Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

infection new_drv.sys

NONO61

Par NONO61
dans Analyses et éradication malwares

 Partager

Messages recommandés

NONO61 Member

NONO61

Posté(e)
Posté(e)

bonjour à tous

 

nouvel inscrit sur ce forum, qui, a lire tous les posts m'a paru vraiment très efficace !

 

depuis peut être un mois la session de mon fils est infectée : AVAST m'informe être infecté par new_drv.sys à deux reprises.

 

si je tente d'annuler ou d'éradiquer ou de mettre en quarantaine, j'ai ensuite un message m'informant que le système va être arrété, et il s'arrête.

 

je sais que ce post a été abondemment traité, mais que la procédure est différente pour chaque cas c'est pourquoi je poste un nouveau sujet!

 

je viens de télécharger hijackthis

 

voici son rapport:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:05:29, on 20/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\sstray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE

C:\Program Files\PopUp Destroy\Popup-Destroy.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\vsnpstd.exe

C:\Program Files\Trust\Mouse 14914\lsmouse.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Creative\ShareDLL\CtNotify.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\BitTorrent\bittorrent.exe

C:\Program Files\Creative\ShareDLL\MediaDet.Exe

C:\WINDOWS\system32\regscan.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\WINDOWS\9129837.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\CTSvcCDA.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\maxime\Bureau\HiJackThis(2).exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t

O4 - HKLM\..\Run: [PopUp Destroy] C:\Program Files\PopUp Destroy\Popup-Destroy.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [MEDIAMOUSE] C:\Program Files\Trust\Mouse 14914\lsmouse.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [bitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\system32\regscan.exe

O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Download Using &BitSpirit - C:\Documents and Settings\maxime\Bureau\bsurl.htm

O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

 

merci de votre aide

nono61

jacmanou Extrem Member

jacmanou

Posté(e)
Posté(e) (modifié)

Bonjour NONO61,

 

Bienvenue sur Zebulon !!

 

Infection SD présente, je vais t'aider à t'en débarrasser.

 

1/ Pour commencer, Avast n'offre plus une protection suffisante : lui préférer Antivir.

 

 

2/ J'ai noté dans tes rapports que tu utilisais une application de p2p.

Cela est très dangereux pour ta sécurité et probablement la source de tes infections.

 

Voir ceci pour plus d'informations :

 

3/ Télécharger SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.

 

(Prendre soin de désactiver l'antivirus provisoirement, il pourrait réagir à l'utilisation de l'outil).

 

Double cliquer sur SDFix.exe et choisir Install pour l'installer (conserver le répertoire par défaut C:).

Redémarrer l'ordinateur en mode sans échec en suivant la procédure que voici :

 

  • Redémarrer ton ordinateur
  • Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapoter la touche F8 (une pression par seconde).
  • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
  • Choisir la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
  • Choisir le compte usuel et non pas celui nommé "administrateur".

 

Dérouler la liste des instructions ci-dessous :

 

  • Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double cliquer sur RunThis.cmd pour lancer le script.
  • Appuyer sur Y pour commencer le processus de nettoyage.
  • Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis demandera d'appuyer sur une touche pour redémarrer.
  • Appuyer sur une touche pour redémarrer le PC.
  • Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
  • Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
  • Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau.
  • Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
  • Enfin, copier/coller le contenu du fichier Report.txt sur le forum.

 

Ainsi qu'un nouveau rapport HijackThis.

Modifié par jacmanou
NONO61 Member

NONO61

Posté(e)
  • Auteur
Posté(e)

bonjour jacmanou et d'avance merci

 

voici mon rapport SDFIX

 

 

SDFix: Version 1.184

Run by maxime on 20/05/2008 at 16:04

 

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

 

Checking Services :

 

Name :

new_drv

 

Path :

\??\C:\WINDOWS\new_drv.sys

 

new_drv - Deleted

 

 

 

Restoring Windows Registry Values

Restoring Windows Default Hosts File

 

Rebooting

 

 

Checking Files :

 

Trojan Files Found:

 

C:\WINDOWS\system32\~.exe - Deleted

C:\Documents and Settings\maxime\new.txt - Deleted

C:\WINDOWS\9129837.exe - Deleted

C:\WINDOWS\system32\regscan.exe - Deleted

 

 

 

 

 

Removing Temp Files

 

ADS Check :

 

 

 

Final Check :

 

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-05-20 16:19:39

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

IPC error: 2 Le fichier spécifié est introuvable.

scanning hidden services & system hive ...

