PC infecté par le ver WORM_SDBOT.EDG

Bonjour,
Le PC d'une amie est infesté par le ver WORM_SDBOT.EDG, qui se caracterise notamment par l'ouverture d'une fenetre IRC dès le démarrage, la fermeture intempestive d'internet explorer et mozilla, et un ramage permanent de l'ordi.
J'ai déjà effectué un scan avec Hijackthis, j'attends vos réponses pour le poster...
Merci d'avance pour votre aide.

Bonjour,

- Télécharge HiJackThis de Merijn sur ton bureau.
- Renomme le fichier HiJackThis.exe en Scanner.exe pour cela, fais un clic droit sur le fichier HiJackThis.exe et choisis renommer dans la liste
- Tape Scanner.exe et Appuye sur la touche Entrée.
- Génère un rapport en suivant ces indications :
- Double-clic sur Scanner.exe
- Exécute le et clique sur Do a scan and save log file.
- Le rapport s'ouvre sur le Bloc-Note
- Colle le rapport ici, pour cela :
- Menu Edition / Selectionner Tout
- Menu Edition / copier
- Ici dans un nouveau message : clic droit / coller
Aide : N'hésite pas à consulter l'aide HiJackThis -

Merci pour la réponse rapide.

J'ai fait le scan, par contre je n'ai pas renommé hijackthis en scanner.exe, ça ne change pas grand chose, si ?

En tous cas voilà le rapport :

Logfile of HijackThis v1.99.1
Scan saved at 17:03:59, on 20/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gericom.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.Siirde.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.Siirde.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elmaliseker.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.Siirde.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6monr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKLM\..\Run: [Windows Service Agent] msnmgrs.exe
O4 - HKLM\..\Run: [Usb 2.0 Drive] klm.exe
O4 - HKLM\..\Run: [Windll] C:\WINDOWS\windll.exe
O4 - HKLM\..\Run: [Tamer] C:\WINDOWS\Fonts\LSSAS.exe
O4 - HKLM\..\Run: [Windows Security Center Notification Appls] C:\WINDOWS\System32\sxe.exe
O4 - HKLM\..\Run: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKLM\..\Run: [Service Update] C:\WINDOWS\System32\alggg.exe
O4 - HKLM\..\Run: [Nod32 Service] nod64.exe
O4 - HKLM\..\Run: [Windows Update] mnz.exe
O4 - HKLM\..\Run: [Windows Service Agents] agsqml1.exe
O4 - HKLM\..\Run: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKLM\..\Run: [Microsoft] rx.exe
O4 - HKLM\..\Run: [Windows LoL Layer] qvfmlvg.exe
O4 - HKLM\..\RunServices: [Usb 2.0 Drive] klm.exe
O4 - HKLM\..\RunServices: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKLM\..\RunServices: [Windows Update] mnz.exe
O4 - HKLM\..\RunServices: [Nod32 Service] nod64.exe
O4 - HKLM\..\RunServices: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKLM\..\RunServices: [Windows Service Agent] msnmgrs.exe
O4 - HKLM\..\RunServices: [Windows Service Agents] agsqml1.exe
O4 - HKLM\..\RunServices: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKLM\..\RunServices: [Microsoft] rx.exe
O4 - HKLM\..\RunServices: [Windows LoL Layer] qvfmlvg.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Windows Service Agent] msnmgrs.exe
O4 - HKCU\..\Run: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKCU\..\Run: [Windows Update] mnz.exe
O4 - HKCU\..\Run: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKCU\..\Run: [Service Update] C:\WINDOWS\System32\alggg.exe
O4 - HKCU\..\Run: [Windows Security Center Notification Appls] C:\WINDOWS\System32\sxe.exe
O4 - HKCU\..\Run: [Windows Service Agents] agsqml1.exe
O4 - HKCU\..\Run: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKCU\..\Run: [Windows LoL Layer] qvfmlvg.exe
O4 - HKCU\..\RunServices: [Windows Update] mnz.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Home Prefix: http://www.elmaliseker.net
O14 - IERESET.INF: START_PAGE_URL=http://www.gericom.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://amelieleb.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: antivirusdll - Unknown owner - C:\WINDOWS\msnmessangern.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: kernel.exe - Unknown owner - C:\WINDOWS\kernel.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Universal Printer NT Service - Unknown owner - C:\WINDOWS\System32\dllcache\upnt.exe
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe

