20:00 <REP> d-------- C:\Program Files\SysCleaner
2008-02-27 19:55 . 2008-02-27 19:49 7,168 --a------ C:\WINDOWS\system32\ws2_64.exe
2008-02-27 07:56 . 2008-02-27 07:56 <REP> d-------- C:\WINDOWS\provisioning
2008-02-27 07:56 . 2008-02-27 19:35 <REP> d-------- C:\WINDOWS\peernet
2008-02-27 07:50 . 2008-02-27 07:50 <REP> d-------- C:\WINDOWS\ServicePackFiles
2008-02-27 07:43 . 2004-08-03 22:43 20,480 --a------ C:\WINDOWS\system32\sprecovr.exe
2008-02-27 07:38 . 2003-04-24 20:00 4,186,256 --a------ C:\WINDOWS\system32\dllcache\luna.mst
2008-02-27 07:35 . 2008-02-27 19:35 <REP> d-------- C:\WINDOWS\EHome
2008-02-27 00:04 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2008-02-27 00:04 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2008-02-27 00:00 . 2008-02-27 00:00 9,773 --a------ C:\Documents and Settings\ELODIE\spoolsv.bin
2008-02-26 23:31 . 2004-03-10 19:01 608,256 -----c--- C:\WINDOWS\system32\dllcache\xpsp2res.dll
2008-02-26 23:31 . 2004-01-10 06:11 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2008-02-26 23:30 . 2008-02-26 23:30 355 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-26 22:04 . 2008-02-26 22:04 24,064 --a------ C:\WINDOWS\mmall.exe
2008-02-26 22:04 . 2008-02-26 22:04 6,205 --a------ C:\Documents and Settings\ELODIE\smss.bin
2008-02-26 21:22 . 2008-02-26 21:22 <REP> d-------- C:\WINDOWS\system32\bits
2008-02-26 20:48 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-26 20:31 . 2008-02-27 19:51 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-02-25 23:41 . 2008-02-25 23:41 <REP> d-------- C:\Program Files\Trend Micro
2008-02-25 23:27 . 2008-02-25 23:27 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 22:32 . 2008-02-25 22:32 23,040 --a------ C:\info.exe
2008-02-24 11:30 . 2008-02-24 11:31 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-02-13 07:22 . 2008-03-03 22:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-13 07:22 . 2008-02-13 07:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 21:57 . 2008-02-04 21:57 30,740 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-02-04 21:38 . 2006-10-05 03:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-02-04 21:38 . 2006-10-05 03:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-02-04 21:32 . 2008-02-04 21:38 <REP> d-------- C:\Program Files\Picasa2
2008-02-04 21:32 . 2008-02-04 21:32 <REP> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-27 18:52 --------- d-----w C:\Program Files\MSN Messenger
2008-02-26 21:03 12,800 ----a-w C:\WINDOWS\system32\svchost.exe
2008-02-26 21:03 12,800 ----a-w C:\WINDOWS\system32\dllcache\svchost.exe
2008-02-12 18:23 --------- d-----w C:\Program Files\PartyGaming
2008-01-13 15:47 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\Apple Computer
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2008-01-06 22:49 --------- d-----w C:\Program Files\QuickTime
2008-01-06 22:49 --------- d-----w C:\Program Files\iTunes
2008-01-06 22:49 --------- d-----w C:\Program Files\iPod
2008-01-06 22:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-06 22:47 --------- d-----w C:\Program Files\Apple Software Update
2008-01-06 22:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-06 13:46 --------- d-----w C:\Program Files\BitComet
2008-01-06 12:35 --------- d-----w C:\Program Files\TimeAdjuster
2008-01-04 22:25 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\vlc
2008-01-04 22:21 --------- d-----w C:\Program Files\VideoLAN
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
.

------- Sigcheck -------

1f063bdbd1afef9ac0abd02384d40376 C:\WINDOWS\system32\wininet.dll
-c----w 581,120 2006-06-23 12:28:30 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
-c----w 603,136 2003-04-24 19:00:00 C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$\wininet.dll
----a-w 660,480 2004-08-19 23:09:47 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\SoftwareDistribution\Download\73231fc5e2f4907698b91ecd0c870ff8\rtmgdr\wininet.dll
----a-w 593,408 2006-06-23 19:46:56 C:\WINDOWS\SoftwareDistribution\Download\73231fc5e2f4907698b91ecd0c870ff8\RTMQFE\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\system32\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\system32\dllcache\wininet.dll

09b38768036508b51564201afb000950 C:\WINDOWS\system32\drivers\ndis.sys
-c----w 162,432 2003-03-06 09:30:58 C:\WINDOWS\$NtServicePackUninstall$\ndis.sys
-c----w 167,552 2003-04-24 19:00:00 C:\WINDOWS\$NtUninstallQ815485$\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\Driver Cache\i386\ndis.sys
----a-w 182,912 2004-08-04 06:14:28 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\system32\dllcache\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2003-04-24 20:00 13312]
"RecordNow!"="" []
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"Microsoft all"="C:\WINDOWS\mmall.exe" [2008-02-26 22:04 24064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-05 12:16 88267 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-15 22:09 110592]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-15 22:08 618496]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10 335872]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-09-26 01:04 114741]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01 110592]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2003-07-17 13:50 184412]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2007-12-28 00:56 32881]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Microsoft all"="C:\WINDOWS\mmall.exe" [2008-02-26 22:04 24064]
"ws2_64.exe"="C:\WINDOWS\System32\ws2_64.exe" [2008-02-27 19:49 7168]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-04-24 20:00 13312]

R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 01:32]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\System32\Drivers\WBSD.SYS [2003-03-20 17:24]
S2 riode32;riode32;C:\WINDOWS\system32\drivers\riode32.sys []
S3 spfhlp.sys;spfhlp.sys;C:\Documents and Settings\ELODIE\spfhlp.sys []

*Newly Created Service* - AVGASCLN
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-23 12:11:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-04 23:13:34
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????????A)w?????????? ?deB???????????????B? ??????