 

scanning hidden registry entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

 

 

Remaining Services :

 

 

 

 

Authorized Application Key Export:

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"

"C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA"

"C:\\Documents and Settings\\maxime\\Bureau\\steamapps\\ekureuil\\counter-strike source\\hl2.exe"="C:\\Documents and Settings\\maxime\\Bureau\\steamapps\\ekureuil\\counter-strike source\\hl2.exe:*:Enabled:hl2"

"C:\\Program Files\\VentSrv\\ventrilo_srv.exe"="C:\\Program Files\\VentSrv\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"

"C:\\Documents and Settings\\maxime\\Local Settings\\Temporary Internet Files\\Content.IE5\\3VPFBLSS\\wow[1].exe"="C:\\Documents and Settings\\maxime\\Local Settings\\Temporary Internet Files\\Content.IE5\\3VPFBLSS\\wow[1].exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Magic Workstation\\MWSPlay.exe"="C:\\Program Files\\Magic Workstation\\MWSPlay.exe:*:Enabled:Magic Workstation Play Module"

"C:\\Documents and Settings\\maxime\\Bureau\\wow.exe"="C:\\Documents and Settings\\maxime\\Bureau\\wow.exe:*:Enabled:Blizzard Downloader"

"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"

"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"

"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager"

"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager"

"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application"

"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

 

Remaining Files :

 

 

File Backups: - C:\SDFix\backups\backups.zip

 

Files with Hidden Attributes :

 

Mon 24 Mar 2008 24 ..SH. --- "C:\WINDOWS\S8E44938A.tmp"

Sat 19 Jan 2008 374,784 ...H. --- "C:\Program Files\Mio Backup2\iBootDev.exe"

Sat 19 Jan 2008 72,192 ...H. --- "C:\Program Files\Mio Backup2\MainShell.exe"

Sat 19 Jan 2008 120,233 ...H. --- "C:\Program Files\Mio Backup2\MUI.exe"

Sat 19 Jan 2008 31,232 ...H. --- "C:\Program Files\Mio Backup2\upgradeUT.exe"

Fri 18 Jan 2008 374,784 A..H. --- "C:\Program Files\Mio Backup\iBootDev.exe"

Fri 18 Jan 2008 72,192 A..H. --- "C:\Program Files\Mio Backup\MainShell.exe"

Fri 18 Jan 2008 120,233 A..H. --- "C:\Program Files\Mio Backup\MUI.exe"

Fri 18 Jan 2008 31,232 A..H. --- "C:\Program Files\Mio Backup\upgradeUT.exe"

Fri 8 Dec 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

Fri 18 Jan 2008 31,232 A..H. --- "C:\Program Files\Mio Backup2\HDD\upgradeUT.exe"

Fri 18 Jan 2008 31,232 A..H. --- "C:\Program Files\Mio Backup\HDD\upgradeUT.exe"

Thu 14 Feb 2008 71,168 ..SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\Setup.exe"

Sat 9 Jul 2005 16,384 A.SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\_Setup.dll"

Sun 28 Oct 2007 20,233,232 A..H. --- "C:\Documents and Settings\L‚a\Local Settings\Temp\BIT2.tmp"

Sun 8 Jul 2007 26,112 ...H. --- "C:\Documents and Settings\norbert\Mes documents\offres d'emploi\~WRL1207.tmp"

Fri 18 Jan 2008 374,784 A..H. --- "C:\Program Files\Mio Backup2\HDD\Program files\iBootDev.exe"

Fri 18 Jan 2008 374,784 A..H. --- "C:\Program Files\Mio Backup\HDD\Program files\iBootDev.exe"

Sat 29 Mar 2008 25,839,664 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7c21b5db948e35a308c052076388cfe\BIT2.tmp"

Fri 18 Jan 2008 374,784 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\iBootDev.exe"

Fri 18 Jan 2008 72,192 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\MainShell.exe"

Fri 18 Jan 2008 120,233 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\MUI.exe"

Fri 18 Jan 2008 31,232 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\upgradeUT.exe"

Fri 8 Dec 2006 4,348 A..H. --- "C:\Documents and Settings\L‚a\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"

Tue 3 Jul 2007 20 A..H. --- "C:\Documents and Settings\L‚a\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"

Sat 10 Mar 2007 9,855 A.SH. --- "C:\Documents and Settings\L‚a\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

Tue 11 Mar 2008 19,456 ...H. --- "C:\Documents and Settings\maxime\Application Data\Microsoft\Word\~WRL0540.tmp"

Tue 11 Mar 2008 20,992 ...H. --- "C:\Documents and Settings\maxime\Application Data\Microsoft\Word\~WRL1798.tmp"

