Virus étrange (indétectable)BLOQUE MON SYSTEMFermé

Question

Bonjour, 

Jai chopé un virus en instalent un logiciel bidon et depui les chosse se resemble pas mal..

en bref tout d'abor durant l'instalation mon coupe feu ma averti si je voulai partir le fichier .exe

jai autorisé mais apres un procesus win32 est parti pui jai tout de suite blocké et suprimé sans savoir quesque cetais..

Apres avoir redémaré mon pc la premiere chose qui c'est passer apres le chargement de windows:L'instruction a ''0x006103b7'' emplois l'adresse mémoire ..0x00610367''.La mémoir ne peut pas etre ''written'' (ok, annulé ou recommencé)

Apres 10 fois ''ok'' l'ecran d'ouverture de session est apparu en petit en haut sous le nom de hp_administrateur.

Jai écrit mon code je suis rentré et encor une fois  L'instruction a ''0x006103b7'' emplois l'adresse mémoire ..0x00610367''.La mémoir ne peut pas etre ''written'' (ok, annulé ou recommencé)

mais cette fois si jai clic q'une seul fois et je suis apparu dans mon bureau (enfin il y avait rien).

Immidiatement une fenetre ses ouvert est voila se qui estais écrit:Prévention de l'exécution des données Microsoft Windows
Pour protéger votre ordinateur,windows a fermé ce programme.
nom:Application d'ouverture de session ''Userinit''

Il y a eu une ecrant de rapportage d'érreur et apres... rien

J'ai redémaré mon pc et encor une fois les 10 message erreur ....mais une fois rendu sur ma session tout est apparu.

Tout semblai etre normal .. jai tout de suite restoré mon pc a 5 jour avant et en redémarent mon pc mon bureau na jamais apparu.

Donc 1 fois sur 2 sa fonctionne

Pendent tout se temp jai scanner mon pc de fond en comble et jamais rien trouvé ..jai pu remarqué que tout marchai normalement a par quand jai voulu utilisé PC-Doctor 5 for windows .. 'Veuillez vous assurer que vous avez une licence valide pour cette copie de PC-Doctor 5 for windows' S'affichai .

J'ai donc désider de réinstaler mon pc mais en activant systeme ricovry apres le chargement lecran devien bleu et s'affiche se message:The windows logon process systeme process terminated unxpextedly with a status of 0x00000080 (0x0000000 0x00000000).
The system has been shut down.

Logfile of HijackThis v1.99.1
Scan saved at 16:23:51, on 2007-10-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSAComHandler.exe
C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32
otepad.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\pkR.dll
O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {E691ECB7-D50E-7FF6-C56F-90E8149BCA85} - (no file)
O2 - BHO: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [Services de sécurité Vidéotron] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - 
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babyblue048.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Service de mise a jour pour Services de sécurité Vidéotron (RPSUpdaterR) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
O23 - Service: Services de sécurité Vidéotron Coupe-feu (RP_FWS) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe

Merci si vous pouvez maidé et m'indiqué quoi faire sa serrai super apprécier!!
et désolé pour les multiples fautes !!

stitchda62 · Answer

Slt, 

à supprimer : 
 	C:\WINDOWS\ALCXMNTR.EXE
 	O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

tu as un programme aussi, Videotron qui est considéré comme un troyen, si tu n'es pas sûr de ce programme il vaut mieux le désinstaller !

++

Oliver · Answer

sa va c'est un anti virus qui d'ailleur me coute plus de 10 euro par mois ><

Oliver · Answer

Re stitchda62, jai fait comme tu ma dit.. jai suprimé les 2 exe que tu ma précisé mais a chaque fois que je redemare mon pc ..meme chose mais le Alcxmonitor reste suprimé mais pas le ALCXMNTR.exe .. a chaque fois il revien .. mon pc a encor le meme probleme !! quelque chose dotre a faire ?

Oliver · Answer

Voici a nouveau le rapport hijack

Logfile of HijackThis v1.99.1
Scan saved at 20:15:35, on 2007-10-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSAComHandler.exe
C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\pkR.dll
O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {E691ECB7-D50E-7FF6-C56F-90E8149BCA85} - (no file)
O2 - BHO: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [Services de sécurité Vidéotron] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - 
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babyblue048.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O20 - AppInit_DLLs: MsgPlusLoader.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Service de mise a jour pour Services de sécurité Vidéotron (RPSUpdaterR) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
O23 - Service: Services de sécurité Vidéotron Coupe-feu (RP_FWS) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe

Oliver · Answer

Bonjour, 
 Est t'il possible que se soit se virus?:W32/Maddis-A

Pourtant .. jai un bon antivirus et il ne trouve rien.

Merci pour de l'aide!!