J'attends la suite des instructions... Merci beaucoup

Voici la manipulation à effectuer en entier
Merci de bien vouloir :
- Lire attentivement les instructions demandées et prendre son temps pour les effectuer convenablement, sinon la désinfection ne sera pas complète.
- Si certains éléments ne sont pas trouvés, merci de le signaler mais de poursuivre les manipulations jusqu'au bout.
- A l'issu de la procédure, merci de bien copier/coller TOUS les rapports demandés.
- N'hésitez pas à consulter les liens d'aides, ils sont là pour vous guider !


---> Télécharge ZoneAlarm mais ne l'installe pas maintenant ZoneAlarm


Télécharge Windows Worms Cleaner : http://www.firewallleaktester.com/wwdc.htm
Tu l'executes et tu fermes tous les ports (il fau qu'il soit en rouge).

- Demarrer / executer / tape services.msc
- Cherche kernel.exe dans la liste
- Double clic dessus, positionne le type de démarrage sur désactiver
- Cherche SC delete Universal Printer NT Service dans la liste
- Double clic dessus, positionne le type de démarrage sur désactiver

Sur HiJackThis, refais un scan et coches les lignes suivantes :

O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\WINDOWS\System32\ipv6monr.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKLM\..\Run: [Windows Service Agent] msnmgrs.exe
O4 - HKLM\..\Run: [Usb 2.0 Drive] klm.exe
O4 - HKLM\..\Run: [Windll] C:\WINDOWS\windll.exe
O4 - HKLM\..\Run: [Tamer] C:\WINDOWS\Fonts\LSSAS.exe
O4 - HKLM\..\Run: [Windows Security Center Notification Appls] C:\WINDOWS\System32\sxe.exe
O4 - HKLM\..\Run: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKLM\..\Run: [Service Update] C:\WINDOWS\System32\alggg.exe
O4 - HKLM\..\Run: [Nod32 Service] nod64.exe
O4 - HKLM\..\Run: [Windows Update] mnz.exe
O4 - HKLM\..\Run: [Windows Service Agents] agsqml1.exe
O4 - HKLM\..\Run: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKLM\..\Run: [Microsoft] rx.exe
O4 - HKLM\..\Run: [Windows LoL Layer] qvfmlvg.exe
O4 - HKLM\..\RunServices: [Usb 2.0 Drive] klm.exe
O4 - HKLM\..\RunServices: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKLM\..\RunServices: [Windows Update] mnz.exe
O4 - HKLM\..\RunServices: [Nod32 Service] nod64.exe
O4 - HKLM\..\RunServices: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKLM\..\RunServices: [Windows Service Agent] msnmgrs.exe
O4 - HKLM\..\RunServices: [Windows Service Agents] agsqml1.exe
O4 - HKLM\..\RunServices: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKLM\..\RunServices: [Microsoft] rx.exe
O4 - HKLM\..\RunServices: [Windows LoL Layer] qvfmlvg.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Windows Service Agent] msnmgrs.exe
O4 - HKCU\..\Run: [Windows Security Center Notification Applsee] C:\WINDOWS\System32\sysecurex.exe
O4 - HKCU\..\Run: [Windows Update] mnz.exe
O4 - HKCU\..\Run: [Service Host Windows] C:\WINDOWS\System32\scchost.exe
O4 - HKCU\..\Run: [Service Update] C:\WINDOWS\System32\alggg.exe
O4 - HKCU\..\Run: [Windows Security Center Notification Appls] C:\WINDOWS\System32\sxe.exe
O4 - HKCU\..\Run: [Windows Service Agents] agsqml1.exe
O4 - HKCU\..\Run: [Windows Updt Maschishkha] Dnmee33.exe
O4 - HKCU\..\Run: [Windows LoL Layer] qvfmlvg.exe
O4 - HKCU\..\RunServices: [Windows Update] mnz.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

---> puis clic sur le bouton "Fix Checked"
n'hésite pas à consulter l'aide HiJackThis

- Télécharge et installe AVG Anti-Spyware - Tutorial : http://www.malekal.com/tutorial_AVG_AntiSpyware.html
- Mets le à jour à partir du menu Mise à jour en haut
- Télécharge clean.zip, décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier clean.