Tue 11 Mar 2008 19,968 ...H. --- "C:\Documents and Settings\maxime\Application Data\Microsoft\Word\~WRL3326.tmp"

Fri 8 Dec 2006 4,348 ...H. --- "C:\Documents and Settings\maxime\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"

Wed 14 Nov 2007 20 A..H. --- "C:\Documents and Settings\maxime\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"

Sat 10 Mar 2007 9,855 A.SH. --- "C:\Documents and Settings\maxime\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

Fri 18 Jan 2008 31,232 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\HDD\upgradeUT.exe"

Fri 18 Jan 2008 374,784 A..H. --- "C:\Documents and Settings\All Users\Documents\mio c520\Mio Backup\HDD\Program files\iBootDev.exe"

 

Finished!

 

 

et voici mon rapport hijackthis

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:28:19, on 20/05/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\system32\CTSvcCDA.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\sstray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE

C:\Program Files\PopUp Destroy\Popup-Destroy.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\vsnpstd.exe

C:\Program Files\Trust\Mouse 14914\lsmouse.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Creative\ShareDLL\CtNotify.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe

C:\Program Files\Creative\ShareDLL\MediaDet.Exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\maxime\Bureau\HiJackThis(2).exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [CreativeMixer] C:\Program Files\Creative\Audio\PROGRAM\CTMIX32.EXE /t

O4 - HKLM\..\Run: [PopUp Destroy] C:\Program Files\PopUp Destroy\Popup-Destroy.exe

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe

O4 - HKLM\..\Run: [MEDIAMOUSE] C:\Program Files\Trust\Mouse 14914\lsmouse.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Download Using &BitSpirit - C:\Documents and Settings\maxime\Bureau\bsurl.htm

O8 - Extra context menu item: Télécharger avec &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

 

--

End of file - 7518 bytes

 

 

tu me dis que j'utilise un logiciel p2p , c'est probablement mon fils, quel est ce logiciel et comment enlever les entrées correspondantes?

 

et de quoi se débarrasser comme lignes inutiles sur mon rapport hijackthis pour optimiser mon PC?

 

encore merci

jacmanou Extrem Member

jacmanou

Posté(e)
Posté(e) (modifié)

Ok, bon travail :P

 

On va finir de parler désinfection et sécurité, puis je te conseillerai dans une optique d'optimisation.

 

As-tu encore des problèmes avec ton ordinateur ?

 

Pour le p2p : en me basant sur le 1er rapport, les logiciel Bittorrent et/ou BitSpirit sont installés sur ta machine. Il tournait au moment de la création du 1er rapport HijackThis, mais plus pour le 2ème. Le désinstaller serait une bonne chose, mais surtout en parler à la personne qui l'utilise (sinon il sera vite réinstallé).

 

Je renouvelle ma recommandation d'utiliser Antivir à la place d'Avast, qui ne fournit pas une protection suffisante.

 

Tu peux désinstaller AdAware 2007, qui n'est plus non plus vraiment efficace. Lui préférer MalwareBytes' AntiMalware (MBAM), que je vais te faire utiliser maintenant :

 

Télécharger Malwarebytes' Anti-Malware (MBAM)

L'enregistrer sur le bureau.

Fermer toutes les fenêtres et programmes.

 

Double-cliquer sur l'icône Download_mbam-setup.exe sur le bureau pour démarrer l'installation.

Suivre les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet).

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

vérifier que les options "Update Malwarebytes' Anti-Malware" et "Launch Malwarebytes' Anti-Malware" sont cochées.

 

MBAM démarrera automatiquement et enverra un message demandant de mettre à jour le programme avant de lancer une analyse.

Comme il se met automatiquement à jour en fin d'installation, cliquer sur OK pour fermer la boîte de dialogue.

 

Redémarrer l'ordinateur en mode sans échec (F8 au début du démarrage de l'ordinateur), puis lancer MBAM.

[sous Vista, fermer le programme, et le relancer en faisant clic droit -> Exécuter en tant qu'administrateur]

 

La fenêtre principale de MBAM s'affiche :

Dans l'onglet analyse, vérifier que "Exécuter une analyse approfondie" est coché et cliquer sur le bouton Rechercher pour démarrer l'analyse.

L'analyse prendra un certain temps, être patient !

Un message s'affichera, en indiquant la fin .

Cliquer sur OK pour continuer.

 

Si des malwares ont été détectés, leur liste s'affiche.

En cliquant sur Suppression, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

 

MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

Fermer le bloc-note.

Fermer MBAM en cliquant sur Quitter.

Redémarrer l'ordinateur en mode normal et poster le rapport sur le forum.

