[RESOLU]Infection par cheval de Troie TR/Rootkit.Gen

OPH03 · le 13 avril 2010

Bonjour,

je me permets de solliciter votre aide car depuis que j'ai allumé mon PC, Antivir ne cesse de m'indiquer (environ toutes les 10 secondes) qu'il a détecté le cheval de Troie TR/Rootkit.Gen.

De plus, l'alerte revient quelque soit la fonction que je coche (déplacer en quarantaine, refuser l'accès...)

J'espère avoir été claire dans mes explications

Ci-joint, le rapport Hijackthis.

Merci de votre aide.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:59:24, on 13/04/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Application Updater\ApplicationUpdater.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Winamp\winampa.exe

C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\PROGRA~1\MICROS~4\wcescomm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\SFR\Kit\9props.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\documents and settings\pc\local settings\application data\hyzsdew.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avira\AntiVir Desktop\GUARDGUI.EXE

C:\Documents and Settings\PC\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sfr.fr/kit/adsl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll

O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Aide à la navigation SFR - {0F6E720A-1A6B-40E1-A294-1D4D19F156C8} - C:\Program Files\SFR\Kit\SFRNavErrorHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\SearchSettings.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [ssAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\TEMP\~TM1D.tmp

O4 - HKLM\..\Run: [searchSettings] C:\Program Files\Search Settings\SearchSettings.exe

O4 - HKCU\..\Run: [Configuration de la C-BOX] C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe

O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\Winsos\WINSOS.EXE" MINI

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Connexion SFR 9props.exe] "C:\Program Files\SFR\Kit\9props.exe" /trayicon

O4 - HKCU\..\Run: [hyzsdew] "c:\documents and settings\pc\local settings\application data\hyzsdew.exe" hyzsdew

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\dwdsregt.exe

O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwinkodv.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe

O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Pense-bête.lnk = C:\Program Files\Broderbund\PrintMaster\PMREMIND.EXE

O4 - Global Startup: REALTEK 11n USB Wireless LAN Utility.lnk = C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra 'Tools' menuitem: Créer un favori mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {09CC593B-E8A9-4491-927D-A3E33534DDD4} (InstallerObj Class) - http://mm.tf1.fr/superdistribution/installer2.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...etup1.0.1.1.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1140804194625

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Service Google Update (gupdate1c9dfd3458a3c2) (gupdate1c9dfd3458a3c2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe

O24 - Desktop Component 0: (no name) - file:///C:/Documents%20and%20Settings/PC/Mes%20documents/oph%E9lie/traineau1.gif

O24 - Desktop Component 1: (no name) - file:///C:/Documents%20and%20Settings/PC/Mes%20documents/oph%E9lie/sapin60.gif

--

End of file - 13642 bytes

Modifié le 19 avril 2010 par OPH03

Thanos · le 13 avril 2010

salut

Une revenante Le pc est effectivement infecté au vu de ton rapport.

On va procéder ainsi (dans l'ordre) =>

1°) Un petit scan supplémentaire avec un programme que tu vas pouvoir conserver: si tu le possède déjà, passe l'étape de l'installation et va directement à la mise à jour >>

Télécharge Malwarebytes' Anti-Malware (MBAM)

Branche tous les supports amovibles que tu possèdes avant de faire ce scan (clé usb/disque dur externe etc)

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen complêt"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

2°) Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.
Clique Continue à l'écran Disclaimer.
Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
Si tu ne vois pas ces deux rapports, tu les trouveras dans le dossier C:\rsit

Poste les 3 rapports stp.

OPH03 · le 15 avril 2010

Salut,

et oui une revenante!!! Merci pour ton aide.

Voici donc le rapport Mbam:

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Version de la base de données: 3990

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

15/04/2010 19:03:21

mbam-log-2010-04-15 (19-03-21).txt

Type d'examen: Examen complet (C:\|)

Elément(s) analysé(s): 237947

Temps écoulé: 1 heure(s), 0 minute(s), 6 seconde(s)

Processus mémoire infecté(s): 1

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 50

Valeur(s) du Registre infectée(s): 3

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 16

Fichier(s) infecté(s): 95

Processus mémoire infecté(s):

C:\documents and settings\PC\local settings\application data\hyzsdew.exe (Adware.Navipromo.H) -> Unloaded process successfully.