Avast! est loin de ce que l'on a fait de mieux en matière de protection, voir ce lien pour plus d'informations : http://forum.malekal.com/ftopic3123.php

Clairement, Antivir est beaucoup plus performant, c'est pourquoi, je te conseille TRES VIVEMENT de désinstaller Avast! et installer Antivir à la place : http://www.malekal.com/tutorial_antivir.php



Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :[list]

____

- Redémarre en mode sans échec, pour cela, redémarre l'ordinateur, avant le logo Windows, tapote sur la touche F8, un menu va apparaître, choisis Mode sans échec et appuye sur la touche entrée du clavier.



Double-clic sur ce dossier clean, tu y trouveras dedans plusieurs fichiers.
Double-clic sur clean. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 2 en appuyant sur la touche 2 de ton clavier.
Clean va travailler.
Un rapport Va etre généré, colle le contenu entier ici.

- Ouvre AVG Anti-Spyware et clic sur l'onglet Analyse, puis le sous-onglet Paramètres
- Sélectionne dans Comment Réagir ? Quarantine. (voir l'aide l'aide AVG Anti-Spyware)
- Reviens au sous-onglet Analyser puis clique sur Analyse complète du système.
---> Le scan démarre.

A la fin clique sur Appliquer toutes les actions, les éléments doivent alors être déplacés en quarantaine.
Puis clique sur Enregistrer le rapport d'analyse et enregistre le rapport sur le Bureau.


Aide : N'hésite pas à consulter l'Aide AVG Anti-Spyware pour tout problème.


Lance Antivir :
- Cliquez sur l'onglet Scanner.
- Sélectionne Manual Selection
- Sélectionne le disque C
- Lance le scan - Mets en quarantaine tous les éléments détectés.
- Une fois le scan terminé Enregistre le rapport.


Installe ZoneAlarm

Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.

Appuie sur Y pour commencer le processus de nettoyage.

Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.

Appuie sur une touche pour redémarrer le PC.

Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.

Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.

Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

[/list]


____


-- Redémarre en mode normal : Menu Démarrer / Arreter / Redémarre l'ordinateur



-- Copie/Colle ici les rapports sans en oublier :
- du Antivir
- AVG Anti-Spyware
- SDFix
- le rapport clean : Poste de travail / double clic sur disque C / double-clic sur rapport_clean.txt et copier/coller le contenu ici C:\rapport_clean.txt
- ainsi qu'un nouveau log HiJackThis

Merci beaucoup

Comme ce n'est pas mon pc mais celui d'une amie, je vais lui faire tout ça des que possible, mais ça sera probablment dans une paire de jours.

A bientôt donc, et encore merci

OK

Bonjour

J'ai pu faire tous les scans, voilà les rapports :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