 

 

Un AntiSpyware résident est aussi une protection importante : Windows Defender, gratuit, fournira une protection suffisante.

 

 

Des mises à jour sont à réaliser sur ton système : Installer Internet Explorer en version 7, beaucoup plus sécurisé.

 

Java n'est pas à jour, donc moins sécurisé. Important de le mettre à jour.

 

Rendez vous là:

Java Runtime Environment (JRE) 6 Update 6 :

http://java.sun.com/javase/downloads/index.jsp

Download Now

S'ouvre une nouvelle page.

Vous descendrez là:

Java Runtime Environment (JRE) 6 Update 6

Clic sur Download

Nouvelle page.

Sélectionnez votre platform->Windows

Cochez "I agree to the java..."

clic sur continue

Nouvelle page

Cochez :

- Windows Online Installation

- Cochez la flèche orange

"Cochez ici" jre-6u6-windows-i586-p-iftw.exe

 

Cela fait, supprimez les installations Java antérieures par "Ajout/Suppression de Programmes".

 

 

Enfin, et on aura fait un grand pas,

Nous déconseillons, sur nos forums de sécurité, l'utilisation de toolbars: en général elles n'aident en rien et ont des visées essentiellement publicitaires

 

http://assiste.com.free.fr/p/abc/a/barres_...ls_toolbar.html

 

La Yahoo! Toolbar analysée par Assiste : http://assiste.forum.free.fr/viewtopic.php?t=18997

Les toolbars, c'est pas obligatoire ! (by Malekal) : http://forum.malekal.com/viewtopic.php?f=45&t=6173

 

Supprimer toutes les Toolbars : Google notamment.

Modifié par jacmanou
jacmanou Extrem Member

jacmanou

Posté(e)
Posté(e)

C'était un peu long, prends bien les choses dans l'ordre.

 

J'attends le rapport MalwareBytes AntiMalware + un nouveau HijackThis à la suite de toutes les opérations, SVP :P

NONO61 Member

NONO61

Posté(e)
  • Auteur
Posté(e)

ok

 

je suis en cours de vérification avec antivir, cela demande un certain temps. il a déjà trouvé 2 detections que j'ai mis en quarantaine 1 fichier suspicieux et 1 warning

 

j'ai désinstallé adaware puis installé MalwareBytes, comme je n'ai pas fini l'inspection antivir, je ferai l'analyse MalwareBytes ultérieurement.

 

a présent tout à l'air de fonctionner correctement, mais il va falloir que je fasse encore du vide!

 

 

qu'entends tu par danger des cracks, y aurait il dans le rapport quelque chose qui te ferais dire qu'il y a des logiciels craqués? si oui lesquels?

 

merci encore

nono61

jacmanou Extrem Member

jacmanou

Posté(e)
Posté(e)

Très bonne initiative, laisse finir Antivir avant de lancer MalwareBytes (et poste moi les rapports des 2 après).

 

Pour les cracks, c'est à titre informatif que je t'ai donné ce lien, car le p2p est souvent utilisé pour obtenir des cracks. Et ces cracks sont dangereux ! Je n'en ai pas relevé particulièrement sur ta configuration.

NONO61 Member

NONO61

Posté(e)
  • Auteur
Posté(e)

voici le rapport de antivir aprés environ 4heures de scan

 

 

 

Avira AntiVir Personal

Report file date: mardi 20 mai 2008 16:43

 

Scanning for 1281002 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: PCBUREAU

 

Version information:

BUILD.DAT : 8.1.00.296 16479 Bytes 29/04/2008 10:47:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 20/05/2008 14:42:15