JADAred · Answer

slt.. enfin non je croi pas que sa soit sa (c'est un vert) !! oubli sa sa rien a voir c'est plus que sa ..
je connai pas trop mais jen c'est asser pour dire que sa rien avoir ton truc ;p

FOrZA.Zz · Answer

Moi non plus je connai pas tout la gamme de virus mais jai deja entendu parlé de sa un de mais pote a dropp sa sur un site crack mais cetais pas same enfaite cetais pas comme sa mais dans la meme game.....
moi je te conseille de refaire l'analize sa crain

good luck!!!!!

stitchda62 · Answer

Dans ton rapport je vois toujours les erreurs que je t'ai montré plus tôt... essaie un scan avec Spybot et Ccleaner

++

Oliver · Answer

A chaque fois je doit reboot mon systeme il ne s'efface pas et en plus spybot donne rien je lavai deja de plus que cccleaner ,tune up utility2007, registry cleaner et perfecttoolsxp2

il y a surment quelque chose a faire .. pour accedé a mon bureau je doit fair echap au debut et pesser enter sur le premier onglet pour pouvoir aller sur mon bureau ... ses pas un virus mutant mais il et chiant aidé moi svp..

JADAred · Answer

tu devrai peut etre installer un otre antivirus com avg ...si ton pc continu a fonctionné normalement a chaque reboot c'est surment un genre de ver en tout cas ses pas normal que ton atv le repere pas et ni meme spybot ni faise rien !!

Oliver · Answer

Re.. jai tout fait pour se ALCXMNTR.EXE 

mais il s'efface mais meme apres le processus ALCXMNTR.EXE 

 marche toujour!! enfaite a present quand je suis rendu a la fenetre qui m'indique que windows bloque lacces Userinit..je ferme et rendu a lecran noir je pese ctrl+alt+supp a ma gestion de tache j'ouvre ''bureau'' et jai mon bureau a part il y a un pti message erreur de idlist menquan sinon sa marche mais a chaque fois .SI quelqun peut maidé serai super aprécier!!

Oliver · Answer

svvvp

green day · Answer

Salut

 ALCXMNTR.EXE n'est pas méchant, tu peux le laisser !

Télécharge SDFix sur ton bureau 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
Redémarre ton ordinateur en mode sans échec 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

++

Oliver · Answer

Salut green day et merci !! enfin voila j'ai fait se que tu ma demendé tout a marché correctement .
J'ai aucune idée de se qui c'est passer mais tout et redevenu comme normalement mais je te fait les rapport:

voila le report :

SDFix: Version 1.112

Run by HP_Administrateur on 2007-10-26 at 12:22

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\HP_ADM~1\Bureau\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

(jai jamais trouvé le report.txt)

voila hijack:


Logfile of HijackThis v1.99.1
Scan saved at 13:27:49, on 2007-10-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSAComHandler.exe
C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {E691ECB7-D50E-7FF6-C56F-90E8149BCA85} - (no file)
O2 - BHO: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [Services de sécurité Vidéotron] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - 
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babyblue048.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Service de mise a jour pour Services de sécurité Vidéotron (RPSUpdaterR) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
O23 - Service: Services de sécurité Vidéotron Coupe-feu (RP_FWS) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe

Merci en tout cas ! enfaite le virus serai t'il encor présent meme si les valeur d'origine son remis? ou tout est simplement suprimé!??

green day · Answer

ok, c'est pas encore tout à fait fini !

 on va voir ce qu'il reste ;-)

 fais ce qui est indiqué ici stp : http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

++

Oliver · Answer

Bitdefender a effacer hijackthis mon defrag et toute sorte de truc et je suis incapable de réinstaler ..quesque je fait?

green day · Answer

Pas compris !
 
désinstaller des programmes ???


++

Oliver · Answer

tout va je scan et je mais les 2 rapport bientot mais ses juste que dans bitdefender le san sur le net il a effacer des programmes bon comme hijackthis mais la jai réesintal donc je fait q'un scan je mais le rapport et j'en fait un de hijack pui tu me dira se qui en est merci ;)

Oliver · Answer

le voila :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:32, on 2007-10-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\pkR.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ZKBho Class - {56071E0D-C61B-11D3-B41C-00E02927A304} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {E691ECB7-D50E-7FF6-C56F-90E8149BCA85} - (no file)
O2 - BHO: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: virtualdj_radio toolbar - {edc4bb0f-17ae-4488-bc8c-6181c5395c52} - C:\Program Files\virtualdj_radio	bvirt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [VideotronSA.exe] "C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" /AUTORUN
O4 - HKLM\..\Run: [Services de sécurité Vidéotron] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe"
O4 - HKLM\..\Run: [-FreedomNeedsReboot] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe"
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [IndexCleaner] "C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - 
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.serviceshub.microsoft.com/supportforbusiness/create
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - https://www.fileplanet.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://babyblue048.spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://www.gamespy.com
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Fichiers communs\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Service de mise a jour pour Services de sécurité Vidéotron (RPSUpdaterR) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité VidéotronpsupdaterR.exe
O23 - Service: Services de sécurité Vidéotron Coupe-feu (RP_FWS) - Vidéotron - C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Fws.exe

green day · Answer

le rapport d'avg et du scan en ligne, ils sont où ??? :))