C:\WINDOWS\Fonts\t1m3r -> Backdoor.Flood.ba : Aucune action entreprise.
C:\WINDOWS\system32\dllcache\upnt.exe -> Backdoor.Mytobor.c : Aucune action entreprise.
C:\WINDOWS\msnmessangern.exe -> Backdoor.SdBot.bci : Aucune action entreprise.
C:\asje.exe -> Backdoor.SdBot.bci : Aucune action entreprise.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4HYJ09I7\wix[1].exe -> Backdoor.Wisdoor.aw : Aucune action entreprise.
C:\WINDOWS\msdevmgr32.exe -> Backdoor.Wisdoor.aw : Aucune action entreprise.
C:\emretedua.exe -> Backdoor.Wisdoor.aw : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP136\A0100119.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP136\A0101120.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP136\A0102120.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP136\A0103111.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0104120.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0104151.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0105151.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0106151.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0106177.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0106202.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0107202.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP137\A0107241.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0108232.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0108255.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0109251.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0110257.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0110271.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0110291.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0111291.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0112291.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0113281.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0114291.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0114306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0115306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0116306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP138\A0117306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0118306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0119306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0120306.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0121296.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0122321.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0122352.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP139\A0122367.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0123391.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0123407.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0124404.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0125404.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0125423.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP140\A0125439.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0126439.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0127439.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0128439.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0128454.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0128473.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0129473.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0130463.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131473.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131488.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131506.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131517.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131526.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0131543.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP141\A0132553.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0133558.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0133573.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0133588.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0133603.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0134593.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0134618.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0135608.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0135632.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0136634.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0137634.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0138634.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0139634.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0139655.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0140655.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0140674.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0141672.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0141694.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP142\A0141725.dll -> Hijacker.Small.kj : Aucune action entreprise.
C:\WINDOWS\system32\lzx32.sys -> Rootkit.Small : Aucune action entreprise.
:mozilla.149:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.150:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.100:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.101:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.98:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.99:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.64:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.65:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@adtech[2].txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@advertising[1].txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.261:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Adviva : Aucune action entreprise.
:mozilla.116:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
:mozilla.97:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@bluestreak[1].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
:mozilla.197:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.198:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.199:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.201:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Coremetrics : Aucune action entreprise.
:mozilla.19:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
:mozilla.37:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
:mozilla.223:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Googleadservices : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@search.live[1].txt -> TrackingCookie.Live : Aucune action entreprise.
:mozilla.200:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.95:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@overture[1].txt -> TrackingCookie.Overture : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Aucune action entreprise.
:mozilla.192:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.194:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.132:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.133:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.134:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.135:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.136:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.137:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.138:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Sitestat : Aucune action entreprise.
:mozilla.139:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Sitestat : Aucune action entreprise.
:mozilla.182:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Sitestat : Aucune action entreprise.
:mozilla.183:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Sitestat : Aucune action entreprise.
:mozilla.184:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Sitestat : Aucune action entreprise.
:mozilla.20:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.21:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.22:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@toplist[1].txt -> TrackingCookie.Toplist : Aucune action entreprise.
:mozilla.93:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.94:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.10:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.11:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.12:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.13:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
C:\Documents and Settings\amélie\Cookies\amélie@weborama[1].txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.229:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.230:C:\Documents and Settings\amélie\Application Data\Mozilla\Firefox\Profiles\d91jbnql.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP146\A0169381.exe -> Trojan.Agent : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177604.exe -> Trojan.Agent : Aucune action entreprise.
C:\WINDOWS\windll.exe -> Trojan.Agent : Aucune action entreprise.
C:\WINDOWS\Fonts\demo.xt -> Trojan.Irc.flood.dv : Aucune action entreprise.
C:\WINDOWS\winhp32.exe -> Trojan.Small : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0154820.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0154836.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0155867.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0156883.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0158155.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0161187.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0163187.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0164218.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP145\A0165233.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP146\A0166233.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP146\A0167233.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP146\A0167273.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP146\A0167335.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0170381.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0170398.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0171398.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0171415.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0171433.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0172433.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0172461.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0172478.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0172495.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0173495.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0174495.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0175495.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0176495.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0176518.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0176536.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177535.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177553.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177572.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177590.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0177610.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0178610.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0180610.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0183610.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP147\A0184610.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP148\A0192777.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP149\A0194825.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP149\A0195852.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\System Volume Information\_restore{5E5370F3-7BC6-4EA8-9599-C9C7C5CB3BFF}\RP149\A0200913.bat -> Trojan.Zapchast : Aucune action entreprise.
C:\WINDOWS\Fonts\niamx -> Worm.Randon : Aucune action entreprise.