AVSCAN.DLL : 8.1.1.0 53505 Bytes 20/05/2008 14:42:15

LUKE.DLL : 8.1.2.9 151809 Bytes 20/05/2008 14:42:16

LUKERES.DLL : 8.1.2.1 12033 Bytes 20/05/2008 14:42:16

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 13:27:15

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 14:42:16

ANTIVIR2.VDF : 7.0.4.53 1848832 Bytes 17/05/2008 14:42:16

ANTIVIR3.VDF : 7.0.4.69 76288 Bytes 20/05/2008 14:42:16

Engineversion : 8.1.0.46

AEVDF.DLL : 8.1.0.5 102772 Bytes 20/05/2008 14:42:16

AESCRIPT.DLL : 8.1.0.33 266618 Bytes 20/05/2008 14:42:16

AESCN.DLL : 8.1.0.18 119156 Bytes 20/05/2008 14:42:16

AERDL.DLL : 8.1.0.20 418165 Bytes 20/05/2008 14:42:16

AEPACK.DLL : 8.1.1.5 364918 Bytes 20/05/2008 14:42:16

AEOFFICE.DLL : 8.1.0.18 192890 Bytes 20/05/2008 14:42:16

AEHEUR.DLL : 8.1.0.29 1253750 Bytes 20/05/2008 14:42:16

AEHELP.DLL : 8.1.0.14 115063 Bytes 20/05/2008 14:42:16

AEGEN.DLL : 8.1.0.21 303477 Bytes 20/05/2008 14:42:16

AEEMU.DLL : 8.1.0.6 430451 Bytes 20/05/2008 14:42:16

AECORE.DLL : 8.1.0.29 168311 Bytes 20/05/2008 14:42:16

AVWINLL.DLL : 1.0.0.7 14593 Bytes 20/05/2008 14:42:15

AVPREF.DLL : 8.0.0.1 25857 Bytes 20/05/2008 14:42:15

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24

AVREG.DLL : 8.0.0.0 30977 Bytes 20/05/2008 14:42:15

AVARKT.DLL : 1.0.0.23 307457 Bytes 20/05/2008 14:42:15

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 20/05/2008 14:42:15

SQLITE3.DLL : 3.3.17.1 339968 Bytes 20/05/2008 14:42:16

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 20/05/2008 14:42:16

NETNT.DLL : 8.0.0.1 7937 Bytes 20/05/2008 14:42:16

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 20/05/2008 14:42:13

RCTEXT.DLL : 8.0.32.0 86273 Bytes 20/05/2008 14:42:13

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: mardi 20 mai 2008 16:43

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'Mediadet.exe' - '1' Module(s) have been scanned

Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'CTNotify.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'lsmouse.exe' - '1' Module(s) have been scanned

Scan process 'vsnpstd.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'Popup-Destroy.exe' - '1' Module(s) have been scanned

Scan process 'Ctmix32.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'sstray.exe' - '1' Module(s) have been scanned

Scan process 'winampa.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'Ctsvccda.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

43 processes with 43 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '28' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\maxime\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\BlackBox.class-1aed29bd-3dc6ada4.class

[DETECTION] Contains suspicious code HEUR/HTML.Malware

[NOTE] The fund was classified as suspicious.

[NOTE] The file was moved to '4893eaec.qua'!

C:\Documents and Settings\maxime\Bureau\photoshop\CRACK + CONVERTI IN ITALIANO\Photoshop.CS2.KeyGen.exe

[DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl

[NOTE] The file was moved to '48a1eb2f.qua'!

C:\Documents and Settings\norbert\Mes documents\smartphone\Jeux\JEUX1\The Sudoku Challenge - Full Version.zip

[0] Archive type: ZIP

--> The_Sudoku_Challenge.exe

[DETECTION] Is the Trojan horse TR/Agent.DRV

[NOTE] The file was moved to '4897ecb6.qua'!

C:\SDFix\backups\backups.zip

[0] Archive type: ZIP

--> backups/9129837.exe

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

--> backups/regscan.exe

[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen

--> backups/~.exe

[DETECTION] Is the Trojan horse TR/Agent.cyt.107

[NOTE] The file was moved to '4895f1ea.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP201\A0107159.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f25f.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP202\A0108176.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f267.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP202\A0109161.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f269.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP202\A0111171.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f26f.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP203\A0111186.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f271.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP203\A0112185.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f272.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP203\A0112196.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda0f3.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP204\A0115200.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f274.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP204\A0116198.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f275.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP204\A0118196.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f276.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP205\A0119198.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f278.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP205\A0120215.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda0f9.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP206\A0120218.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f27a.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP206\A0120247.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f27b.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP206\A0122245.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f27c.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP206\A0123253.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda0fd.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP206\A0123272.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f27d.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP207\A0124264.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f27f.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP207\A0125263.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda000.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP207\A0125283.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f280.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP208\A0126285.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f282.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP208\A0126308.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda003.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP208\A0127310.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f283.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP209\A0128308.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f284.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP209\A0129309.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f285.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP209\A0130310.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f286.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP209\A0132309.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f287.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP210\A0133321.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f289.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP210\A0134317.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f28a.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP210\A0134349.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f28b.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP210\A0135349.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda00c.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP210\A0135463.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f28f.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP211\A0136406.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f291.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP211\A0136418.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda012.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0137421.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f293.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0138421.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f294.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0139421.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda015.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0140421.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f295.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0141449.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f296.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0142453.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda017.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0142465.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f297.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP212\A0143466.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f298.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0143499.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f29a.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0143509.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda01b.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0144510.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f29b.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0144528.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f29c.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0145530.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '49fda01d.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP213\A0145641.sys

