Infecté par NSAnti.H une vraie galère ... SOS !!

[Wullfk]

Re,

 

t'as fait fort 3 antivirus d'installé , il y a un article sur Zebulon qui explique la sécurité dans ces détails ICI ainsi que l'article très complet sur le site de Malekal.com sur le phénomène de surprotection qui peut engendrer plus de mal que de bien LA

 

as tu désisntaller les deux Antivirus de trop (AVG et SYMANTEC) et effectué tous le nettoyage que je t'ai recommandé. si oui refait un scan et un rapport HJT.

 

par contre pour ce qui est de l'élimination du trojan, je laisse le soins au spécialiste de la sécurité de t'indiquer la marche à suivre pour effectuer la désinfection.

 

Salut

Modifié le 1 mai 2008 par Wullfk

[guy-pol]

OK Wullfk,

 

Merci, je vais lire ces articles.

 

En fait, j'avais désinstallé Norton avant d'installer AVG mais il me reste toujours Live Update qui prétend être utile à d'autres programmes Symantec, donc je l'ai gardé. C'est lui qui doit laisser des traces, mais je ne sais pas si je dois le désinstaller ??

 

Sinon, je suis en train de désinstaller AVG, et je vais essayer de nettoyer plus en profondeur Norton avec les outils que tu m'as indiqué.

 

Salut (j'ai tenté d'insérer un smiley, mais ça ne marche pas ...)

[guy-pol]

Bonsoir !

 

Suite à la procédure qui m'a été conseillée, j'ai obtenu les rapports Antivir et Hijackthis suivants :

 

(j'avais 2 virus emprisonnés par AVG : Win32/NSanti.H et Worm/Autorun

et Antivir vient à nouveau de bloquer un virus : Crypt.NSPM.Gen dans C\ System Volume Information\...)

 

Avira AntiVir Personal

Report file date: jeudi 1 mai 2008 18:58

 

Scanning for 1245960 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: HP_Administrateur

Computer name: HP-PETIT-BUREAU

 

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58

ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 18:07:11

ANTIVIR3.VDF : 7.0.3.235 248832 Bytes 30/04/2008 18:07:12

Engineversion : 8.1.0.37

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.28 233851 Bytes 30/04/2008 18:07:18

AESCN.DLL : 8.1.0.15 119157 Bytes 30/04/2008 18:07:18

AERDL.DLL : 8.1.0.20 418165 Bytes 30/04/2008 18:07:17

AEPACK.DLL : 8.1.1.4 364918 Bytes 30/04/2008 18:07:16

AEOFFICE.DLL : 8.1.0.18 192890 Bytes 30/04/2008 18:07:15

AEHEUR.DLL : 8.1.0.21 1196407 Bytes 30/04/2008 18:07:15

AEHELP.DLL : 8.1.0.14 115063 Bytes 30/04/2008 18:07:14

AEGEN.DLL : 8.1.0.18 299381 Bytes 30/04/2008 18:07:13

AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43

AECORE.DLL : 8.1.0.27 168310 Bytes 30/04/2008 18:07:12

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: jeudi 1 mai 2008 18:58

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'jucheck.exe' - '1' Module(s) have been scanned

Scan process 'aoltpspd.exe' - '1' Module(s) have been scanned

Scan process 'shellmon.exe' - '1' Module(s) have been scanned

Scan process 'waol.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'kbd.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'QTTask.exe' - '1' Module(s) have been scanned

Scan process 'aolsoftware.exe' - '1' Module(s) have been scanned

Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'DMAScheduler.exe' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'ELService.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned

Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned

Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned

Scan process 'avgupsvc.exe' - '1' Module(s) have been scanned

Scan process 'aolload.exe' - '1' Module(s) have been scanned

Scan process 'avgamsvr.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

59 processes with 59 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD5

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '36' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <HP_PAVILION>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <HP_RECOVERY>

 

 

End of the scan: jeudi 1 mai 2008 19:37

Used time: 39:19 min

 

The scan has been done completely.