++

Oliver · Answer

AVG anti spyware est rempli de VIRUS .. jai moi meme éffectuer un scan avec mon anti spyware et jai supprimé 9 spyware asser bizar sinon pour le san en ligne je copi cole le lien html??

green day · Answer

il fallait poster les deux rapports ! :-)

si tu as le rapport du scan en ligne, poste le stp

++

Oliver · Answer

voila : BitDefender Online Scanner	
 	
 

Scan report generated at: Fri, Oct 26, 2007 - 18:04:23

 	
 	
 

Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;	
 	
 

 	
 	
 

Statistics

Time	
00:46:45

Files	
283644

Folders	
6502

Boot Sectors	
3

Archives	
15711

Packed Files	
14023
	
 	
 

Results

Identified Viruses 	
2599

Infected Files 	
9808

Suspect Files 	
0

Warnings	
0

Disinfected	
0

Deleted Files	
0
	
 	
 

Engines Info

Virus Definitions	
858323

Engine build	
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins	
14

Archive plugins	
38

Unpack plugins	
7

E-mail plugins	
6

System plugins	
1
	
 	
 

Scan Settings

First Action	
Report

Second Action	
__SECACT__

Heuristics	
Yes

Enable Warnings	
Yes

Scanned Extensions	
*;

Exclude Extensions	
 

Scan Emails	
Yes

Scan Archives	
Yes

Scan Packed	
Yes

Scan Files	
Yes

Scan Boot	
Yes
	
 	
 
  
Scanned File	
 Status

C:\Documents and Settings\HP_Administrateur\Bureau\JkDefrag-3.16\JkDefrag.exe	
Infected with: Win32.Virtob.6.Gen

C:\Documents and Settings\HP_Administrateur\Bureau\JkDefrag-3.16\JkDefragCmd.exe	
Infected with: Win32.Virtob.6.Gen

C:\Documents and Settings\HP_Administrateur\Bureau\JkDefrag-3.16\JkDefragScreenSaver.exe	
Infected with: Win32.Virtob.6.Gen

C:\Documents and Settings\HP_Administrateur\Bureau\JkDefrag-3.16\JkDefragScreenSaver.scr	
Infected with: Win32.Virtob.6.Gen

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\J6SJU9Z1\kler[1].exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\AddDevicePath.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\ASK.EXE	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\automod32.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\autorun.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\CleanRec.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\cloaker.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\commands.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\DM.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Eject.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\FindWindow.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\finis.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\FullScreen.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\FullScreen.htm	
Infected with: Generic.Virtob.1.336A5454

C:\hp\bin\FullScreen2.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\HPBI.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\HPCONTXT.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\HPLocale.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\HtmlMsg.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\IniMerge.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Is64OS.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\IsRunning.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\KillIt.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\KillWind.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Locale.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\MsgAction.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\OSType.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\PE_Patch.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\ProcessLogger.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Progress.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\RefCount.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\RPCOPY.EXE	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\SendKey.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\SetIni.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\SetRes.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Sleep.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\Spawn.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\TransientMessage.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\bin\UIni.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\audio_realtek\Alcxmntr.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\audio_realtek\RTLCPL.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\audio_realtek\SoundMan.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\keyboard\PS2.EXE	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\LightScribe\DA\LSUpdate.htm	
Infected with: Generic.Virtob.1.AEE986EB

C:\hp\drivers\LightScribe\DE\LSUpdate.htm	
Infected with: Generic.Virtob.1.2673A0AB

C:\hp\drivers\LightScribe\EN_US\LSUpdate.htm	
Infected with: Generic.Virtob.1.10C7E659

C:\hp\drivers\LightScribe\ES\LSUpdate.htm	
Infected with: Generic.Virtob.1.F8DA0227

C:\hp\drivers\LightScribe\ES_ES\LSUpdate.htm	
Infected with: Generic.Virtob.1.F8DA0227

C:\hp\drivers\LightScribe\ES_MX\LSUpdate.htm	
Infected with: Generic.Virtob.1.2C62B314

C:\hp\drivers\LightScribe\FI\LSUpdate.htm	
Infected with: Generic.Virtob.1.AC28AD70

C:\hp\drivers\LightScribe\FR\LSUpdate.htm	
Infected with: Generic.Virtob.1.D6248C8C

C:\hp\drivers\LightScribe\FR_CA\LSUpdate.htm	
Infected with: Generic.Virtob.1.36137CC6