[DETECTION] Is the Trojan horse TR/Rootkit.Gen

[NOTE] The file was moved to '4863f2a0.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP214\A0146590.exe

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

[NOTE] The file was moved to '4863f2a2.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP214\A0146591.exe

[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen

[NOTE] The file was moved to '4863f2a3.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP214\A0146599.exe

[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen

[NOTE] The file was moved to '49fda024.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP214\A0146600.exe

[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen

[NOTE] The file was moved to '4863f2a5.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP214\A0146602.exe

[DETECTION] Is the Trojan horse TR/Agent.cyt.107

[NOTE] The file was moved to '49fda026.qua'!

C:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP215\A0146759.exe

[DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl

[NOTE] The file was moved to '4863f2a9.qua'!

Begin scan in 'D:\'

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\058F0N4N\t[1].html

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '4863fb53.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\BYV15PR7\bill[2]

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '489efc25.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\BYV15PR7\bill[3]

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '491f4e96.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\KP63WD6Z\argentgagnant[1].html

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '4899fd3c.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\ODGNGVWZ\produits[1].html

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '48a1ff00.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\ODGNGVWZ\tag_script[1].php

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '4899fef1.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\ONZV68P5\t[1].html

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '4863ff00.qua'!

D:\Documents and Settings\Léa\Local Settings\Temporary Internet Files\Content.IE5\WL85IB8T\max9300[1].html

[DETECTION] Contains detection pattern of the HTML script virus HTML/Infected.WebPage.Gen

[NOTE] The file was moved to '48aaff6f.qua'!

D:\Documents and Settings\Maxime\Bureau\oldblivion\oldblivion_0.11t5\oldblivion.exe

[DETECTION] Is the Trojan horse TR/Hijacker.Gen

[NOTE] The file was moved to '48970035.qua'!

D:\Documents and Settings\Maxime\Bureau\photoshop\CRACK + CONVERTI IN ITALIANO\Photoshop.CS2.KeyGen.exe

[DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl

[NOTE] The file was moved to '48a200f8.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\10136a3.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864014e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\105120f.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4868014e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\108e47.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b014f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\10ab1b7.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48940150.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\10eed4e.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48980150.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1116f48.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48640152.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\119d538.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c0153.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\128c66d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b0154.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1334441.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48660156.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1480713.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b0158.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\15f4ad6.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990159.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1665c00.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4869015b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\16bbc7d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4895015c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\171446.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864015d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\197f075.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486a0160.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\198f1dd.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b0161.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\19f1c7.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990161.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1a5f2.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4868018a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1a927e2.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c018b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1b2806d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4865018c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1baa073.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4894018d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1c5912f.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4868018e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1dfb84.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990190.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1edfd9f.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48970192.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1f0536c.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48630193.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\1f768d8.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486a0194.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\20f7a8d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4899015f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\20fa09.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990160.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\228bb74.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b0162.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\234de57.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48670164.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\23b3fc8.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48950164.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\23e792e.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48980165.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\2414347.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48640167.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\24c489.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48960167.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\25675ec.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48690169.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\25e6abb.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4898016a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\273b060.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4866016c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\2994808.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c016f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\2a02fd2.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48630198.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\2c12f5.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864019a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\2cc62f0.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4896019b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\3a1b2e.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491ba2eb.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\3a9c78.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c019b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\3d0490.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4863019e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\3e2269.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486501a0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4114aa.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864016c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\413457.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4866016d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\488e4a.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b0175.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4a670.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4869019f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4c32c4.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486601a1.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4c6c03.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486901a2.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4de2a8.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489801a4.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4e1725.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486401a5.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\4fbf1d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489501a7.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\524c1.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48670174.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\54bfac.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48950177.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\57f1b2.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4899017a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\5b9469.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c01a6.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\5d8a47.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b01a9.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\5ee056.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489801ab.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\61f952.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990177.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\6493e3.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c017b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\6d6431.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486901ab.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\6fd6e7.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489701ae.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\70dd4.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48970179.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\71cffb.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4896017b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\8805cc.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48630182.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\91e222.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4898017c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\938727.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b017f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\94f496.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48990181.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\96ae4b.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48940183.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\971956.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48640185.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\9912d2.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48640188.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\9ac26b.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489601b0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\9f83ce.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b01b6.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\a2c091.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48960183.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\a56f6e.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48690187.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\a8a60.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4894018a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\a8dd42.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4897018b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\ae7c4b.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486a01b9.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\b9de97.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4897018d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\bb83d6.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486b01b7.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\bc359f.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486601b9.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\be3d44.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486601bc.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\c1cf3f.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48960188.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\c3a564.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4894018b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\c70650.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48630190.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\cf9fb.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486c01bf.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\d6140.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48640190.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\da6e3.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486901bc.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\dee69d.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '489801c0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\e1f849.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4899018d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\e877a4.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '486a0195.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\f200dd.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491ca2e1.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temp\f3da0e.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48970191.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\03V7MWPT\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487402cf.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\03V7MWPT\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64ee8.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\03V7MWPT\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487402d0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\03V7MWPT\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487402d1.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874036d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874036e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f5b1df.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874036f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740370.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\0PIZC5YV\upAYB[6].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64f49.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\49S7OFW7\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487403f2.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\49S7OFW7\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487403f3.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\4HAJSTMV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874041c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\4HAJSTMV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64825.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740441.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f6487a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740443.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740442.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f6487b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\54PLNP57\upAYB[6].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740444.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\5AF1TMG6\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874046f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\5AF1TMG6\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740470.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\5AF1TMG6\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64849.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\5AF1TMG6\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740472.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\5AF1TMG6\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740471.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\6VH80JUX\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740496.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\6VH80JUX\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f648af.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\6VH80JUX\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740497.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\77PZFXCW\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487404be.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\77PZFXCW\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64887.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\77PZFXCW\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487404b0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\A3SFR0D8\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487404e2.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BODDRGOK\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740508.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BODDRGOK\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64931.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BODDRGOK\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874050a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BODDRGOK\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64933.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BODDRGOK\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740509.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BXAE53V1\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740552.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BXAE53V1\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f6496b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BXAE53V1\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740553.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\BXAE53V1\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740554.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\CLQJK1UZ\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487405d2.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\CLQJK1UZ\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487405d3.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\CLQJK1UZ\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f649ec.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\CLQJK1UZ\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487405d5.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\F5GKGBN7\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740600.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\F5GKGBN7\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a39.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\F5GKGBN7\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740601.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\F5GKGBN7\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a3a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\G1YZCPQZ\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874062b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\G1YZCPQZ\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a14.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\G1YZCPQZ\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874062d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\I1KB6T61\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740655.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\I1KB6T61\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a6e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\JFH9T5HQ\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740679.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\JFH9T5HQ\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a42.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\JFH9T5HQ\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874067b.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\JFH9T5HQ\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874067a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\JFH9T5HQ\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a43.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\K16NKTIZ\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487406a0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\K16NKTIZ\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487406a1.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\K16NKTIZ\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64a9a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\K16NKTIZ\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487406a3.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\NBUMS87E\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740702.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\NBUMS87E\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740703.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\NBUMS87E\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f5b5b4.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\OTOL2JW9\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740723.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\OTOL2JW9\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64b1c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\OTOL2JW9\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740724.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\QR41I5GF\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740773.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\QR41I5GF\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64b4c.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S567SDY7\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740799.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S567SDY7\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874079a.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S567SDY7\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64ba3.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S92ZO9YV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487407bd.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S92ZO9YV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487407be.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\S92ZO9YV\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64b87.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\U1JW54VU\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487407e1.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\U1JW54VU\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f5b552.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UN2NQXUN\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874080e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UN2NQXUN\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64437.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UN2NQXUN\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48740800.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UN2NQXUN\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874080f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UN2NQXUN\upAYB[5].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64428.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UNUZMLEV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874083d.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UNUZMLEV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874083e.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UNUZMLEV\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64407.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\UNUZMLEV\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4874083f.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\W5IB4DMV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487408b7.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\W5IB4DMV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f64480.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\W5IB4DMV\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487408b9.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\WHENG1IV\upAYB[1].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487408e0.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\WHENG1IV\upAYB[2].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '49f5ba51.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\WHENG1IV\upAYB[3].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487408e2.qua'!

D:\Documents and Settings\Maxime\Local Settings\Temporary Internet Files\Content.IE5\WHENG1IV\upAYB[4].int

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '487408e1.qua'!