 

10487 Scanning directories

435570 Files were scanned

0 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

435570 Files not concerned

15827 Archives were scanned

7 Warnings

0 Notes

 

------------------------------------------

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:10:45, on 01/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Program Files\Fichiers communs\AOL\Loader\aolload.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Fichiers communs\AOL\1190306977\ee\AOLSoftware.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\AOL 9.0\waol.exe

C:\Program Files\AOL 9.0\shellmon.exe

C:\Program Files\Fichiers communs\Aol\aoltpspd.exe

C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Karcher\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect

O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Fichiers communs\AOL\1190306977\ee\AOLSoftware.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{61EB4D35-7C01-4427-9671-7BA86B37C84E}: NameServer = 205.188.146.145

O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

 

--

End of file - 11150 bytes

 

 

Merci de votre aide.

[Wullfk]

En fait, j'avais désinstallé Norton avant d'installer AVG mais il me reste toujours Live Update qui prétend être utile à d'autres programmes Symantec, donc je l'ai gardé. C'est lui qui doit laisser des traces, mais je ne sais pas si je dois le désinstaller ??

 

tout dépend si tu utilise d'autre produit de SYMANTEC (Ghost,Norton Utilities,etc..), pour ma part lorsque j'utilisais la suite Norton SystemWorks, j'aimais bien utiliser Norton Disk Doctor dans les "Utilities", mais il y a plus performant ailleurs, et puis c'est la lourdeur de la suite, et le fait que Symantec s'installe un peu partout dans Windows (trop intrusif à mon goût)qui ma dérangé j'ai mis du temps (5 ans d'utilisation) avant de tout virer. quoi qu'il en soit si tu n'utilise rien de leur produit, supprime tout ce qui les concernent. il est plus difficile de supprimer qu'un seul éléments de leur produit ,il existe malgré tout une procédure, pour ne supprimer que l'Antivirus, effectue une recherche sur Zebulon, mon retour d'expérience en ne voulant supprimer que Norton Antivirus c'est avéré désastreux, j'ai complètement planté mon PC , certainement du à une mauvaise manipulation, d'autre on sûrement réussi.

 

concernant la désinfection d'un éventuel virus,trojan ou malware, je crois savoir que la procédure doit s'effectuée en mode sans échec, donc sans connexion internet, mais là je laisse le soins aux pro de la sécurité sur le forum, pour te donner la marche à suivre, tu peux déjà effectuer une recherche sur Zebulon avec le nom de ton virus, pour trouver la procédure pour l'éradiqué.

 

Salut

[Wullfk]

Re,

 

je viens de consulter ton rapport AntiVir, et il n'y a apparament aucun virus, donc ton systeme est propre.

 

(j'avais 2 virus emprisonnés par AVG : Win32/NSanti.H et Worm/Autorun

et Antivir vient à nouveau de bloquer un virus : Crypt.NSPM.Gen dans C\ System Volume Information\...)

 

c'est le but d'un Antivirus, sinon à quoi ça servirai d'en avoir un, bien au contraire si tu n'en avais pas ben le virus se serait installé, d'autre part selon comment tu as paramétré les scans, les virus détecté peuvent être mis en quarantaine , supprimer immédiatement ou même ignoré (pas conseillé).

 

bref AntiVir joue bien sont rôle, c'est ce qu'on lui demande. à ma connaissance ce qui pouvait te créer des problèmes c'était d'avoir 3 antivirus d'installé, comme je te l'ai dit précédemment cela ne peut apporter plus de mal que de bien.

 

des que j'aurai un peu plus de temps je jetterai un œil sur ton rapport HJT mais à première vu, j'ai rien constater d'anormal.

 

Salut

Modifié le 2 mai 2008 par Wullfk

[guy-pol]

Merci Wullfk,

 

En fait, le dernier rapport Antivir qui s'est lancé automatiquement me fait apparaître 159 fichiers infectés ...

 

Apparemment, les deux virus concernés sont TR/PSW.Onlinegames.NLE et TR/Crypt.NSPM.Gen

 

Voici le rapport en question, je suis désespéré ...