C:\hp\drivers\LightScribe\FR_FR\LSUpdate.htm	
Infected with: Generic.Virtob.1.D6248C8C

C:\hp\drivers\LightScribe\IT\LSUpdate.htm	
Infected with: Generic.Virtob.1.6E7F48B9

C:\hp\drivers\LightScribe\KO_KR\LSUpdate.htm	
Infected with: Generic.Virtob.1.6E2F180A

C:\hp\drivers\LightScribe\NL\LSUpdate.htm	
Infected with: Generic.Virtob.1.AC3353BB

C:\hp\drivers\LightScribe\NO\LSUpdate.htm	
Infected with: Generic.Virtob.1.626BABD5

C:\hp\drivers\LightScribe\PT\LSUpdate.htm	
Infected with: Generic.Virtob.1.DF79FA9F

C:\hp\drivers\LightScribe\SV\LSUpdate.htm	
Infected with: Generic.Virtob.1.296007EB

C:\hp\drivers\LightScribe\UK\LSUpdate.htm	
Infected with: Generic.Virtob.1.10C7E659

C:\hp\drivers\LightScribe\ZH_CN\LSUpdate.htm	
Infected with: Generic.Virtob.1.C9A55335

C:\hp\drivers\LightScribe\ZH_HK\LSUpdate.htm	
Infected with: Generic.Virtob.1.ED4FFD80

C:\hp\drivers\LightScribe\ZH_TW\LSUpdate.htm	
Infected with: Generic.Virtob.1.ED4FFD80

C:\hp\drivers\modem_Agere_Sequoia_Redwood\agrsmdel.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\Modem_Conexant\HXFSetup.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\CopyInf.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\hpbvspst.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\hpzglu10.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\install.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\program files\HP\Digital Imaging\bin\hpqpprop.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\program files\HP\hp deskjet 3740 series\1033\enueadme.html	
Infected with: Generic.Virtob.1.7E603B7B

C:\hp\drivers\printers\deskjet\program files\HP\hp deskjet 3840 series\1033\enueadme.html	
Infected with: Generic.Virtob.1.2F57F034

C:\hp\drivers\printers\deskjet\program files\HP\hp deskjet 3840 series\START.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\setup.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\util\common\hpfpdi10.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\util\common\hpzghl10.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\printers\deskjet\util\common\hpzpin10.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\TVTuner_Hauppauge_WinTV_PVR_PCI_II\HcwDriverInstall.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\drivers\video_ATI_UMA\CPanel\Setup.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\CreateVF.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\Help.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\Install.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\kbd.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\KBUPDATE.EXE	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBDunHSC.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\RunReg.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\STATIC\AR\buttonconfig.htm	
Infected with: Generic.Virtob.1.D0B71D68

C:\hp\KBD\STATIC\AR\Chat.htm	
Infected with: Generic.Virtob.1.1387964A

C:\hp\KBD\STATIC\AR\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\AR\Copy of HP.htm	
Infected with: Generic.Virtob.1.FB29508D

C:\hp\KBD\STATIC\AR\email.htm	
Infected with: Generic.Virtob.1.0054B109

C:\hp\KBD\STATIC\AR\Entertainment.htm	
Infected with: Generic.Virtob.1.9CFFA0C4

C:\hp\KBD\STATIC\AR\Finance.htm	
Infected with: Generic.Virtob.1.30DE7BAC

C:\hp\KBD\STATIC\AR\help.htm	
Infected with: Generic.Virtob.1.110D13A3

C:\hp\KBD\STATIC\AR\HP.htm	
Infected with: Generic.Virtob.1.0E1FB418

C:\hp\KBD\STATIC\AR\People.htm	
Infected with: Generic.Virtob.1.5D6CF8B6

C:\hp\KBD\STATIC\AR\Search.htm	
Infected with: Generic.Virtob.1.A51E5968

C:\hp\KBD\STATIC\AR\Shopping.htm	
Infected with: Generic.Virtob.1.F426ED30

C:\hp\KBD\STATIC\AR\Sports.htm	
Infected with: Generic.Virtob.1.10C7E7AF

C:\hp\KBD\STATIC\AR\video.htm	
Infected with: Generic.Virtob.1.CF8E7090

C:\hp\KBD\STATIC\AR\weather.htm	
Infected with: Generic.Virtob.1.7A0B1559

C:\hp\KBD\STATIC\buttonconfig.htm	
Infected with: Generic.Virtob.1.58590A9A

C:\hp\KBD\STATIC\Common\hpkey.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\KBD\STATIC\DA\buttonconfig.htm	
Infected with: Generic.Virtob.1.FBB670EF

C:\hp\KBD\STATIC\DA\Chat.htm	
Infected with: Generic.Virtob.1.F111D666

C:\hp\KBD\STATIC\DA\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\DA\email.htm	
Infected with: Generic.Virtob.1.325504FC