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-04 23:14:51
ComboFix-quarantined-files.txt 2008-03-04 22:14:40
ComboFix2.txt 2008-02-27 22:36:14
.
2008-02-26 22:39:09 --- E O F ---

ok merci pour ton aide green bay !

je vais faire ca demain, on se reverra surement ;)

merci encore!

++

Bonsoir,

J'ai effectué la procédure ci-dessous:

https://www.commentcamarche.net/list 3174 virus methode preliminaire de desinfection version fr

J'ai fait des scan avec AVG, BitDefender puis HijackThis dont voici les rapports:

AVG:

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 22:17:51 03/03/2008

+ Résultat de l'analyse:

HKU\S-1-5-21-776561741-839522115-1060284298-1003\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : Aucune action entreprise.
C:\QooBox\Quarantine\C\Program Files\BraveSentry\BraveSentry0.bs.vir -> Adware.MrAntispy : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017454.exe -> Dialer.GBDialer.j : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0006393.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0006394.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0006586.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0006587.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007550.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007551.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008562.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008563.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015367.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015368.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017535.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017536.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017553.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017555.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP90\A0017573.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP90\A0017574.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP91\A0017584.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP91\A0017586.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP91\A0017605.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP91\A0017606.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\WINDOWS\mm_tmphr3.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\WINDOWS\mmhr3.exe -> Downloader.Agent.ipr : Aucune action entreprise.
[3000] C:\WINDOWS\mmhr3.exe -> Downloader.Agent.ipr : Aucune action entreprise.
C:\tlmnmae.exe -> Downloader.Agent.jmz : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017447.sys -> Downloader.Small : Aucune action entreprise.
C:\QooBox\Quarantine\C\Program Files\Helper\1204059896.dll.vir -> Not-A-Virus.Adware.E404 : Aucune action entreprise.
C:\QooBox\Quarantine\C\Program Files\Helper\1204059988.dll.vir -> Not-A-Virus.Adware.E404 : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016414.dll -> Not-A-Virus.Adware.E404 : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016415.dll -> Not-A-Virus.Adware.E404 : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\desktop.html.vir -> Not-A-Virus.Hoax.Win32.Renos.cy : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017448.sys -> Proxy.Agent.xo : Aucune action entreprise.
C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga4m1et4.exe.vir -> Proxy.Agent.zd : Aucune action entreprise.
C:\SDFix\backups\backups.zip/backups/taskmon.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0006491.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007555.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008555.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015361.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016424.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017475.exe -> Proxy.Agent.zd : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017486.exe -> Proxy.Agent.zd : Aucune action entreprise.
:mozilla.6:C:\Documents and Settings\ELODIE\Application Data\Mozilla\Firefox\Profiles\z1pypauf.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.7:C:\Documents and Settings\ELODIE\Application Data\Mozilla\Firefox\Profiles\z1pypauf.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.9:C:\Documents and Settings\ELODIE\Application Data\Mozilla\Firefox\Profiles\z1pypauf.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.13:C:\Documents and Settings\ELODIE\Application Data\Mozilla\Firefox\Profiles\z1pypauf.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017534.exe -> Trojan.Delf.aps : Aucune action entreprise.
C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017552.exe -> Trojan.Delf.aps : Aucune action entreprise.
C:\WINDOWS\mm_tmpoc2.exe -> Trojan.Delf.aps : Aucune action entreprise.
C:\QooBox\Quarantine\C\Documents and Settings\ELODIE\Application Data\Microsoft\Internet Explorer\Desktop.htt.vir -> Trojan.Renos : Aucune action entreprise.

Fin du rapport

BitDefender Online Scanner

Scan report generated at: Mon, Mar 03, 2008 - 23:26:28

Scan path: C:\;D:\;E:\;

Statistics

Time

00:57:39

Files

129464

Folders

3681

Boot Sectors

2

Archives

1732

Packed Files

9122

Results

Identified Viruses

23

Infected Files

96

Suspect Files

1

Warnings

0

Disinfected

0

Deleted Files

95

Engines Info

Virus Definitions

985107

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\Documents and Settings\ELODIE\Bureau\catchme.zip=>pcximg.pif

Infected with: Trojan.Agent.AHBT

C:\Documents and Settings\ELODIE\Bureau\catchme.zip=>pcximg.pif

Deleted

C:\Documents and Settings\ELODIE\Bureau\catchme.zip

Updated

C:\Documents and Settings\ELODIE\tmp.exe

Infected with: Packer.Krunchy.B

C:\Documents and Settings\ELODIE\tmp.exe

Disinfection failed

C:\Documents and Settings\ELODIE\tmp.exe

Deleted

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\92QEXNBD\2202aa[1].exe

Infected with: BehavesLike:Win32.ExplorerHijack

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\92QEXNBD\2202aa[1].exe

Disinfection failed

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\92QEXNBD\2202aa[1].exe

Deleted

C:\mbjuwp.exe

Infected with: Backdoor.Tofsee.H

C:\mbjuwp.exe

Deleted

C:\qgxo.exe

Infected with: Trojan.Srizbi.BC

C:\qgxo.exe

Deleted

C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir

Infected with: Trojan.Adloader.JC

C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\ucleaner_setup.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\alt.exe.exe.vir