 

Avira AntiVir Personal

Report file date: vendredi 2 mai 2008 12:00

 

Scanning for 1246006 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: HP-PETIT-BUREAU

 

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58

ANTIVIR2.VDF : 7.0.3.197 1260032 Bytes 22/04/2008 18:07:11

ANTIVIR3.VDF : 7.0.3.236 249344 Bytes 01/05/2008 18:06:34

Engineversion : 8.1.0.37

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.28 233851 Bytes 30/04/2008 18:07:18

AESCN.DLL : 8.1.0.15 119157 Bytes 30/04/2008 18:07:18

AERDL.DLL : 8.1.0.20 418165 Bytes 30/04/2008 18:07:17

AEPACK.DLL : 8.1.1.4 364918 Bytes 30/04/2008 18:07:16

AEOFFICE.DLL : 8.1.0.18 192890 Bytes 30/04/2008 18:07:15

AEHEUR.DLL : 8.1.0.21 1196407 Bytes 30/04/2008 18:07:15

AEHELP.DLL : 8.1.0.14 115063 Bytes 30/04/2008 18:07:14

AEGEN.DLL : 8.1.0.18 299381 Bytes 30/04/2008 18:07:13

AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:43

AECORE.DLL : 8.1.0.27 168310 Bytes 30/04/2008 18:07:12

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

 

Configuration settings for the scan:

Jobname..........................: Local Hard Disks

Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldiscs.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: vendredi 2 mai 2008 12:00

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'logon.scr' - '1' Module(s) have been scanned

Scan process 'avgw.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'kbd.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avgcc.exe' - '1' Module(s) have been scanned

Scan process 'QTTask.exe' - '1' Module(s) have been scanned

Scan process 'aolsoftware.exe' - '1' Module(s) have been scanned

Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned

Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned

Scan process 'DMAScheduler.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned

Scan process 'jucheck.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'kbd.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'QTTask.exe' - '1' Module(s) have been scanned

Scan process 'aolsoftware.exe' - '1' Module(s) have been scanned

Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'DMAScheduler.exe' - '1' Module(s) have been scanned

Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'ELService.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned

Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned

Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned

Scan process 'avgupsvc.exe' - '1' Module(s) have been scanned

Scan process 'aolload.exe' - '1' Module(s) have been scanned

Scan process 'avgamsvr.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'AOLacsd.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

77 processes with 77 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD2

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD3

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD4

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

Master boot sector HD5

[iNFO] No virus was found!

[WARNING] Le périphérique n'est pas prêt.

