mon ordinateur est infecté???

lucchinip · le 29 février 2008

Bonjour ou Bonsoir tout le monde.......

J'envoie mon log HijackThis.... Peut on m'aider SVP

Merci

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:17:16, on 29/02/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Avast4\aswUpdSv.exe

C:\Program Files\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\SYSTEM32\GEARSEC.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Megatec\RUPS 2000\Rupsd.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\UltraBackup\4.9\bin\thpassiveclientsvc.exe

C:\WINDOWS\system32\wwSecure.exe

C:\Program Files\Avast4\ashMaiSv.exe

C:\Program Files\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Avast4\ashSimpl.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Lucchini Pierre\Mes documents\Pierre LUCCHINI\téléchargements\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.orange.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: FlpLauncher Class - {4401FDC3-7996-4774-8D2B-C1AE9CD6CC25} - C:\Program Files\E-Book Systems\FlipAlbum 6 Standard\FpLaunch.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: LostGoggles plug-in (web site preview snapshots - www.lostgoggles.com) - {6291957C-8CE9-4c90-BEFF-12D9E68CFF30} - C:\Program Files\LostGoggles\LGoggles.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - C:\Program Files\Copernic Desktop Search 2\DesktopSearchBand201013011.dll

O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe

O4 - HKCU\..\Policies\Explorer\Run: [Windows Security Tool] WinSecure.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll

O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll

O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll

O12 - Plugin for .mut: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll

O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll

O12 - Plugin for .xmz: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1184165541140

O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://paris.ville.orange.fr/CO/activex/AxisCamControl.cab

O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe

O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

O23 - Service: BvrpKrnl - Unknown owner - C:\Program Files\WinFax eXPert\BVRPKrnl.exe

O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: Rupsd - Mega System Technologies, Inc. - C:\Program Files\Megatec\RUPS 2000\Rupsd.exe

O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe

O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

O23 - Service: Astase ThalliumBackup Client Background Service (thpassivesvc) - Astase - C:\Program Files\UltraBackup\4.9\bin\thpassiveclientsvc.exe

O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

--

End of file - 11777 bytes

Lien Rag · le 29 février 2008

Bonjour

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

Guide d'utilisation : http://mickael.barroux.free.fr/securite/sdfix.php

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

[*]Redémarre ton ordinateur

[*]Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).

[*]A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.

[*]Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".

[*]Choisis ton compte.

Déroule la liste des instructions ci-dessous :

[*]Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script.

[*]Appuie sur Y pour commencer le processus de nettoyage.

[*]Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.

[*]Appuie sur une touche pour redémarrer le PC.

[*]Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

[*]Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.

[*]Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.

[*]Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

[*]Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum.

N.B.:

- Le fichier SDFIX_README.htm (dans le dossier SDFix) contient la liste des malwares pris en compte par l'outil.

- Andy fait plusieurs mises à jour, souvent plus d'une par jour... N'hésitez donc pas à demander de télécharger une nouvelle version lorsque le nettoyage dure et que l'outil ne semble pas tout voir.

lucchinip · le 29 février 2008

Merci de ta réponse.

Voici le rapport SDfix

[Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\DOCUME~1\LUCCHI~1\LOCALS~1\Temp\temp_01.exe - Deleted

C:\DOCUME~1\LUCCHI~1\LOCALS~1\Temp\TEMP1.ZIP - Deleted

C:\WINDOWS\system32\NTSpool.exe - Deleted

C:\WINDOWS\system32\WinSecure.exe - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-29 21:09:23

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys0c55f99072]

"001262017220"=hex:79,0d,94,55,db,09,ef,3e,5a,b3,c6,00,aa,f0,39,81

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys0c55f99072]

"001262017220"=hex:79,0d,94,55,db,09,ef,3e,5a,b3,c6,00,aa,f0,39,81

"001b5913c641"=hex:30,1a,8a,4a,43,8c,a4,6d,b4,27,59,bb,26,22,f9,c1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]

"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"

"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 11

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"

"C:\\WINDOWS\\system32\\fxsclnt.exe"="C:\\WINDOWS\\system32\\fxsclnt.exe:*:Enabled:Microsoft Fax Console"

"C:\\Program Files\\GetRight\\getright.exe"="C:\\Program Files\\GetRight\\getright.exe:*:Enabled:GetRight© www.getright.com"

"C:\\Program Files\\Kazaa Lite K++\\KazaaLite.kpp"="C:\\Program Files\\Kazaa Lite K++\\KazaaLite.kpp:*:Enabled:KazaaLite"

"C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.EXE"="C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.EXE:*:Enabled:Visual Basic"