Infected with: Trojan.Proxy.Horst.APD

C:\QooBox\Quarantine\C\WINDOWS\system32\alt.exe.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q1.exe.vir

Infected with: Trojan.Peed.IZI

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q1.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q1.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q2.exe.vir

Infected with: Trojan.Peed.Gen

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q2.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q2.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q5.exe.vir

Infected with: Trojan.Peed.IZI

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q5.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q5.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q6.exe.vir

Infected with: Trojan.Peed.IZI

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q6.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q6.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q7.exe.vir

Infected with: Trojan.Peed.IZI

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q7.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\dllgh8jkd1q7.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\asc3550p.sys.vir

Infected with: Rootkit.Agent.WI

C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\asc3550p.sys.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\asc3550p.sys.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\shift.exe.exe.vir

Infected with: Trojan.Peed.IWW

C:\QooBox\Quarantine\C\WINDOWS\system32\shift.exe.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\shift.exe.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\svcp.csv.vir

Infected with: Trojan.Peed.IQY

C:\QooBox\Quarantine\C\WINDOWS\system32\svcp.csv.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\svcp.csv.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga1me4t1.exe.vir

Infected with: Trojan.Peed.IZN

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga1me4t1.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga1me4t1.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga4me1.exe.vir

Infected with: Generic.Malware.SYddld!!.9A33DA6D

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga4me1.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\vedxga4me1.exe.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\xpupdate.exe.vir

Infected with: Trojan.Peed.Gen

C:\QooBox\Quarantine\C\WINDOWS\xpupdate.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\xpupdate.exe.vir

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP59\A0004824.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP59\A0004824.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP59\A0004824.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP71\A0004958.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP71\A0004958.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP71\A0004958.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP81\A0005101.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP81\A0005101.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP81\A0005101.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005185.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005185.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005185.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005279.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005279.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005279.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005280.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005280.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005280.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005291.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005291.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005291.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005303.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005303.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0005303.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007553.exe

Infected with: Trojan.Peed.IZM

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007553.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007553.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007554.exe

Infected with: Trojan.Peed.IZM

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007554.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0007554.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008539.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008539.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008539.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008550.exe

Infected with: Trojan.Peed.IZM

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008550.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008550.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008552.exe

Infected with: Trojan.Peed.IZM

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008552.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008552.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008557.exe

Infected with: Trojan.Peed.IWX

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008557.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008559.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008559.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008559.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008560.exe

Infected with: Packer.Krunchy.B

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008560.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0008560.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0010288.exe=>:exe.exe

Infected with: Dropped:Backdoor.Agent.ZCI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0010288.exe=>:exe.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0010288.exe=>:exe.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0010288.exe

Updated

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0011321.exe

Infected with: Packer.Krunchy.B

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0011321.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0011321.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0014803.exe=>:exe.exe

Infected with: Dropped:Backdoor.Agent.ZCI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0014803.exe=>:exe.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0014803.exe=>:exe.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0014803.exe

Updated

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015256.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015256.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015256.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015311.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015311.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015311.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015312.exe

Infected with: Trojan.Peed.IZN

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015312.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015312.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015316.exe

Infected with: Trojan.Peed.IWW

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015316.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015316.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015345.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015345.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015345.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015358.exe

Infected with: Generic.Malware.SYddld!!.9A33DA6D

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015358.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015358.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015359.exe

Infected with: Trojan.Peed.IZN

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015359.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015359.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015363.exe

Infected with: Trojan.Peed.IWX

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015363.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015376.exe

Infected with: Trojan.Peed.IYS

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015376.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0015376.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016416.exe

Infected with: Trojan.Adloader.JC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016416.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016416.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016418.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016418.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016418.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016419.sys

Infected with: Rootkit.Agent.WI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016419.sys

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016419.sys

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016420.exe

Infected with: Trojan.Proxy.Horst.APD

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016420.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016421.exe

Infected with: Trojan.Peed.IWW

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016421.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016421.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016423.exe

Infected with: Trojan.Peed.IZN

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016423.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016423.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016425.exe

Infected with: Generic.Malware.SYddld!!.9A33DA6D

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016425.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016425.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016426.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016426.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016426.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016427.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016427.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016427.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016428.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016428.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016428.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016429.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016429.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016429.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016430.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016430.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0016430.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017457.dll

Infected with: Trojan.Downloader.Small.AALQ

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017457.dll

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017458.dll

Infected with: Trojan.Agent.AHAP

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017458.dll

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017459.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017459.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017459.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017460.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017460.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017460.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017461.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017461.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017461.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017462.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017462.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017462.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017463.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017463.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017463.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017464.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017464.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017464.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017465.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017465.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017465.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017466.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017466.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017466.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017467.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017467.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017467.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017472.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017472.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017472.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017473.exe

Infected with: Packer.Krunchy.B

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017473.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017473.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017474.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017474.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017474.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017483.exe

Infected with: Trojan.Peed.IZI

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017483.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017483.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017485.exe

Infected with: Packer.Krunchy.B

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017485.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017485.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017487.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017487.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017487.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017488.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017488.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017488.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017489.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017489.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017489.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017490.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017490.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017490.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017491.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017491.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017491.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017492.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017492.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017492.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017493.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017493.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017493.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017494.exe

Infected with: Generic.Malware.dld!!.9C66C7BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017494.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017494.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017495.exe