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '34' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <HP_PAVILION>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP318\A0035467.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c35.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP318\A0036385.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c3b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP319\A0036392.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c41.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP320\A0036414.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c45.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP321\A0036429.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c49.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP322\A0036467.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c4e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP323\A0036498.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c52.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP324\A0036546.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c55.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP325\A0036588.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c59.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP326\A0036626.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c5d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP327\A0036652.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c61.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP327\A0036724.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c64.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP327\A0036728.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c66.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP327\A0036732.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c6e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036769.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c6f.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036770.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8d0.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036838.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c71.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036844.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8d2.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036845.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c73.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036846.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8d4.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036858.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c72.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036864.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8d3.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036865.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c74.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036886.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c75.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036892.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8d6.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036893.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c77.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036905.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8d5.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036911.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c76.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036912.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8d7.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP328\A0036931.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8d8.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0036942.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c78.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0036943.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8d9.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037007.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c79.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037013.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c7a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037014.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8db.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037018.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c7c.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037039.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8da.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037040.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c7b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037067.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8dd.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037074.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c7e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP329\A0037075.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8df.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP330\A0037094.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d8dc.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP330\A0037095.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c40.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP331\A0037142.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c7d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP331\A0037143.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d8de.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP332\A0037213.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c80.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP332\A0037214.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d821.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP333\A0037239.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c81.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP333\A0037240.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c82.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP334\A0037291.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c83.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP334\A0037292.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d824.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP335\A0037333.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c85.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP335\A0037334.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d826.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP336\A0037386.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c87.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP336\A0037387.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d828.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP337\A0037436.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c89.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP337\A0037437.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d82a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP338\A0037483.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c8a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP338\A0037484.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c8b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP339\A0037559.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c8d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP339\A0037560.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d82e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP340\A0037616.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c8f.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP340\A0037617.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d830.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP341\A0037651.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c90.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP341\A0037652.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c91.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP342\A0037677.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c92.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP342\A0037678.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d833.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP343\A0037715.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c94.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP343\A0037716.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d835.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP344\A0037756.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c95.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP344\A0037757.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d836.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP345\A0037811.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c97.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP345\A0037812.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c98.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP346\A0037865.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c9a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP346\A0037866.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d83b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP347\A0037904.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c9b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP347\A0037905.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d83c.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP348\A0037933.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c9d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP348\A0037934.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d83e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP349\A0037973.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1c9e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP349\A0037974.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c9f.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP350\A0037978.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca0.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP350\A0037979.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d801.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP350\A0038001.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca2.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038054.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d803.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038055.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca3.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038056.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d804.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038090.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca4.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038096.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d805.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP351\A0038097.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1ca6.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP352\A0038128.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca5.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP352\A0038129.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d807.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP353\A0038153.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca7.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP353\A0038154.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d808.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP354\A0038214.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ca9.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP354\A0038215.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1caa.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038265.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cab.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038266.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d80c.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038310.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cac.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038315.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cad.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038316.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d80e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038325.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1caf.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038360.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cae.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038361.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d810.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038362.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cb1.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038388.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d812.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038391.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cb0.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP355\A0038392.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d811.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP356\A0038451.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cb2.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP356\A0038452.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d813.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP356\A0039383.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cb3.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP356\A0039389.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d814.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP356\A0039390.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cb5.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP357\A0039431.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d816.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP357\A0039432.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cb7.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP358\A0039483.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d818.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP358\A0039484.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cb8.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP358\A0039522.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d819.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP358\A0039528.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cba.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP358\A0039529.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cb9.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP359\A0039561.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d81b.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP359\A0039562.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cbc.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP360\A0039629.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cbd.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP360\A0039630.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d81e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP361\A0039694.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cbe.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP361\A0039695.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cbf.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP362\A0039737.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc0.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP362\A0039738.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d861.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039763.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc2.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039764.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d863.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039803.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc3.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039809.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d864.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039810.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cc5.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039859.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d866.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039865.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc7.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0039866.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d868.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0040862.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc6.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0040865.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d867.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP363\A0040866.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cc8.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0040913.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cc9.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0040914.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d86a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041007.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1ccc.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041011.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d86d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041012.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1ccd.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041647.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cd9.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041651.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d87a.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0041652.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cdb.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042590.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d87c.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042595.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cdd.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042596.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cdc.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042610.dll

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d87d.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042615.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cde.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP364\A0042616.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '4ba2d87e.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP365\A0042621.com

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d87f.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP365\A0042622.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1c20.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP365\A0042628.exe

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '4ba2d881.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP365\A0042652.bat

[DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen

[NOTE] The file was moved to '484b1cdf.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP366\A0042654.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1ce0.qua'!

C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP379\A0048368.inf

[DETECTION] Is the Trojan horse TR/PSW.OnlineGames.NLE

[NOTE] The file was moved to '484b1cf3.qua'!

Begin scan in 'D:\' <HP_RECOVERY>

 

 

End of the scan: vendredi 2 mai 2008 16:07

Used time: 4:07:35 min

 

The scan has been done completely.

 

10752 Scanning directories

442860 Files were scanned

159 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

159 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

442701 Files not concerned

15828 Archives were scanned

7 Warnings

159 Notes

[Wullfk]

Re,

 

Configuration settings for the scan:

Jobname..........................: Local Hard Disks

Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldiscs.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

 

pas bon la configuration de "secondary action" le mieux est de le paramétré en "delete"

 

159 files were moved to quarantine

 

les 159 fichiers sont en quarantaine, donc théoriquement il ne sont pas actif, mais isolé (j'ai malgré tout un doute sur mon raisonnement, attend confirmation d'un pro de la sécurité)

 

je ne souhaite pas te faire faire de bêtise en supprimant les fichiers en quarantaine, donc patiente pour que quelqu'un de plus calé t'indique une procédure de désinfection spécifique à ton trojan.