D:\Program Files\MP3 Player Utilities 3.5.01\DelDrv.exe

[DETECTION] Is the Trojan horse TR/DelAll.Q.1

[NOTE] The file was moved to '489f0d33.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146814.exe

[DETECTION] Is the Trojan horse TR/Hijacker.Gen

[NOTE] The file was moved to '486416fe.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146815.exe

[DETECTION] Contains detection pattern of the worm WORM/Autorun.cxl

[NOTE] The file was moved to '486416ff.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146816.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641700.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146817.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641701.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146818.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cd2.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146819.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641702.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146820.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cd3.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146821.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641703.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146822.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cd4.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146823.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641704.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146824.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cd5.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146825.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641705.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146826.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cd6.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146827.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641706.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146828.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b225f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146829.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641707.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146830.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2250.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146831.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641708.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146832.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641709.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146833.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2252.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146834.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170a.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146835.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2253.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146836.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170b.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146837.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2254.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146838.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170c.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146839.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2255.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146840.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170d.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146841.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cde.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146842.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170e.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146843.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2257.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146844.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864170f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146845.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2248.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146846.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641710.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146847.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2249.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146848.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641711.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146849.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b224a.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146850.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641712.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146851.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b224b.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146852.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641713.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146853.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641714.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146854.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b224d.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146855.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641715.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146856.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b224e.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146857.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641716.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146858.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b224f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146859.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641717.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146860.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2240.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146861.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641718.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146862.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641719.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146863.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2242.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146864.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171a.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146865.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8ccb.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146866.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171b.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146867.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2244.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146868.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171c.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146869.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8ccd.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146870.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171d.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146871.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cce.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146872.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171e.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146873.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8ccf.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146874.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864171f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146875.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cf0.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146876.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641720.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146877.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cf1.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146878.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641721.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146879.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cf2.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146880.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641722.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146881.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641723.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146882.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491a8cf4.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146883.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641724.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146884.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b227d.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146885.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641725.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146886.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641726.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146887.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b227f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146888.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641727.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146889.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2270.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146890.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641728.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146891.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2271.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146892.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641729.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146893.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2272.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146894.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172a.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146895.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172b.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146896.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2274.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146897.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172c.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146898.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2275.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146899.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172d.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146900.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172e.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146901.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2277.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146902.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '4864172f.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146903.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b2268.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146904.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641730.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146905.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641731.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146906.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b226a.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146907.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641732.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146908.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b226b.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146909.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '48641733.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146910.exe

[DETECTION] Is the Trojan horse TR/Dldr.Swizzor.DV

[NOTE] The file was moved to '491b226c.qua'!

D:\System Volume Information\_restore{B52B1DBB-4358-4D98-B9E8-843C9EF03574}\RP216\A0146918.exe

[DETECTION] Is the Trojan horse TR/DelAll.Q.1

[NOTE] The file was moved to '48641734.qua'!

 

 

End of the scan: mardi 20 mai 2008 20:49

Used time: 4:06:17 min

 

The scan has been done completely.

 

18624 Scanning directories

931029 Files were scanned

358 viruses and/or unwanted programs were found

1 Files were classified as suspicious:

0 files were deleted

0 files were repaired

357 files were moved to quarantine

0 files were renamed

1 Files cannot be scanned

930671 Files not concerned

17300 Archives were scanned

1 Warnings

357 Notes

 

bonne soirée a+

 

nono61

jacmanou Extrem Member

jacmanou

Posté(e)
Posté(e)

Antivir a fait le boulot, la plupart des éléments qu'il a trouvé étaient situés dans la restauration système.

 

Supprime tes points de restauration.

Pour cela utilise le tuto de Pierre Pinard et Assiste.com :

http://assiste.com.free.fr/p/comment/comme...stauration.html

 

 

Continue ensuite la procédure indiquée dans mon 2ème post.

 

Bonne soirée à toi si tu en restes là pour ce soir, à demain ! :P

NONO61 Member

NONO61

Posté(e)
  • Auteur
Posté(e)

bonjour jacmanou

 

je suis allé visiter le tuto de pierre PINARD, il n'y est pas indiqué comment les supprimer mais simplement Comment activer / désactiver les points de restauration, quelle est la bonne procédure ?

 

 

 

actuellement je ne suis pas sur le poste concerné, j'espère avoir le temps en soirée!

 

j'ai vu aussi que la plupart des fichiers provenaient de mon disque D en ATA ; c'est mon ancien DD qui est maintenant en esclave depuis plus de 2 ans et dans lequel je peux retrouver certaines anciennes sauvegardes , et ma licence originale XP PRO, car quand j'ai changé pour un SATA de plus grande contenance, mon cd d'install XP pro SP1 ne tenait pas compte du SATA, c'est donc un ami qui m'a fourni un cd non officiel et avec des n° de lic* intégrés et autres que les miens.

je n'ai pas possibilité de changer les n° de lic* sur mon SATA, et je ne peux pas non plus reformater le SATA pour réinstaller mon XP dessus à moins d'avoir un CD avec XP pro SP2 intégrant le SATA et sans N° de lic intégré!

 

merci

 

A bientôt

nono

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...