Infected with: Generic.Malware.dld!!.0E3CDAE4

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017495.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017495.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017500.exe

Infected with: Trojan.Peed.Gen

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017500.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP89\A0017500.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017776.exe

Infected with: DeepScan:Generic.Malware.SFYd.5E1C35E2

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017776.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017776.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017777.exe

Infected with: Trojan.Agent.AHBT

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017777.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017781.exe

Infected with: DeepScan:Generic.Malware.SFYd.5E1C35E2

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017781.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017781.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017794.exe

Infected with: Packer.Krunchy.B

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017794.exe

Disinfection failed

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017794.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017795.exe

Infected with: Backdoor.Tofsee.H

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017795.exe

Deleted

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017796.exe

Infected with: Trojan.Srizbi.BC

C:\System Volume Information\_restore{94CF56A8-8C0D-4791-A975-02A9AE52B1D9}\RP92\A0017796.exe

Deleted

C:\WINDOWS\$NtServicePackUninstall$\svchost.exe=>:exe.exe

Infected with: Dropped:Backdoor.Agent.ZCI

C:\WINDOWS\$NtServicePackUninstall$\svchost.exe=>:exe.exe

Disinfection failed

C:\WINDOWS\$NtServicePackUninstall$\svchost.exe=>:exe.exe

Deleted

C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

Updated

C:\WINDOWS\e01.exe

Infected with: Trojan.Peed.Gen

C:\WINDOWS\e01.exe

Disinfection failed

C:\WINDOWS\e01.exe

Deleted

C:\WINDOWS\Installer\{11f7119b-afc6-4d49-9179-40bcd58ffa25}\zip.dll

Infected with: Trojan.Agent.AHAP

C:\WINDOWS\Installer\{11f7119b-afc6-4d49-9179-40bcd58ffa25}\zip.dll

Deleted

C:\WINDOWS\Installer\{32a88bec-bd74-46b9-9e99-c6a9ba5b877a}\zip.dll

Infected with: Trojan.Agent.AHAP

C:\WINDOWS\Installer\{32a88bec-bd74-46b9-9e99-c6a9ba5b877a}\zip.dll

Deleted

C:\WINDOWS\Installer\{ffc6e4bc-39c1-4c4f-9e6d-43f9099c0bab}\zip.dll

Infected with: Trojan.Agent.AHAP

C:\WINDOWS\Installer\{ffc6e4bc-39c1-4c4f-9e6d-43f9099c0bab}\zip.dll

Deleted

C:\WINDOWS\mmall.exe

Suspected of: Generic.Malware.Sdld.20C7E7EA

C:\WINDOWS\mmall.exe

Disinfection failed

C:\WINDOWS\mmall.exe

Delete failed

C:\WINDOWS\system32\ws2_64.exe

Infected with: Generic.Malware.SYddld!!.9A33DA6D

C:\WINDOWS\system32\ws2_64.exe

Disinfection failed

C:\WINDOWS\system32\ws2_64.exe

Delete failed

rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:34:31, on 03/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\mmall.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ws2_64.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\mmall.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www8.hp.com/fr/fr/home.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www8.hp.com/fr/fr/home.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F3 - REG:win.ini: run=C:\WINDOWS\mmall.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe
O4 - HKLM\..\Run: [ws2_64.exe] C:\WINDOWS\System32\ws2_64.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Microsoft all] C:\WINDOWS\mmall.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

@ni_koMerci d'avance à ceux qui peuvent m'aider...

d'accord, je fais ca et je reviens... merci

re,

voici le report SDFix:

[b]SDFix: Version 1.148 [/b]

Run by ELODIE on 28/02/2008 at 00:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Name:
pcximg
taskmon.sys

Path:
\??\C:\WINDOWS\system\pcximg.pif
\??\C:\WINDOWS\System32\taskmon.sys

pcximg - Deleted
taskmon.sys - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Service asc3550p - Deleted after Reboot

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\Installer\{62b68bd0-67ee-4263-a891-a4530c691fd5}\KbdDrive.dll - Deleted
C:\WINDOWS\Installer\{2764cb82-ae1a-4bc1-a9bb-bfe759b3eb1b}\zip.dll - Deleted
C:\-12774~1 - Deleted
C:\Program Files\tmp155323.exe - Deleted
C:\Program Files\tmp155343.exe - Deleted
C:\Program Files\tmp157826.exe - Deleted
C:\Program Files\tmp214177.exe - Deleted
C:\Program Files\tmp214278.exe - Deleted
C:\Program Files\tmp214308.exe - Deleted
C:\Program Files\tmp217522.exe - Deleted
C:\Program Files\tmp221879.exe - Deleted
C:\Program Files\tmp317766.exe - Deleted
C:\Program Files\tmp435095.exe - Deleted
C:\Program Files\tmp435105.exe - Deleted
C:\Program Files\tmp435115.exe - Deleted
C:\Program Files\tmp435366.exe - Deleted
C:\WINDOWS\system32\n2ewma1xxsv2234.exe - Deleted
C:\WINDOWS\system32\runtime.exe - Deleted
C:\WINDOWS\system32\wind32.exe - Deleted
C:\WINDOWS\taskmon.exe - Deleted
C:\WINDOWS\system\pcximg.pif - Deleted

Folder C:\WINDOWS\Installer\{62b68bd0-67ee-4263-a891-a4530c691fd5} - Removed
Folder C:\WINDOWS\Installer\{2764cb82-ae1a-4bc1-a9bb-bfe759b3eb1b} - Removed