Fin du rapport



AntiVir PersonalEdition Classic
Report file date: dimanche 27 mai 2007 11:26

Scanning for 740715 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 1) [5.1.2600]
Username: amélie
Computer name: AMELIE

Version information:
BUILD.DAT : 247 14437 Bytes 10/05/2007 11:55:00
AVSCAN.EXE : 7.0.4.15 282664 Bytes 20/04/2007 11:37:14
AVSCAN.DLL : 7.0.4.4 33832 Bytes 27/03/2007 11:31:54
LUKE.DLL : 7.0.4.11 143400 Bytes 27/03/2007 11:26:04
LUKERES.DLL : 7.0.4.0 10280 Bytes 19/03/2007 11:18:59
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 13:08:58
ANTIVIR1.VDF : 6.37.1.151 4303360 Bytes 23/02/2007 13:09:01
ANTIVIR2.VDF : 6.38.0.214 729600 Bytes 12/04/2007 13:09:02
ANTIVIR3.VDF : 6.38.0.225 50688 Bytes 16/04/2007 13:09:02
AVEWIN32.DLL : 7.4.0.12 2404864 Bytes 13/04/2007 13:04:24
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.1 24616 Bytes 27/03/2007 11:31:50
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.8 360488 Bytes 27/03/2007 07:48:28
AVREG.DLL : 7.0.1.2 31784 Bytes 15/03/2007 08:05:08
AVEVTLOG.DLL : 7.0.0.18 86056 Bytes 27/03/2007 11:16:05
AVARKT.DLL : 1.0.0.17 278568 Bytes 02/05/2007 10:32:26
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.15 2228264 Bytes 13/03/2007 09:46:18
RCTEXT.DLL : 7.0.45.0 86056 Bytes 19/03/2007 11:42:42

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 27 mai 2007 11:26

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
10 processes with 10 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '14' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\amélie\Bureau\Sécurité\SDFix\backups\backups.zip
[0] Archive type: ZIP
--> backups/update.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46bc4fab.qua'!
C:\Documents and Settings\amélie\Local Settings\Temporary Internet Files\Content.IE5\N386LXOK\2210[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '468a4faf.qua'!
C:\Documents and Settings\amélie\Local Settings\Temporary Internet Files\Content.IE5\TLGOUFLX\installer[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46cc5015.qua'!
C:\Documents and Settings\amélie\Local Settings\Temporary Internet Files\Content.IE5\XQ33UAV6\update[1].html
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46bd504f.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4TI3GTI7\amcik[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46bc51f2.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\S163KPIR\dene[1].exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46c751eb.qua'!
C:\WINDOWS\installer.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46cc5664.qua'!
C:\WINDOWS\sdfsd.exe
[DETECTION] Is the Trojan horse TR/Drop.IRC.Small.G
[INFO] The file was moved to '46bf5660.qua'!
C:\WINDOWS\update.html
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46bd566f.qua'!
C:\WINDOWS\update2.html
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '47d84534.qua'!
C:\WINDOWS\vktjrha.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46cd566b.qua'!
C:\WINDOWS\yokayh.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46c45671.qua'!
C:\WINDOWS\$NtUninstallKB824141$\user32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\hh.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\itss.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\locator.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\magnify.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\narrator.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\newdev.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\ole32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\osk.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\rpcrt4.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\rpcss.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\shell32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\shmedia.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\srv.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\user32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\win32k.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826939$\zipfldr.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\dhcpcsvc.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\ndis.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\ndisuio.sys
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\netshell.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\wzcdlg.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\wzcsapi.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB826942$\wzcsvc.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB828028$\msasn1.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\dao360.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\expsrv.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msexch40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msexcl40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjet40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjetol1.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjetoledb40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjint40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjter40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msjtes40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msltus40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\mspbde40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msrd2x40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msrd3x40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msrepl40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\mstext40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\mswdat10.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\mswstr10.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\msxbde40.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB829558$\vbajet32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll
[WARNING] The file could not be opened!
C:\WINDOWS\Fonts\LSSAS.exe
[DETECTION] Contains signature of the worm WORM/IRCBot.620544
[INFO] The file was moved to '46ac56e4.qua'!
C:\WINDOWS\system32\olaeayx.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46ba5a69.qua'!
C:\WINDOWS\system32\rx.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46875a83.qua'!
C:\WINDOWS\system32\tpeyklhj.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46be5a8a.qua'!
C:\WINDOWS\system32\yolastjh.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '46c55aa0.qua'!