"C:\\Program Files\\Atari\\Act of War - Direct Action\\ACTOFWAR.EXE"="C:\\Program Files\\Atari\\Act of War - Direct Action\\ACTOFWAR.EXE:*:Enabled:ACTOFWAR"

"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"

"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"

"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"

"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"

"C:\\Program Files\\WinFax eXPert\\WinFax.exe"="C:\\Program Files\\WinFax eXPert\\WinFax.exe:*:Enabled:Winfax"

"C:\\Program Files\\WinFax eXPert\\BvrpKrnl.exe"="C:\\Program Files\\WinFax eXPert\\BvrpKrnl.exe:*:Enabled:Bvrpkrnl"

"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"

"C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"="C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"

"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Enabled:AOL 9.0"

"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe:*:Enabled:AOL"

"C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 31 Dec 2003 1,152 A.SH. --- "C:\pdhjawvh.sys"

Wed 21 Sep 2005 7,432 ...HR --- "C:\C_DILLA\B2DE1000.BAK"

Thu 28 Sep 2006 7,432 ...HR --- "C:\C_DILLA\B3C88000.BAK"

Tue 11 Dec 2007 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"

Wed 17 Oct 2007 8 ..SHR --- "C:\WINDOWS\system32\6C363592EC.sys"

Fri 26 Aug 2005 56 ..SHR --- "C:\WINDOWS\system32\D43F2A2B91.sys"

Sat 10 Feb 2007 5 A.SH. --- "C:\WINDOWS\system32\fabdab4_s.dll"

Sun 4 Nov 2007 2,516 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"

Fri 6 Jun 2003 77,824 A..H. --- "C:\Works\PIP\launcher.exe"

Tue 14 Nov 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Fri 19 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Fri 7 Jan 2005 1,569 ..SHR --- "C:\Documents and Settings\Lucchini Pierre\Local Settings\Application Data\SCPSS.DLL"

Tue 18 Dec 2007 23,552 ...H. --- "C:\Documents and Settings\Lucchini Pierre\Mes documents\Paroisse\~WRL0941.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Downloada67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT7.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BITA.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22fb973e059470cc1b5d76c4ae605351\BITE.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT6.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2769b111678c52099a3b3123b12f2325\BITB.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\30285791903730fbf957a83562db4ff4\BIT8.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT5.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9e870549834e2bceb796e44a1e3ac6f5\BITD.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb8921d0c7830b2f33c00fa4c8a10d17\BIT9.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d6e228e44f2018dd79eeb427a0b47d06\BITF.tmp"

Fri 29 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d77b9b5b8fed23dd91f50d167cce60d3\BITC.tmp"

Sun 24 Feb 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT5.tmp"

Wed 31 Oct 2007 1,219,072 ...H. --- "C:\Documents and Settings\Lucchini Pierre\Application Data\Microsoft\ModŠles\~WRL0246.tmp"

Wed 30 Apr 2003 273,408 A..H. --- "C:\Documents and Settings\Lucchini Pierre\Mes documents\Lyc‚es miltaires\Brevet\~WRL3386.tmp"

Fri 20 May 2005 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"

Finished!

Lien Rag · le 29 février 2008

Telecharge AVGanti-spy

Avant tout: Mise à jour ( via l'onglet & connexion internet): si la maj ne fonctionne pas fais le scan qd meme

puis lance un scan complet

supprime ce que AVGas aura trouvé puis génère un rapport

Post le rapport

lucchinip · le 1 mars 2008

Bonjour,

Voici le rapport demandé

VG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

+ Créé à: 11:13:44 01/03/2008

+ Résultat de l'analyse:

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP221\A0060378.exe -> Adware.Casino : Ignoré.

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP221\A0060380.exe -> Adware.Casino : Ignoré.

HKLM\SOFTWARE\Classes\CLSID\{6291957C-8CE9-4c90-BEFF-12D9E68CFF30} -> Adware.Generic : Ignoré.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6291957C-8CE9-4c90-BEFF-12D9E68CFF30} -> Adware.Generic : Ignoré.

HKU\S-1-5-21-3919743573-2389146501-2305241734-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6291957C-8CE9-4C90-BEFF-12D9E68CFF30} -> Adware.Generic : Ignoré.

HKU\S-1-5-21-3919743573-2389146501-2305241734-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6291957C-8CE9-4C90-BEFF-12D9E68CFF30} -> Adware.Generic : Ignoré.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@advertising[1].txt -> TrackingCookie.Advertising : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@adviva[1].txt -> TrackingCookie.Adviva : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@atdmt[2].txt -> TrackingCookie.Atdmt : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@bluestreak[1].txt -> TrackingCookie.Bluestreak : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.

:mozilla.17:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.

:mozilla.18:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.

:mozilla.19:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.