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 00:12:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 36

[b]Remaining Services [/b]:

Authorized Application Key Export:

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 4 Feb 2008 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Tue 26 Feb 2008 24,102 ..SHR --- "C:\WINDOWS\Installer\{11f7119b-afc6-4d49-9179-40bcd58ffa25}\zip.dll"
Tue 26 Feb 2008 24,102 ..SHR --- "C:\WINDOWS\Installer\{32a88bec-bd74-46b9-9e99-c6a9ba5b877a}\zip.dll"
Wed 27 Feb 2008 24,102 ..SHR --- "C:\WINDOWS\Installer\{ffc6e4bc-39c1-4c4f-9e6d-43f9099c0bab}\zip.dll"
Wed 27 Feb 2008 153,450 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\02418795bf9ae0332d2724a0721b3b6a\BIT152B.tmp"
Wed 27 Feb 2008 103,201 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\04d77a314e978a6d2e5e499ece3dd910\BIT152E.tmp"
Wed 21 Nov 2007 102,648 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0736b9819d78ce6fd28d7a44be52cc29\BIT1521.tmp"
Wed 27 Feb 2008 150,705 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\12c9c7b74d009cd8f751411d54cc4b11\BIT1527.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2b0ec6af95107cd747155f214801a1de\BIT1544.tmp"
Wed 27 Feb 2008 10,703,680 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3a4b17774256790710b116f48cad024c\BIT1525.tmp"
Wed 27 Feb 2008 104,552 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4896e7eb404b9f0d2ec9221b3c0f425b\BIT153A.tmp"
Wed 27 Feb 2008 156,087 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4c5c888ff189ce65af20cc141b13bcd3\BIT1526.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5857fd464a38367b479c179d651cd5d4\BIT1545.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\598b3ea05d3c2f275520ea46f80fb98d\BIT154D.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d24ad19cee78bba662249a4deccb260\BIT154F.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5f04040f0ee4f5284e03d88e1fa5a7e1\BIT1550.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6291f486ec5de5182ec3cff2071af184\BIT1547.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\79dfe016119d9f9104f7a081382c2de7\BIT1549.tmp"
Wed 27 Feb 2008 156,723 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7a40be1d5e41517009a903a286bf28bd\BIT1535.tmp"
Wed 27 Feb 2008 156,257 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7bd07c1089c2af7712a37e4bc06b52c1\BIT152D.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\813a989071c1720c8fca52f421b7b9e5\BIT1548.tmp"
Wed 27 Feb 2008 102,951 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\84fbc956da54d159058962d983555052\BIT1531.tmp"
Wed 27 Feb 2008 103,500 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8cf13444ad5b33cad5e4b774633810f9\BIT1533.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\90e550d1a108d8bbd6da9841aafd83a8\BIT1551.tmp"
Wed 27 Feb 2008 522,480 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\90eded57e7780b832eed3339a922a322\BIT1539.tmp"
Wed 27 Feb 2008 2,174,016 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\96a3d4dd19edfa722414cd456a235932\BIT1534.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a04a8dce324b141449b6bb4b762ae54a\BIT154E.tmp"
Wed 27 Feb 2008 122,680 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a0a06594bec34f1a4bfbddf6cd27d688\BIT152C.tmp"
Wed 27 Feb 2008 804,256 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a3debb4e9e3b20d27b1821077eb58bad\BIT153C.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a4147a8e69c2ca6d401c0a8a62e9bf23\BIT1543.tmp"
Wed 27 Feb 2008 103,611 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ba502b35f31a2bf19a595db79d7bef15\BIT153D.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bd2f344a6cea520182f159a127c8f5ad\BIT1542.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cc102203f99c8c6ebf1523556f8411b6\BIT154C.tmp"
Mon 5 Feb 2007 152,359 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d3d59acde4bc99f07df90298fa402c77\BIT1552.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d92c462d05652e1246e67f0b8524027c\BIT1541.tmp"
Wed 27 Feb 2008 152,663 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e6709a5593e8edb948fefef2ae74a35e\BIT1530.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e8ac11bc9e4687d6c2a32699ff0541d6\BIT154A.tmp"
Wed 27 Feb 2008 105,134 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\edf770ea565c428bca41a4befcabb97b\BIT153B.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ef76b58e91ae8084bf0833c90d4b9382\BIT1546.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f32bfa5d1049b53eae766f9d37379ea6\BIT1553.tmp"
Wed 27 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\02970179a133da43483e5e8495d03f51\download\BIT2B.tmp"

[b]Finished![/b]

oups, dslé, mauvais copier/coller !