End of the scan: dimanche 27 mai 2007 12:18
Used time: 52:16 min

The scan has been done completely.

3743 Scanning directories
168993 Files were scanned
17 viruses and/or unwanted programs were found
0 classified as suspicious:
0 files were deleted
0 files were repaired
17 files were moved to quarantine
0 files were renamed
64 Files cannot be scanned
168976 Files not concerned
6353 Archives were scanned
64 Warnings
0 Notes
0 Hidden objects were found


SDFix: Version 1.84

Run by am‚lie - 27/05/2007 - 1:06:17,45

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\AMLIE~1\Bureau\SCURIT~1\SDFix

Safe Mode:
Checking Services:

Name:
antivirusdll
hwclock
Microsoft Agent
Universal Printer NT Service

ImagePath:
"C:\WINDOWS\msnmessangern.exe"
C:\WINDOWS\System32\hwclock.exe
"C:\WINDOWS\System32\dllcache\qxchost.exe"
"C:\WINDOWS\System32\dllcache\upnt.exe"

antivirusdll - Deleted
hwclock - Deleted
Microsoft Agent - Deleted
Universal Printer NT Service - Deleted


C:\WINDOWS\system32\Microsoft\backup.ftp Found...
C:\WINDOWS\system32\Microsoft\backup.tftp Found...

Checking files:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp

Dummy:
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Files copied to SDFix\Backups

Restoring files if backups are found

Final Check:

Genuine:
C:\WINDOWS\system32\Microsoft\backup.ftp
C:\WINDOWS\system32\Microsoft\backup.tftp
C:\WINDOWS\system32\ftp.exe
C:\WINDOWS\system32\tftp.exe
C:\WINDOWS\system32\dllcache\ftp.exe
C:\WINDOWS\system32\dllcache\tftp.exe

Dummy:



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\Temp\eraseme_21084.exe - Deleted
C:\WINDOWS\system32\kazaabackupfiles\download_me.exe - Deleted
C:\WINDOWS\Fonts\remote.ini - Deleted
C:\WINDOWS\system32\agl23.exe - Deleted
C:\WINDOWS\system32\alggg.exe - Deleted
C:\WINDOWS\system32\dllcache\qxchost.exe - Deleted
C:\WINDOWS\system32\ipv6monr.dll - Deleted
C:\WINDOWS\system32\Microsoft\backup.ftp - Deleted
C:\WINDOWS\system32\Microsoft\backup.tftp - Deleted
C:\WINDOWS\system32\nod64.exe - Deleted
C:\WINDOWS\system32\sxe.exe - Deleted
C:\WINDOWS\update.exe - Deleted


Folder C:\WINDOWS\system32\kazaabackupfiles - Removed

Removing Temp Files...

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



Final Check:

Remaining Services:
------------------


[B]Rootkit PE386 Found, Use a Rootkit scanner ![/B]

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\WINDOWS\\System32\\dllcache\\upnt.exe"="C:\\WINDOWS\\System32\\dllcache\\upnt.exe:*:Enabled:Universal Printer NT Service"
"|"="|:*:Enabled:Nod32 Service"
"h"="h:*:Enabled:Windows Update "
"C:\\WINDOWS\\System32\\mysqld-backup-nt.exe"="C:\\WINDOWS\\System32\\mysqld-backup-nt.exe:*:Enabled:mysqld-backup process"
"C:\\WINDOWS\\System32\\wimnimi.exe"="C:\\WINDOWS\\System32\\wimnimi.exe:*:Enabled:Windows Update"
"C:\\WINDOWS\\Dnmee33.exe"="C:\\WINDOWS\\Dnmee33.exe:*:Enabled:Windows Updt Maschishkha"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]