 

n'effectue pas de manip hasardeuse, sans l'avis et les conseils d'un "vrai" spécialiste dans ce domaine, ce qui n'ai pas mon cas, à mon niveau je ne fais qu'interpréter ton rapport.

 

désolé de ne pouvoir en faire plus pour le moment. (je continue à suivre ton post, car les éléments qui pourront t'aider à la désinfection pourront m'être utile par la suite).

 

ne lache pas l'affaire, cela doit pouvoir s'arranger, par contre par la suite modifie certaines de tes habitudes de surf, surtout en ce qui concerne les sites de jeux si tu vois ce que je veux dire.

 

Salut

[guy-pol]

Apparemment mes deux virus sont planqués quelque part et ils se déclenchent par moments.

 

J'ai cherché leur nom sur Zébulon mais je n'ai pas trouvé de procédure adaptée. Comment faire pour obtenir un conseil de désinfection ?

 

Sinon, j'ai trouvé des modalités de paramétrages de Antivir, et j'ai modifié la configuration (primary action et secondary action). Merci pour ton conseil Wullfk.

 

Est-ce que je dois créer une nouvelle annonce modifiée maintenant que je connais le nom des 2 virus ?

Modifié le 3 mai 2008 par guy-pol

[Wullfk]

Pas nécessairement, reprend juste ton post initial et modifie le titre. cela alertera plus facilement les connaisseurs.

 

Sinon, j'ai trouvé des modalités de paramétrages de Antivir, et j'ai modifié la configuration (primary action et secondary action). Merci pour ton conseil Wullfk.

 

content pour toi, d'avoir pu t'apporter une aide aussi petite qu'elle soit.

 

@+

 

petite indication ( à prendre au conditionnel,car tu n'as pas le même trojan)

 

un autre utilisateur (dans les derniers messages en date) à aussi un problème de trojan (Vundo) et un spécialiste en la matière (Pear) lui à préconisé en premier lieu ceci:

 

Bonsoir,

 

* .

 

Télécharger BTFix de Bibi26

* Dézipper l'archive sur le Bureau.

* Ouvrir le dossier BTFix.

* Double cliquer sur BTFix.exe.

* Cliquer sur Rechercher.

* Un rapport va apparaître, copier/coller dans la prochaine réponse.

 

 

Puis,si le rapport n'est pas propre, lancer à nouveau BTFix

*Le nettoyage doit être fait en mode sans échec.

 

* Cliquer sur Nettoyer.

* Un rapport va apparaître, copier/coller dans la prochaine réponse

Reste à savoir si cela peut s'appliquer à ton cas

Car je ne voudrai pas t'induire en erreur et que tu plante ton système à cause de moi, attend de voir en ayant changé le titre de ton message, si quelqu'un peut t'apporter une assistance plus complète et certainement moins hasardeuse.

 

pour info, voila pourquoi je préfère que tu patiente pour avoir une réponse d'un spécialiste :

 

Citation En quoi un membre des groupes "Equipe Sécurité" et "Junior-Sécu" est-il plus qualifié, plus apte ?

Quelques points qui les caractérisent...

 

• ces membres ont travaillé de nombreuses heures sur divers cas de nettoyage d'infections, depuis plusieurs mois/années
  
• ils se sentent particulièrement concernés par la lutte antimalware
  
• ils ont eu l'occasion de décortiquer, souvent en commun, des cas complexes leur ayant enseigné le calme et l'humilité, les ficelles et les réflexes nécessaires
  
• ils ont discuté avec les développeurs et, parfois, les ont aidé à améliorer les outils
  
• ils demandent des conseils si besoin est et surtout, savent où et comment les obtenir
  
• ils font partie d'une communauté mondiale qui a les mêmes buts, les mêmes méthodes et lui apportera l'aide demandée
  
• la manière de procéder, ils l'ont étudiée, lue et relue et l'appliquent les yeux fermés, de manière naturelle car ils adhèrent aux buts poursuivis
  
• la plupart utilisent une machine virtuelle pour tester les solution, effectuer des recherches sur les malwares !
  