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{5015bf9d-173c-474b-9af3-77d4d23a4135} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{85e0b171-04fa-11d1-b7da-00a0c90348d7} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{92c3f342-45da-4511-853a-b3836aaff5f5} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{566dede9-9ed8-45da-9be6-9b2eeab17f49} (Adware.Mirar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9a9c9b68-f908-4aab-8d0c-10ea8997f37e} (Adware.Mirar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9a9c9b69-f908-4aab-8d0c-10ea8997f37e} (Adware.Mirar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b5141620-c2b2-4d95-9f0f-134d99c87ab0} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.amo (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.amo.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.momo (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.momo.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.ohb (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\fis.ohb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\winantivirus pro 2006 (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Enhanced Ads by Think-Adz (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Think-Adz Search Assistant (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fopn (Rogue.WinAntiSpyware) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyzsdew (Adware.Navipromo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysgif32 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\bootstera (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

C:\Documents and Settings\PC\Application Data\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\FunWebProducts\Data (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\FunWebProducts\Data\PC (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\WinAntiVirus Pro 2006 (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006 (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006\Logs (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\Fichiers communs\WinAntiVirus Pro 2006 (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\WinAntiVirus Pro 2006 (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\Documents and Settings\PC\Local Settings\Application Data\hyzsdew_navps.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Local Settings\Application Data\hyzsdew_nav.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Local Settings\Application Data\hyzsdew.dat (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Local Settings\Application Data\hyzsdew.exe (Adware.Navipromo.H) -> Quarantined and deleted successfully.

C:\Program Files\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012234.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012241.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012248.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012257.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012264.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012271.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012278.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012285.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012215.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012292.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012299.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012306.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012313.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012320.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012335.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012381.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012392.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012405.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012420.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012427.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012434.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012442.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012451.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012458.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012468.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012475.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012487.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012494.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012506.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012513.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012519.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012526.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012534.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012541.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012548.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012555.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012562.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012569.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012583.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP86\A0012590.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012597.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012635.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012646.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012654.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012659.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012666.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012673.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012680.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012687.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012694.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012701.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012708.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012715.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012720.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012725.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012732.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012739.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012746.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012753.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP87\A0012761.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP88\A0012832.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0012962.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0012983.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0012988.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0012997.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0013960.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{FB047EF1-F9F5-4AA5-A041-AE6F9FB996FD}\RP89\A0014959.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\rxwttm.sys (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\drivers\dot4.sys.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\pzcwoc.sys (Rootkit.Agent) -> Delete on reboot.

C:\Documents and Settings\PC\Application Data\FunWebProducts\Data\PC\avatar.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006\PGE.dat (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006\Logs\update.log (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006\Logs\wa6Support.log (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\WinAntiVirus Pro 2006\Logs\winav.log (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\Fichiers communs\WinAntiVirus Pro 2006\err.log (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

C:\Program Files\WinAntiVirus Pro 2006\msvcp71.dll (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\WinAntiVirus Pro 2006\msvcr71.dll (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Menu Démarrer\Programmes\Démarrage\TA_Start.lnk (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Menu Démarrer\Programmes\Démarrage\Think-Adz.lnk (Rogue.Link) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\msnav32.ax (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\stera.job (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\zxdnt3d.cfg (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\zxdnt3d.cfg. (Adware.ZenoSearch) -> Quarantined and deleted successfully.

C:\Documents and Settings\PC\Application Data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully.

OPH03 · le 15 avril 2010

Et voici les 2 autres rapports:

Logfile of random's system information tool 1.06 (written by random/random)

Run by PC at 2010-04-15 19:17:38

Microsoft Windows XP Édition familiale Service Pack 3

System drive C: has 91 GB (73%) free of 125 GB

Total RAM: 511 MB (13% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:17:45, on 15/04/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Application Updater\ApplicationUpdater.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Cegetel\C-BOX\Wizard\QuickAccess.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\PROGRA~1\MICROS~4\wcescomm.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SFR\Kit\9props.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe

C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe

C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Microsoft Office\Office\WINWORD.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\PC\Bureau\RSIT.exe

C:\Documents and Settings\PC\Bureau\PC.exe