Remaining Files:
---------------

Backups Folder: - C:\DOCUME~1\AMLIE~1\Bureau\SCURIT~1\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\Documents and Settings\am‚lie\Local Settings\Application Data\Microsoft\Messenger\amelieleboucher@hotmail.com\Sharing Folders\labichette77@hotmail.com\Thumbs.db
C:\Documents and Settings\am‚lie\Local Settings\Application Data\Microsoft\Messenger\amelieleboucher@hotmail.com\Sharing Folders\seamus_daiken@msn.com\Thumbs.db
C:\WINDOWS\iexplor.exe
C:\WINDOWS\kernel.exe
C:\WINDOWS\system32\agsqml1.exe
C:\WINDOWS\system32\durxnrx.exe
C:\WINDOWS\system32\kgm.exe
C:\WINDOWS\system32\mnz.exe
C:\WINDOWS\system32\msnmgrs.exe
C:\WINDOWS\system32\mysqld-backup-nt.exe
C:\WINDOWS\system32\pglolkr.exe
C:\WINDOWS\system32\qvfmlvg.exe
C:\WINDOWS\system32\rx.exe
C:\WINDOWS\system32\uahnlca.exe
C:\WINDOWS\system32\wimnimi.exe
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0003.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0004.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0005.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0071.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0199.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0204.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0298.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0447.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0711.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL0965.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL1409.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL1672.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL1768.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL1843.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL1959.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL2700.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL2780.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3060.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3375.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3645.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3660.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3758.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3828.tmp
C:\Documents and Settings\am‚lie\Application Data\Microsoft\Word\~WRL3831.tmp
C:\Documents and Settings\am‚lie\Bureau\~WRL0509.tmp
C:\Documents and Settings\am‚lie\Bureau\~WRL0743.tmp
C:\Documents and Settings\am‚lie\Bureau\~WRL3786.tmp
C:\Documents and Settings\am‚lie\Mes documents\Clef USB\lettres de motivation 2005\~WRL0003.tmp
C:\Documents and Settings\am‚lie\Mes documents\Clef USB\lettres de motivation 2005\~WRL1468.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0233.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0448.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0567.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0621.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0637.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL0941.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL1004.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL1555.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL1687.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL2028.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL3414.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL3843.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL3850.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\champ des toiles\~WRL4012.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Deug\IUPg‚n‚ral\~WRL3043.tmp
C:\Documents and Settings\am‚lie\Mes documents\IUP Licence\Economie contemporaine\~WRL0001.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0016.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0165.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0404.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0454.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0492.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0527.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0603.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0607.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0651.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0773.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0817.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0876.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0933.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL0963.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1060.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1132.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1193.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1206.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1263.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1285.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1286.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1432.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1564.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1623.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1639.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1678.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1703.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1758.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL1958.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2018.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2054.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2107.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2208.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2331.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2357.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2394.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2412.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2493.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2645.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2713.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2741.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2773.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2892.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2930.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL2994.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3011.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3032.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3063.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3065.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3154.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3370.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3580.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3599.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3646.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3858.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3875.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3901.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3908.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3918.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL3964.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL4058.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Dossier final\~WRL4096.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Plan de d‚part\~WRL1176.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Plan de d‚part\~WRL1342.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Plan de d‚part\~WRL1481.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Plan de d‚part\~WRL2385.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Plan de d‚part\~WRL4085.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\dossier 2e semestre\Sources documentaires\~WRL0004.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL0290.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL0693.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL1282.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL1972.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL2040.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Dossier de recherche sem1\~WRL3414.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL0173.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL0876.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL1301.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL1918.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL2717.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL2729.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL3038.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL3041.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 1 Com'\Master 2005-06\Dossier Collectivit‚s locales\Dossier fin\~WRL3184.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0002.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0018.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0033.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0038.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0237.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0420.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0511.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0578.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL0643.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL1517.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL1585.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL1716.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL1792.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL1897.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2040.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2161.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2227.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2247.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2253.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2304.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2427.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2439.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2731.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2752.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL2825.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3079.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3080.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3100.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3148.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3182.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3193.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3250.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3329.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3383.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3465.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3477.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3719.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3723.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3750.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL3880.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\~WRL4015.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL0001.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL0003.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL0004.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL0240.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL1089.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL1904.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL2049.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL2633.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL2763.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL3525.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL3803.tmp
C:\Documents and Settings\am‚lie\Mes documents\Master 2 MPE\Stage Fin ‚tudes\~WRL3815.tmp
C:\Documents and Settings\am‚lie\Mes documents\Professionnel\~WRL0003.tmp
C:\Documents and Settings\am‚lie\Mes documents\Professionnel\~WRL1911.tmp
C:\Documents and Settings\am‚lie\Mes documents\Professionnel\~WRL3604.tmp
C:\Documents and Settings\am‚lie\Mes documents\Professionnel\lettres de motivation 2005\~WRL0003.tmp
C:\Documents and Settings\am‚lie\Mes documents\Professionnel\lettres de motivation 2005\~WRL1468.tmp
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\b4248c4c189bf5460d6eb98122ea18be\BITB.tmp