ComboFix 08-02-25.3 - ELODIE 2008-02-27 23:27:19.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.387 [GMT 1:00]
Endroit: C:\Documents and Settings\ELODIE\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\ELODIE\Application Data\install.dat
C:\Documents and Settings\ELODIE\Application Data\microsoft\internet explorer\Desktop.htt
C:\Program Files\bravesentry
C:\Program Files\bravesentry\BraveSentry.exe
C:\Program Files\bravesentry\BraveSentry.lic
C:\Program Files\bravesentry\BraveSentry0.bs
C:\Program Files\bravesentry\BraveSentry1.bs
C:\Program Files\Helper
C:\Program Files\Helper\1204059896.dll
C:\Program Files\Helper\1204059988.dll
C:\Program Files\ucleaner_setup.exe
C:\WINDOWS\desktop.html
C:\WINDOWS\mmoc2.exe
C:\WINDOWS\system32\2154937841.dll
C:\WINDOWS\system32\alt.exe.exe
C:\WINDOWS\system32\dllgh8jkd1q1.exe
C:\WINDOWS\system32\dllgh8jkd1q2.exe
C:\WINDOWS\system32\dllgh8jkd1q5.exe
C:\WINDOWS\system32\dllgh8jkd1q6.exe
C:\WINDOWS\system32\dllgh8jkd1q7.exe
C:\WINDOWS\system32\dllgh8jkd1q8.exe
C:\WINDOWS\system32\drivers\asc3550p.sys
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\msssc.dll
C:\WINDOWS\system32\shift.exe.exe
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\vedxg4am1et2.exe
C:\WINDOWS\system32\vedxga1me4t1.exe
C:\WINDOWS\system32\vedxga4m1et4.exe
C:\WINDOWS\system32\vedxga4me1.exe
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\xpupdate.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_ICF
-------\ICF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-27 to 2008-02-27 ))))))))))))))))))))))))))))))))))))
.