C:\hp\KBD\STATIC\DA\Entertainment.htm	
Infected with: Generic.Virtob.1.FB12FC19

C:\hp\KBD\STATIC\DA\Finance.htm	
Infected with: Generic.Virtob.1.78AB8831

C:\hp\KBD\STATIC\DA\help.htm	
Infected with: Generic.Virtob.1.FFB51405

C:\hp\KBD\STATIC\DA\HP.htm	
Infected with: Generic.Virtob.1.DE5C9F9E

C:\hp\KBD\STATIC\DA\People.htm	
Infected with: Generic.Virtob.1.840FFA5C

C:\hp\KBD\STATIC\DA\Search.htm	
Infected with: Generic.Virtob.1.742DE7AA

C:\hp\KBD\STATIC\DA\Shopping.htm	
Infected with: Generic.Virtob.1.216F7A82

C:\hp\KBD\STATIC\DA\Sports.htm	
Infected with: Generic.Virtob.1.10D16499

C:\hp\KBD\STATIC\DA\weather.htm	
Infected with: Generic.Virtob.1.201A3C21

C:\hp\KBD\STATIC\DE\buttonconfig.htm	
Infected with: Generic.Virtob.1.0535B488

C:\hp\KBD\STATIC\DE\chat.htm	
Infected with: Generic.Virtob.1.C5055DF4

C:\hp\KBD\STATIC\DE\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\DE\email.htm	
Infected with: Generic.Virtob.1.2AA6DA4A

C:\hp\KBD\STATIC\DE\Entertainment.htm	
Infected with: Generic.Virtob.1.EABBB05B

C:\hp\KBD\STATIC\DE\Finance.htm	
Infected with: Generic.Virtob.1.805320A0

C:\hp\KBD\STATIC\DE\help.htm	
Infected with: Generic.Virtob.1.B9B28F76

C:\hp\KBD\STATIC\DE\HP.htm	
Infected with: Generic.Virtob.1.C14E1F2B

C:\hp\KBD\STATIC\DE\People.htm	
Infected with: Generic.Virtob.1.2F0A6E9F

C:\hp\KBD\STATIC\DE\Search.htm	
Infected with: Generic.Virtob.1.794CEA42

C:\hp\KBD\STATIC\DE\Shopping.htm	
Infected with: Generic.Virtob.1.3FE21664

C:\hp\KBD\STATIC\DE\Sports.htm	
Infected with: Generic.Virtob.1.9AA80711

C:\hp\KBD\STATIC\EN\buttonconfig.htm	
Infected with: Generic.Virtob.1.58590A9A

C:\hp\KBD\STATIC\EN\Chat.htm	
Infected with: Generic.Virtob.1.1387964A

C:\hp\KBD\STATIC\EN\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\EN\email.htm	
Infected with: Generic.Virtob.1.0054B109

C:\hp\KBD\STATIC\EN\Entertainment.htm	
Infected with: Generic.Virtob.1.9CFFA0C4

C:\hp\KBD\STATIC\EN\Finance.htm	
Infected with: Generic.Virtob.1.30DE7BAC

C:\hp\KBD\STATIC\EN\help.htm	
Infected with: Generic.Virtob.1.110D13A3

C:\hp\KBD\STATIC\EN\HP.htm	
Infected with: Generic.Virtob.1.0E1FB418

C:\hp\KBD\STATIC\EN\People.htm	
Infected with: Generic.Virtob.1.5D6CF8B6

C:\hp\KBD\STATIC\EN\Search.htm	
Infected with: Generic.Virtob.1.A51E5968

C:\hp\KBD\STATIC\EN\Shopping.htm	
Infected with: Generic.Virtob.1.F426ED30

C:\hp\KBD\STATIC\EN\Sports.htm	
Infected with: Generic.Virtob.1.10C7E7AF

C:\hp\KBD\STATIC\EN\video.htm	
Infected with: Generic.Virtob.1.CF8E7090

C:\hp\KBD\STATIC\EN\weather.htm	
Infected with: Generic.Virtob.1.7A0B1559

C:\hp\KBD\STATIC\ES\buttonconfig.htm	
Infected with: Generic.Virtob.1.FA3AAF2E

C:\hp\KBD\STATIC\ES\Chat.htm	
Infected with: Generic.Virtob.1.113B131C

C:\hp\KBD\STATIC\ES\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\ES\email.htm	
Infected with: Generic.Virtob.1.99C48158