:mozilla.9:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@smartadserver[2].txt -> TrackingCookie.Smartadserver : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@weborama[2].txt -> TrackingCookie.Weborama : Ignoré.

C:\Documents and Settings\Lucchini Pierre\Mes documents\Pierre LUCCHINI\chanson perrine1 Track 1.wma -> Trojan.Wimad.a : Ignoré.

Fin du rapport

lucchinip · le 1 mars 2008

J'avais oublié de nettoyer.

Voici le rapport après "nettoyage"

AVG Anti-Spyware - Rapport d'analyse

---------------------------------------------------------

+ Créé à: 11:22:22 01/03/2008

+ Résultat de l'analyse:

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP221\A0060378.exe -> Adware.Casino : Nettoyé.

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP221\A0060380.exe -> Adware.Casino : Nettoyé.

HKLM\SOFTWARE\Classes\CLSID\{6291957C-8CE9-4c90-BEFF-12D9E68CFF30} -> Adware.Generic : Nettoyé.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6291957C-8CE9-4c90-BEFF-12D9E68CFF30} -> Adware.Generic : Nettoyé.

HKU\S-1-5-21-3919743573-2389146501-2305241734-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6291957C-8CE9-4C90-BEFF-12D9E68CFF30} -> Adware.Generic : Nettoyé.

HKU\S-1-5-21-3919743573-2389146501-2305241734-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6291957C-8CE9-4C90-BEFF-12D9E68CFF30} -> Adware.Generic : Nettoyé.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@adviva[1].txt -> TrackingCookie.Adviva : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.

:mozilla.17:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.18:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.19:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

:mozilla.9:C:\Documents and Settings\Lucchini Pierre\Application Data\Mozilla\Firefox\Profiles\e6xaldeh.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Cookies\lucchini pierre@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.

C:\Documents and Settings\Lucchini Pierre\Mes documents\Pierre LUCCHINI\chanson perrine1 Track 1.wma -> Trojan.Wimad.a : Nettoyé.

Fin du rapport

Lien Rag · le 1 mars 2008

1° conseil

Desinstallation de Avast

2° conseil

http://www.malekal.com//tutorial_antivir_security_suite.php

une fois ces 2 conseils considérés , fais un scan complet avec AVIRA et post nous le rapport stp

lucchinip · le 1 mars 2008

Salut, voici mon rapport après installation de antivir et scan

Merci

AntiVir PersonalEdition Classic

Report file date: 01/03/2008 15:19

Scanning for 1129035 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Lucchini Pierre

Computer name: PAPA

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 14:10:33

ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 14:10:33

ANTIVIR3.VDF : 7.0.2.215 117248 Bytes 29/02/2008 14:10:33

AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 01/03/2008 14:10:34

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.3 360488 Bytes 01/03/2008 14:10:34

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:

Jobname..........................: Rootkit search

Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp

Logging..........................: high

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Scan memory......................: off

Process scan.....................: off

Scan registry....................: off

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: high

Expanded search settings.........: 0x00300922

Start of the scan: 01/03/2008 15:19

Starting search for hidden objects.

HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FF3E9388-AC5C-78BA-ADD2DEDBC8CD3822}\{3A1287C7-66E7-369B-1F735B898390688C}\{D7B36791-6000-8B4A-CB886D7CE3F1E4AE}\h3croqjyx4vdachzcdnm4salhe1

[NOTE] The registry entry is invisible.

'832903' objects were checked, '1' hidden objects were found.

End of the scan: 01/03/2008 15:27

Used time: 07:40 min

The scan has been done completely.

0 Scanning directories

0 Files were scanned

0 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

0 Files cannot be scanned

0 Files not concerned

0 Archives were scanned

0 Warnings

0 Notes

832903 Objects were scanned with rootkit scan

1 Hidden objects were found

Lien Rag · le 1 mars 2008

Post moi un dernier Hijack

lucchinip · le 1 mars 2008

J'ai refait un scan avec antivir...... Le premier m'avait semblé un peu rapide.

J'ai mis les fichiers vérolés en quarantaine...Je peux les effacer?

Je te joins aussi le Hijackthis fait à l'issue.