2008-02-27 23:33 . 2008-02-27 23:33 1,600 --a------ C:\Documents and Settings\ELODIE\spfhlp.sys
2008-02-27 23:16 . 2008-02-27 23:12 13,824 --a------ C:\WINDOWS\system32\m1ax1d121322116143v.exe
2008-02-27 20:00 . 2008-02-27 20:00 <REP> d-------- C:\Program Files\SysCleaner
2008-02-27 19:55 . 2008-02-27 19:49 7,168 --a------ C:\WINDOWS\system32\ws2_64.exe
2008-02-27 19:51 . 2008-02-27 19:51 <REP> d-------- C:\WINDOWS\LastGood
2008-02-27 19:49 . 2008-02-27 19:49 16,628 --a------ C:\Program Files\tmp435105.exe
2008-02-27 19:49 . 2008-02-27 19:49 16,612 --a------ C:\Program Files\tmp435095.exe
2008-02-27 19:49 . 2008-02-27 19:49 16,596 --a------ C:\Program Files\tmp435115.exe
2008-02-27 19:49 . 2008-02-27 19:49 13,548 --a------ C:\Program Files\tmp435366.exe
2008-02-27 07:56 . 2008-02-27 07:56 <REP> d-------- C:\WINDOWS\provisioning
2008-02-27 07:56 . 2008-02-27 19:35 <REP> d-------- C:\WINDOWS\peernet
2008-02-27 07:50 . 2008-02-27 07:50 <REP> d-------- C:\WINDOWS\ServicePackFiles
2008-02-27 07:48 . 2008-02-27 16:52 <REP> d-------- C:\WINDOWS\LastGood.Tmp
2008-02-27 07:43 . 2004-08-03 22:43 20,480 --a------ C:\WINDOWS\system32\sprecovr.exe
2008-02-27 07:38 . 2003-04-24 20:00 4,186,256 --a------ C:\WINDOWS\system32\dllcache\luna.mst
2008-02-27 07:35 . 2008-02-27 19:35 <REP> d-------- C:\WINDOWS\EHome
2008-02-27 07:27 . 2008-02-27 07:27 112,640 --a------ C:\Documents and Settings\ELODIE\tmp.exe
2008-02-27 07:26 . 2008-02-27 07:26 4,608 --a------ C:\Program Files\tmp157826.exe
2008-02-27 07:26 . 2008-02-27 07:26 4,608 --a------ C:\Program Files\tmp155343.exe
2008-02-27 07:26 . 2008-02-27 07:26 4,608 --a------ C:\Program Files\tmp155323.exe
2008-02-27 00:05 . 2008-02-27 07:25 78,848 --a------ C:\WINDOWS\taskmon.exe
2008-02-27 00:04 . 2004-08-02 14:20 7,208 --------- C:\WINDOWS\system32\secupd.sig
2008-02-27 00:04 . 2004-08-02 14:20 4,569 --------- C:\WINDOWS\system32\secupd.dat
2008-02-27 00:00 . 2008-02-27 00:00 9,773 --a------ C:\Documents and Settings\ELODIE\spoolsv.bin
2008-02-26 23:59 . 2008-02-26 23:59 4,608 --a------ C:\Program Files\tmp217522.exe
2008-02-26 23:59 . 2008-02-26 23:59 4,608 --a------ C:\Program Files\tmp214308.exe
2008-02-26 23:59 . 2008-02-26 23:59 4,608 --a------ C:\Program Files\tmp214278.exe
2008-02-26 23:59 . 2008-02-26 23:59 4,608 --a------ C:\Program Files\tmp214177.exe
2008-02-26 23:31 . 2004-03-10 19:01 608,256 -----c--- C:\WINDOWS\system32\dllcache\xpsp2res.dll
2008-02-26 23:31 . 2004-01-10 06:11 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2008-02-26 23:30 . 2008-02-26 23:30 355 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-26 23:12 . 2008-02-27 22:21 39,424 --a------ C:\WINDOWS\mmhr3.exe
2008-02-26 23:12 . 2008-02-27 22:21 39,424 --a------ C:\WINDOWS\mm_tmphr3.exe
2008-02-26 22:04 . 2008-02-26 22:04 147,456 --a------ C:\qgxo.exe
2008-02-26 22:04 . 2008-02-26 22:04 112,640 --a------ C:\WINDOWS\system32\runtime.exe
2008-02-26 22:04 . 2008-02-26 22:04 58,368 --a------ C:\tlmnmae.exe
2008-02-26 22:04 . 2008-02-26 22:04 54,764 --a------ C:\WINDOWS\system\pcximg.pif
2008-02-26 22:04 . 2008-02-26 22:04 44,878 --a------ C:\mbjuwp.exe
2008-02-26 22:04 . 2008-02-26 22:04 24,064 --a------ C:\WINDOWS\mmall.exe
2008-02-26 22:04 . 2008-02-26 22:04 6,205 --a------ C:\Documents and Settings\ELODIE\smss.bin
2008-02-26 22:04 . 2008-02-26 22:04 4,608 --a------ C:\Program Files\tmp221879.exe
2008-02-26 22:04 . 2008-02-26 22:04 2 --a------ C:\-127741018
2008-02-26 21:22 . 2008-02-26 21:22 <REP> d-------- C:\WINDOWS\system32\bits
2008-02-26 20:48 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-26 20:31 . 2008-02-27 19:51 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-02-25 23:41 . 2008-02-25 23:41 <REP> d-------- C:\Program Files\Trend Micro
2008-02-25 23:27 . 2008-02-25 23:27 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-25 22:32 . 2008-02-25 22:32 23,040 --a------ C:\info.exe
2008-02-25 22:32 . 2008-02-25 22:32 17,872 --a------ C:\WINDOWS\system32\wind32.exe
2008-02-25 22:32 . 2008-02-25 22:32 17,872 --a------ C:\WINDOWS\e01.exe
2008-02-25 22:32 . 2008-02-25 22:32 13,682 --a------ C:\WINDOWS\system32\n2ewma1xxsv2234.exe
2008-02-24 11:30 . 2008-02-24 11:31 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-02-13 07:22 . 2008-02-27 23:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-13 07:22 . 2008-02-13 07:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-04 21:57 . 2008-02-04 21:57 30,740 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-02-04 21:38 . 2006-10-05 03:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-02-04 21:38 . 2006-10-05 03:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-02-04 21:32 . 2008-02-04 21:38 <REP> d-------- C:\Program Files\Picasa2
2008-02-04 21:32 . 2008-02-04 21:32 <REP> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-27 18:52 --------- d-----w C:\Program Files\MSN Messenger
2008-02-12 18:23 --------- d-----w C:\Program Files\PartyGaming
2008-01-13 15:47 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\Apple Computer
2008-01-06 22:49 --------- d-----w C:\Program Files\QuickTime
2008-01-06 22:49 --------- d-----w C:\Program Files\iTunes
2008-01-06 22:49 --------- d-----w C:\Program Files\iPod
2008-01-06 22:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-06 22:47 --------- d-----w C:\Program Files\Apple Software Update
2008-01-06 22:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-06 13:46 --------- d-----w C:\Program Files\BitComet
2008-01-06 12:35 --------- d-----w C:\Program Files\TimeAdjuster
2008-01-04 22:25 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\vlc
2008-01-04 22:21 --------- d-----w C:\Program Files\VideoLAN
2007-12-31 13:09 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\Talkback
2007-12-31 12:31 --------- d-----w C:\Program Files\Alwil Software
2007-12-28 12:37 --------- d-----w C:\Program Files\Microsoft.NET
2007-12-28 00:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-28 00:02 --------- d-----w C:\Program Files\InterVideo
2007-12-27 23:56 --------- d-----w C:\Program Files\Java
2007-12-27 23:56 --------- d-----w C:\Program Files\Fichiers communs\Java
2007-12-27 23:54 --------- d-----w C:\Program Files\HPQ
2007-12-27 23:52 --------- d-----w C:\Program Files\Sonic
2007-12-27 23:52 --------- d-----w C:\Program Files\RecordNow!
2007-12-27 23:52 --------- d-----w C:\Program Files\Fichiers communs\SureThing Shared
2007-12-27 23:52 --------- d-----w C:\Program Files\Fichiers communs\Sonic
2007-12-27 23:52 --------- d-----w C:\Documents and Settings\ELODIE\Application Data\Sonic
2007-12-27 23:51 --------- d-----w C:\Program Files\HP DLA
2007-12-27 23:50 --------- d-----w C:\Program Files\Intel
2007-12-27 23:49 --------- d-----w C:\Program Files\ATI Technologies
2007-12-27 23:48 --------- d-----w C:\Program Files\Synaptics
2007-12-27 23:43 1,697 --sha-r C:\WINDOWS\system32\drivers\HP_CPQ nx7010 (PG598ES ABF)_YN_U_QCND435_E_4_I0860_SCOMPAL_V8051 Version 24.54_B68BAL Ver. F.42_T040507_WXP1_L40C_M512_J60_7Intel_8Pentium M_91,5_111063044_N10EC8139_P15241410_Z808624C6_K_A808624C5_U808624C2_G.MRK
2007-12-27 23:34 --------- d-----w C:\Program Files\WIDCOMM
2007-12-27 23:33 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-12-27 23:33 --------- d-----w C:\Program Files\Analog Devices
2007-12-27 23:23 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-27 23:21 --------- d-----w C:\Program Files\Services en ligne
.