C:\hp\KBD\STATIC\ES\Entertainment.htm	
Infected with: Generic.Virtob.1.2A881F7C

C:\hp\KBD\STATIC\ES\Finance.htm	
Infected with: Generic.Virtob.1.B60DA122

C:\hp\KBD\STATIC\ES\help.htm	
Infected with: Generic.Virtob.1.09F215E6

C:\hp\KBD\STATIC\ES\HP.htm	
Infected with: Generic.Virtob.1.A3F66954

C:\hp\KBD\STATIC\ES\People.htm	
Infected with: Generic.Virtob.1.8D0A4E17

C:\hp\KBD\STATIC\ES\Search.htm	
Infected with: Generic.Virtob.1.CC599D84

C:\hp\KBD\STATIC\ES\Shopping.htm	
Infected with: Generic.Virtob.1.D59067C5

C:\hp\KBD\STATIC\ES\sports.htm	
Infected with: Generic.Virtob.1.9A5C479E

C:\hp\KBD\STATIC\FI\buttonconfig.htm	
Infected with: Generic.Virtob.1.21E55BD5

C:\hp\KBD\STATIC\FI\Chat.htm	
Infected with: Generic.Virtob.1.C9059345

C:\hp\KBD\STATIC\FI\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\FI\email.htm	
Infected with: Generic.Virtob.1.09E972C1

C:\hp\KBD\STATIC\FI\Entertainment.htm	
Infected with: Generic.Virtob.1.5BA7832A

C:\hp\KBD\STATIC\FI\Finance.htm	
Infected with: Generic.Virtob.1.D45695BB

C:\hp\KBD\STATIC\FI\help.htm	
Infected with: Generic.Virtob.1.95CAD3A4

C:\hp\KBD\STATIC\FI\HP.htm	
Infected with: Generic.Virtob.1.060D7994

C:\hp\KBD\STATIC\FI\People.htm	
Infected with: Generic.Virtob.1.0249D3A3

C:\hp\KBD\STATIC\FI\Search.htm	
Infected with: Generic.Virtob.1.6FA64D75

C:\hp\KBD\STATIC\FI\Shopping.htm	
Infected with: Generic.Virtob.1.0D267319

C:\hp\KBD\STATIC\FI\Sports.htm	
Infected with: Generic.Virtob.1.C22F2347

C:\hp\KBD\STATIC\FI\weather.htm	
Infected with: Generic.Virtob.1.8BA1A935

C:\hp\KBD\STATIC\FR\buttonconfig.htm	
Infected with: Generic.Virtob.1.8656672C

C:\hp\KBD\STATIC\FR\chat.htm	
Infected with: Generic.Virtob.1.8D33E632

C:\hp\KBD\STATIC\FR\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\FR\email.htm	
Infected with: Generic.Virtob.1.1D30C84B

C:\hp\KBD\STATIC\FR\Entertainment.htm	
Infected with: Generic.Virtob.1.443478B7

C:\hp\KBD\STATIC\FR\Finance.htm	
Infected with: Generic.Virtob.1.CB29B3BA

C:\hp\KBD\STATIC\FR\help.htm	
Infected with: Generic.Virtob.1.34A901A6

C:\hp\KBD\STATIC\FR\HP.htm	
Infected with: Generic.Virtob.1.30077DDE

C:\hp\KBD\STATIC\FR\News.htm	
Infected with: Generic.Virtob.1.404612A0

C:\hp\KBD\STATIC\FR\People.htm	
Infected with: Generic.Virtob.1.B9C5F658

C:\hp\KBD\STATIC\FR\Search.htm	
Infected with: Generic.Virtob.1.AF208C85

C:\hp\KBD\STATIC\FR\Shopping.htm	
Infected with: Generic.Virtob.1.68C5DFEF

C:\hp\KBD\STATIC\FR\sports.htm	
Infected with: Generic.Virtob.1.7E43886F

C:\hp\KBD\STATIC\FR\Weather.htm	
Infected with: Generic.Virtob.1.0D0F4998

C:\hp\KBD\STATIC\FR_CA\buttonconfig.htm	
Infected with: Generic.Virtob.1.8656672C

C:\hp\KBD\STATIC\FR_CA\Chat.htm	
Infected with: Generic.Virtob.1.8D33E632

C:\hp\KBD\STATIC\FR_CA\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\FR_CA\Email.htm	
Infected with: Generic.Virtob.1.1D30C84B

C:\hp\KBD\STATIC\FR_CA\Entertainment.htm	
Infected with: Generic.Virtob.1.443478B7