Merci

AntiVir PersonalEdition Classic

Report file date: samedi 1 mars 2008 17:07

Scanning for 1129035 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: PAPA

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 14:10:33

ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 14:10:33

ANTIVIR3.VDF : 7.0.2.215 117248 Bytes 29/02/2008 14:10:33

AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 01/03/2008 14:10:34

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.3 360488 Bytes 01/03/2008 14:10:34

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: C:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: samedi 1 mars 2008 17:07

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'HiJackThis.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'Watch.exe' - '1' Module(s) have been scanned

Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned

Scan process 'PollingModule.exe' - '1' Module(s) have been scanned

Scan process 'Inactivity.exe' - '1' Module(s) have been scanned

Scan process 'Toaster.exe' - '1' Module(s) have been scanned

Scan process 'ComComp.exe' - '1' Module(s) have been scanned

Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wwSecure.exe' - '1' Module(s) have been scanned

Scan process 'thpassiveclientsvc.exe' - '1' Module(s) have been scanned

Scan process 'Tablet.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'snmp.exe' - '1' Module(s) have been scanned

Scan process 'Rupsd.exe' - '1' Module(s) have been scanned

Scan process 'RichVideo.exe' - '1' Module(s) have been scanned

Scan process 'TabUserW.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'DesktopSearchService.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'GEARSEC.EXE' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned

Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'point32.exe' - '1' Module(s) have been scanned

Scan process 'DkService.exe' - '1' Module(s) have been scanned

Scan process 'CDANTSRV.EXE' - '1' Module(s) have been scanned

Scan process 'btwdins.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned

Scan process 'type32.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'WinPatrol.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

52 processes with 52 modules were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( '36' files ).

Starting the file scan:

Begin scan in 'C:\' <Disque principal>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Program Files\Ictus3\Download\update.exe

[DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen

[iNFO] The file was moved to '482d8f23.qua'!

C:\SDFix\backups\backups.zip

[0] Archive type: ZIP

--> backups/NTSpool.exe

[DETECTION] Is the Trojan horse TR/Delf.own

--> backups/TEMP1.zip

[1] Archive type: CAB (Microsoft)

--> Installer-Crack-Keygen.exe

[DETECTION] Contains detection pattern of the worm WORM/P2P.Agent.N

--> backups/temp_01.exe

[DETECTION] Is the Trojan horse TR/Delf.own

--> backups/WinSecure.exe

[DETECTION] Contains detection pattern of the worm WORM/P2P.Agent.N

[iNFO] The file was deleted!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP254\A0065561.exe

[DETECTION] Contains detection pattern of the dropper DR/Click.Small.QO

[iNFO] The file was moved to '47f9e08b.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP287\A0071773.exe

[DETECTION] Is the Trojan horse TR/Dldr.Bagle.JV

[iNFO] The file was moved to '47f9e0df.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP287\A0071774.exe

[DETECTION] Is the Trojan horse TR/Dldr.Bagle.JV

[iNFO] The file was moved to '47f9e0e3.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP299\A0074041.exe

[DETECTION] Is the Trojan horse TR/Delf.own

[iNFO] The file was moved to '47f9e11c.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP299\A0074042.exe

[DETECTION] Contains detection pattern of the worm WORM/P2P.Agent.N

[iNFO] The file was moved to '47f9e11f.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP299\A0074049.exe

[DETECTION] Is the Trojan horse TR/Delf.own

[iNFO] The file was moved to '47f9e121.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP299\A0074050.exe

[DETECTION] Is the Trojan horse TR/Delf.own

[iNFO] The file was moved to '47f9e123.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP299\A0074051.exe

[DETECTION] Contains detection pattern of the worm WORM/P2P.Agent.N

[iNFO] The file was moved to '47f9e125.qua'!

C:\System Volume Information\_restore{864052BC-19BA-479C-90EF-D7B52A87B268}\RP302\A0074411.exe

[DETECTION] Is the Trojan horse TR/Delphi.Downloader.Gen

[iNFO] The file was moved to '47f9e130.qua'!

C:\téléchargement\file1\OS-Adobe_CS2_KeyGen_Tryout_to_Full.exe

[DETECTION] Is the Trojan horse TR/Agent.RIR.135

[iNFO] The file was moved to '47f6e177.qua'!

End of the scan: dimanche 2 mars 2008 00:28

Used time: 7:21:17 min

The scan has been done completely.

15391 Scanning directories

751778 Files were scanned

15 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

1 files were deleted

0 files were repaired

11 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

751763 Files not concerned

10277 Archives were scanned

1 Warnings

50 Notes

_____________________________

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:36:57, on 02/03/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\WINPAT~1\winpatrol.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Microsoft IntelliType Pro\type32.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\SYSTEM32\GEARSEC.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Program Files\Megatec\RUPS 2000\Rupsd.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\UltraBackup\4.9\bin\thpassiveclientsvc.exe

C:\WINDOWS\system32\wwSecure.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe

C:\Program Files\Wanadoo\GestionnaireInternet.exe

C:\Program Files\Wanadoo\ComComp.exe

C:\PROGRA~1\Wanadoo\Toaster.exe

C:\PROGRA~1\Wanadoo\Inactivity.exe

C:\PROGRA~1\Wanadoo\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\Program Files\Wanadoo\Watch.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\taskmgr.exe