------- Sigcheck -------

1f063bdbd1afef9ac0abd02384d40376 C:\WINDOWS\system32\wininet.dll
-c----w 581,120 2006-06-23 12:28:30 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll
-c----w 603,136 2003-04-24 19:00:00 C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$\wininet.dll
----a-w 660,480 2004-08-19 23:09:47 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\SoftwareDistribution\Download\73231fc5e2f4907698b91ecd0c870ff8\rtmgdr\wininet.dll
----a-w 593,408 2006-06-23 19:46:56 C:\WINDOWS\SoftwareDistribution\Download\73231fc5e2f4907698b91ecd0c870ff8\RTMQFE\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\system32\wininet.dll
----a-w 581,120 2006-06-23 12:28:30 C:\WINDOWS\system32\dllcache\wininet.dll

09b38768036508b51564201afb000950 C:\WINDOWS\system32\drivers\ndis.sys
-c----w 162,432 2003-03-06 09:30:58 C:\WINDOWS\$NtServicePackUninstall$\ndis.sys
-c----w 167,552 2003-04-24 19:00:00 C:\WINDOWS\$NtUninstallQ815485$\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\Driver Cache\i386\ndis.sys
----a-w 182,912 2004-08-04 06:14:28 C:\WINDOWS\SoftwareDistribution\Download\70ccc3de7e94865059fbcf2f809c03b1\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\system32\dllcache\ndis.sys
----a-w 162,432 2003-03-06 09:30:58 C:\WINDOWS\system32\drivers\ndis.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2003-04-24 20:00 13312]
"RecordNow!"="" []
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"SVCHOST.EXE"="C:\WINDOWS\System32\drivers\svchost.exe" [ ]
"Microsoft all"="C:\WINDOWS\mmall.exe" [2008-02-26 22:04 24064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-05 12:16 88267 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-15 22:09 110592]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-15 22:08 618496]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10 335872]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-09-26 01:04 114741]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 01:01 110592]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2003-07-17 13:50 184412]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2007-12-28 00:56 32881]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"SystemSv121"="C:\WINDOWS\System32\n2ewma1xxsv2234.exe" [2008-02-25 22:32 13682]
"runtime.exe"="C:\WINDOWS\System32\runtime.exe" [2008-02-26 22:04 112640]
"Microsoft all"="C:\WINDOWS\mmall.exe" [2008-02-26 22:04 24064]
"taskmon"="C:\WINDOWS\taskmon.exe" [2008-02-27 07:25 78848]
"ws2_64.exe"="C:\WINDOWS\System32\ws2_64.exe" [2008-02-27 19:49 7168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-04-24 20:00 13312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"KbdDrive"= {62b68bd0-67ee-4263-a891-a4530c691fd5} - C:\WINDOWS\Installer\{62b68bd0-67ee-4263-a891-a4530c691fd5}\KbdDrive.dll [2008-02-26 22:04 13862]
"zip"= {2764cb82-ae1a-4bc1-a9bb-bfe759b3eb1b} - C:\WINDOWS\Installer\{2764cb82-ae1a-4bc1-a9bb-bfe759b3eb1b}\zip.dll [2008-02-27 07:26 24102]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-23 12:11:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 23:33:42
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????????A)w?????????? ?deB???????????????B? ??????

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2800.1106]
-> C:\WINDOWS\Installer\{62b68bd0-67ee-4263-a891-a4530c691fd5}\KbdDrive.dll
-> C:\WINDOWS\Installer\{2764cb82-ae1a-4bc1-a9bb-bfe759b3eb1b}\zip.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\imapi.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-27 23:36:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-27 22:35:54
.
2008-02-26 22:39:09 --- E O F ---

je dois refaire la procédure?

ok je fais ca et je te poste le rapport... merci

re green day,

voici le rapport:

ComboFix 08-02-25.3 - ELODIE 2008-02-27 23:27:19.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.387 [GMT 1:00]
Endroit: C:\Documents and Settings\ELODIE\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\ELODIE\Application Data\install.dat
C:\Documents and Settings\ELODIE\Application Data\microsoft\internet explorer\Desktop.htt
C:\Program Files\bravesentry
C:\Program Files\bravesentry\BraveSentry.exe
C:\Program Files\bravesentry\BraveSentry.lic
C:\Program Files\bravesentry\BraveSentry0.bs
C:\Program Files\bravesentry\BraveSentry1.bs
C:\Program Files\Helper
C:\Program Files\Helper\1204059896.dll
C:\Program Files\Helper\1204059988.dll
C:\Program Files\ucleaner_setup.exe
C:\WINDOWS\desktop.html
C:\WINDOWS\mmoc2.exe
C:\WINDOWS\system32\2154937841.dll
C:\WINDOWS\system32\alt.exe.exe
C:\WINDOWS\system32\dllgh8jkd1q1.exe
C:\WINDOWS\system32\dllgh8jkd1q2.exe
C:\WINDOWS\system32\dllgh8jkd1q5.exe
C:\WINDOWS\system32\dllgh8jkd1q6.exe
C:\WINDOWS\system32\dllgh8jkd1q7.exe
C:\WINDOWS\system32\dllgh8jkd1q8.exe
C:\WINDOWS\system32\drivers\asc3550p.sys
C:\WINDOWS\system32\drivers\svchost.exe
C:\WINDOWS\system32\kr_done1
C:\WINDOWS\system32\msssc.dll
C:\WINDOWS\system32\shift.exe.exe
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\vedxg4am1et2.exe
C:\WINDOWS\system32\vedxga1me4t1.exe
C:\WINDOWS\system32\vedxga4m1et4.exe
C:\WINDOWS\system32\vedxga4me1.exe
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\xpupdate.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_ICF
-------\ICF

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-27 to 2008-02-27 ))))))))))))))))))))))))))))))))))))
.

Merci du conseil Marcwell, je vais faire ca, on va voir ce que ca donne... mais pas sûr qu'il puisse tous les supprimer

@ni_koAvast ne peut pas supprimer Win32:Delf-HQH... qqn saurait comment faire? merci d'avance...