C:\hp\KBD\STATIC\FR_CA\Finance.htm	
Infected with: Generic.Virtob.1.CB29B3BA

C:\hp\KBD\STATIC\FR_CA\help.htm	
Infected with: Generic.Virtob.1.34A901A6

C:\hp\KBD\STATIC\FR_CA\HP.htm	
Infected with: Generic.Virtob.1.3F73BA31

C:\hp\KBD\STATIC\FR_CA\News.htm	
Infected with: Generic.Virtob.1.404612A0

C:\hp\KBD\STATIC\FR_CA\People.htm	
Infected with: Generic.Virtob.1.B9C5F658

C:\hp\KBD\STATIC\FR_CA\Search.htm	
Infected with: Generic.Virtob.1.AF208C85

C:\hp\KBD\STATIC\FR_CA\Shopping.htm	
Infected with: Generic.Virtob.1.8CD2AAF8

C:\hp\KBD\STATIC\FR_CA\Sports.htm	
Infected with: Generic.Virtob.1.7E43886F

C:\hp\KBD\STATIC\FR_CA\Weather.htm	
Infected with: Generic.Virtob.1.0D0F4998

C:\hp\KBD\STATIC\IT\buttonconfig.htm	
Infected with: Generic.Virtob.1.D8D30B32

C:\hp\KBD\STATIC\IT\Chat.htm	
Infected with: Generic.Virtob.1.1FC88B8B

C:\hp\KBD\STATIC\IT\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\IT\email.htm	
Infected with: Generic.Virtob.1.0EDD9C81

C:\hp\KBD\STATIC\IT\Finance.htm	
Infected with: Generic.Virtob.1.250DFC7E

C:\hp\KBD\STATIC\IT\help.htm	
Infected with: Generic.Virtob.1.E6EC9621

C:\hp\KBD\STATIC\IT\HP.htm	
Infected with: Generic.Virtob.1.F0F5EFFA

C:\hp\KBD\STATIC\IT\Search.htm	
Infected with: Generic.Virtob.1.0EBFD832

C:\hp\KBD\STATIC\IT\Shopping.htm	
Infected with: Generic.Virtob.1.C4769EA9

C:\hp\KBD\STATIC\IT\Sports.htm	
Infected with: Generic.Virtob.1.C7D15F71

C:\hp\KBD\STATIC\JA\Chat.htm	
Infected with: Generic.Virtob.1.31D1CAE6

C:\hp\KBD\STATIC\JA\Connect.htm	
Infected with: Generic.Virtob.1.B186BF67

C:\hp\KBD\STATIC\JA\email.htm	
Infected with: Generic.Virtob.1.B22D106C

C:\hp\KBD\STATIC\JA\Finance.htm	
Infected with: Generic.Virtob.1.EA5B44F3

C:\hp\KBD\STATIC\JA\HP.htm	
Infected with: Generic.Virtob.1.2C870430

C:\hp\KBD\STATIC\JA\Search.htm	
Infected with: Generic.Virtob.1.61F52C4C

C:\hp\KBD\STATIC\JA\Shopping.htm	
Infected with: Generic.Virtob.1.CB8AE85A

C:\hp\KBD\STATIC\JA\Sports.htm	
Infected with: Generic.Virtob.1.89CF6D07

C:\hp\KBD\STATIC\KO\buttonconfig.htm	
Infected with: Generic.Virtob.1.CD0B45F8

C:\hp\KBD\STATIC\KO\Chat.htm	
Infected with: Generic.Virtob.1.F047EBE1

C:\hp\KBD\STATIC\KO\Connect.htm	
Infected with: Generic.Virtob.1.B186BF67

C:\hp\KBD\STATIC\KO\email.htm	
Infected with: Generic.Virtob.1.D73DD7DD

C:\hp\KBD\STATIC\KO\Finance.htm	
Infected with: Generic.Virtob.1.47BAEE8F

C:\hp\KBD\STATIC\KO\help.htm	
Infected with: Generic.Virtob.1.BC7EB2AD

C:\hp\KBD\STATIC\KO\HP.htm	
Infected with: Generic.Virtob.1.90BA6106

C:\hp\KBD\STATIC\KO\Search.htm	
Infected with: Generic.Virtob.1.BBBBE442

C:\hp\KBD\STATIC\KO\Shopping.htm	
Infected with: Generic.Virtob.1.934E5C3A

C:\hp\KBD\STATIC\KO\Sports.htm	
Infected with: Generic.Virtob.1.8DE8E0F5

C:\hp\KBD\STATIC\NB\buttonconfig.htm	
Infected with: Generic.Virtob.1.3AEB052E

C:\hp\KBD\STATIC\NB\Chat.htm	
Infected with: Generic.Virtob.1.F6D329F8

C:\hp\KBD\STATIC\NB\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\NB\email.htm	
Infected with: Generic.Virtob.1.9B4E856C