... les résultats sont :

• ils interprètent correctement les logs : HijackThis, RunScanner, DSS-Deckard's System Scanner, DiagHelp, Clean, SmitfraudFix, navilog1, The Avenger, ComboFix, etc.
  
• ils ne se servent pas du robot hijackthis.de (dangereux lorsqu'on n'en connaît pas les limites) mais ont une panoplie d'outils à leur disposition, qu'ils font utiliser en fonction de ce qu'ils lisent dans les rapports
  
• ils différencient un fichier légitime d'un faux, trient les fichiers homonymes qui trompent les analystes, ne font pas confiance aveuglément à une recherche Google sur nom de fichier aboutissant à un forum qui ne vous donnera pas forcément une information fiable
  
• ils ne succombent pas à la facilité consistant à enchaîner 36 outils dans l'espoir que chacun va enlever quelques fichiers, un peu au hasard, pour qu'à la longue et avec de la chance, les symptômes disparaissent avec - hélas trop souvent - quelques dégâts dans le fonctionnement du système
  
• ils savent en outre qu'ils appartiennent à un groupe et qu'ils doivent participer en faisant remonter des fichiers, des cas de désinfection ardue, etc. aux développeurs pour l'amélioration et la mise à jour des outils
  
• ils distinguent désinfection et optimisation et ne s'amusent pas à éliminer des lignes simplement inutiles (sans être néfastes)
  
• ils recherchent les cas similaires sur les forums les plus efficaces dans le monde entier ; ils savent interroger directement les experts !
  
• leur expérience, leurs connaissances leur apportent une certaine intuition les aidant dans les cas les plus ardus de variantes encore inconnues
  

Le helpeur a certaines latitudes dans ses méthodes en fonction de ses connaissances, ses aptitudes et son expérience mais si les moyens peuvent être légèrement différents, le résultat et les buts sont les mêmes : respect, convivialité, efficacité, sûreté, nettoyage complet, prise en compte d'une formation minimale de l'utilisateur, etc.

On est loin -reconnaissez-le- de la simple disparition des symptômes, d'un simple nettoyage tant bien que mal...

 

y a pas photo, entre mon aide et ce que eux peuvent t'apporter. donc patience.

Modifié le 3 mai 2008 par Wullfk

[guy-pol]

Pas nécessairement, reprend juste ton post initial et modifie le titre. cela alertera plus facilement les connaisseurs.

 

 

 

content pour toi, d'avoir pu t'apporter une aide aussi petite qu'elle soit.

 

@+

 

petite indication ( à prendre au conditionnel,car tu n'as pas le même trojan)

 

un autre utilisateur (dans les derniers messages en date) à aussi un problème de trojan (Vundo) et un spécialiste en la matière (Pear) lui à préconisé en premier lieu ceci:

 

 

Reste à savoir si cela peut s'appliquer à ton cas

Car je ne voudrai pas t'induire en erreur et que tu plante ton système à cause de moi, attend de voir en ayant changé le titre de ton message, si quelqu'un peut t'apporter une assistance plus complète et certainement moins hasardeuse.

 

pour info, voila pourquoi je préfère que tu patiente pour avoir une réponse d'un spécialiste :

 

 

 

y a pas photo, entre mon aide et ce que eux peuvent t'apporter. donc patience.

 

Merci encore Wullfk !

 

je n'ai pas réussi à trouver comment changer le titre du post initial... J'y avais déjà pensé, mais j'ai cru que c'était impossible. C'est pour ça que j'ai envisagé de changer d'annonce. Si tu peux m'indiquer la procédure pour modifier le titre, je suis preneur.

 

Et encore merci pour ton aide. Quand on est dans la panade, on apprécie vraiment un coup de main généreux ! je suis conscient du temps que ça prend. C'est sympa de ta part !