Finished

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 26/05/2007 a 19:58:32,62

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32

*** Suppression des fichiers dans C:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !

Logfile of HijackThis v1.99.1
Scan saved at 13:40:37, on 27/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cleanmgr.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gericom.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.Siirde.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.Siirde.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elmaliseker.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.Siirde.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iexpl] C:\WINDOWS\System32\iexpl.exe
O4 - HKLM\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Update] C:\Program Files\AntiVir PersonalEdition Classic\preupd.exe /CALLSCHEDULER /DM="0"

Apparamment c'était trop long pour un post...

Je recommence à partir d'hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 13:40:37, on 27/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cleanmgr.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gericom.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.Siirde.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.Siirde.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elmaliseker.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.Siirde.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [iexpl] C:\WINDOWS\System32\iexpl.exe
O4 - HKLM\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Update] C:\Program Files\AntiVir PersonalEdition Classic\preupd.exe /CALLSCHEDULER /DM="0" /CALLSCHEDULER
O4 - HKCU\..\Run: [iexpl] C:\WINDOWS\System32\iexpl.exe
O4 - HKCU\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Home Prefix: http://www.elmaliseker.net
O14 - IERESET.INF: START_PAGE_URL=http://www.gericom.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://amelieleb.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe

QUelques petites remarques :
- Je ne suis pas sûr que le "clean" ait marché, il est resté bloqué des heures sur le nettoyage de disque pour gagner de l'espace, j'ai dû sauter cette étape.
- Les scans antivir et SVG ont été fait avec les versions non mises à jour puisqu'on ne peut pas mettre à jour avec les ports fermés par le programme worms cleaner. A ce propos : quel port faut-il ouvrir pour permettre les maj ? Une fois un firewall installé, on peut les réouvrir ?
- Les maj windows ont été désactivées par mon amie : je suppose que j'ai intéret à les réactiver, et à télécharger tous les correctifs qu'il lui manque ?

En tous cas ça à l'air pratiquement clean, ça ne rame plus, et mIRC ne se lance plus ! Merci énormément !!
J'attends voir s'il y a encore des bricoles à faire, et si tu as quelques autres conseils à me donner pour que ça ne se reproduise plus

Tu es encore infecté..

La machine n'est pas à jour donc vulnérable.... il faut un firewal...
T'as pas installé ZoneAlarm...

Fais le et poste un nouveau rapport HijackThis..

Logfile of HijackThis v1.99.1
Scan saved at 17:04:56, on 27/05/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\iexpl.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\absecure32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gericom.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.Siirde.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.Siirde.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elmaliseker.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://recherche.neuf.fr/ie/default.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.Siirde.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iexpl] C:\WINDOWS\System32\iexpl.exe
O4 - HKLM\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [iexpl] C:\WINDOWS\System32\iexpl.exe
O4 - HKCU\..\Run: [Office Monitor Secure Systema] C:\WINDOWS\System32\absecure32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Home Prefix: http://www.elmaliseker.net
O14 - IERESET.INF: START_PAGE_URL=http://www.gericom.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://amelieleb.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: ¾2:¡/
wù:GŸ·siÖ (€?
) - Unknown owner - C:\WINDOWS\iexplor.exe (file missing)



Voilà