C:\hp\KBD\STATIC\NB\Entertainment.htm	
Infected with: Generic.Virtob.1.589ECE11

C:\hp\KBD\STATIC\NB\Finance.htm	
Infected with: Generic.Virtob.1.C6AF8C84

C:\hp\KBD\STATIC\NB\help.htm	
Infected with: Generic.Virtob.1.D7E3891F

C:\hp\KBD\STATIC\NB\HP.htm	
Infected with: Generic.Virtob.1.B5A05CA6

C:\hp\KBD\STATIC\NB
ews.htm	
Infected with: Generic.Virtob.1.2213E89B

C:\hp\KBD\STATIC\NB\Search.htm	
Infected with: Generic.Virtob.1.D3EE2778

C:\hp\KBD\STATIC\NB\Shopping.htm	
Infected with: Generic.Virtob.1.26A9EFC7

C:\hp\KBD\STATIC\NB\Sports.htm	
Infected with: Generic.Virtob.1.27FC1E2D

C:\hp\KBD\STATIC\NB\weather.htm	
Infected with: Generic.Virtob.1.28E3ED81

C:\hp\KBD\STATIC\NL\buttonconfig.htm	
Infected with: Generic.Virtob.1.6D6DF7C8

C:\hp\KBD\STATIC\NL\Chat.htm	
Infected with: Generic.Virtob.1.CA04157F

C:\hp\KBD\STATIC\NL\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\NL\email.htm	
Infected with: Generic.Virtob.1.FFAABFC4

C:\hp\KBD\STATIC\NL\Entertainment.htm	
Infected with: Generic.Virtob.1.CC64F0F6

C:\hp\KBD\STATIC\NL\Finance.htm	
Infected with: Generic.Virtob.1.4F14D807

C:\hp\KBD\STATIC\NL\help.htm	
Infected with: Generic.Virtob.1.54388314

C:\hp\KBD\STATIC\NL\HP.htm	
Infected with: Generic.Virtob.1.138CA20F

C:\hp\KBD\STATIC\NL
ews.htm	
Infected with: Generic.Virtob.1.7C15BF3F

C:\hp\KBD\STATIC\NL\Search.htm	
Infected with: Generic.Virtob.1.A79A8D2A

C:\hp\KBD\STATIC\NL\Shopping.htm	
Infected with: Generic.Virtob.1.710D1AF3

C:\hp\KBD\STATIC\NL\Sports.htm	
Infected with: Generic.Virtob.1.F8D93409

C:\hp\KBD\STATIC\NL\weather.htm	
Infected with: Generic.Virtob.1.C29770AA

C:\hp\KBD\STATIC\PT\buttonconfig.htm	
Infected with: Generic.Virtob.1.A534E3E5

C:\hp\KBD\STATIC\PT\Chat.htm	
Infected with: Generic.Virtob.1.2833BF68

C:\hp\KBD\STATIC\PT\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\PT\email.htm	
Infected with: Generic.Virtob.1.EC1221BC

C:\hp\KBD\STATIC\PT\Entertainment.htm	
Infected with: Generic.Virtob.1.67CA3587

C:\hp\KBD\STATIC\PT\Finance.htm	
Infected with: Generic.Virtob.1.F5BF91A7

C:\hp\KBD\STATIC\PT\help.htm	
Infected with: Generic.Virtob.1.019F83D5

C:\hp\KBD\STATIC\PT\HP.htm	
Infected with: Generic.Virtob.1.762E2025

C:\hp\KBD\STATIC\PT\People.htm	
Infected with: Generic.Virtob.1.A00B70FD

C:\hp\KBD\STATIC\PT\Search.htm	
Infected with: Generic.Virtob.1.39C23811

C:\hp\KBD\STATIC\PT\Shopping.htm	
Infected with: Generic.Virtob.1.512C5A3F

C:\hp\KBD\STATIC\PT\Sports.htm	
Infected with: Generic.Virtob.1.07C5A686

C:\hp\KBD\STATIC\PT\weather.htm	
Infected with: Generic.Virtob.1.58EE826E

C:\hp\KBD\STATIC\RU\buttonconfig.htm	
Infected with: Generic.Virtob.1.D0B71D68

C:\hp\KBD\STATIC\RU\Chat.htm	
Infected with: Generic.Virtob.1.1387964A

C:\hp\KBD\STATIC\RU\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\RU\email.htm	
Infected with: Generic.Virtob.1.0054B109

C:\hp\KBD\STATIC\RU\Entertainment.htm	
Infected with: Generic.Virtob.1.9CFFA0C4

C:\hp\KBD\STATIC\RU\Finance.htm	
Infected with: Generic.Virtob.1.30DE7BAC

C:\hp\KBD\STATIC\RU\HP.htm	
Infected with: Generic.Virtob.1.0E1FB418

C:\hp\KBD\STATIC\RU\People.htm	
Infected with: Generic.Virtob.1.5D6CF8B6

C:\hp\KBD\STATIC\RU\Search.htm	
Infected with: Generic.Virtob.1.A51E5968

C:\hp\KBD\STATIC\RU\Shopping.htm	
Infected with: Generic.Virtob.1.F426ED30

C:\hp\KBD\STATIC\RU\Sports.htm	
Infected with: Generic.Virtob.1.10C7E7AF

C:\hp\KBD\STATIC\RU\video.htm	
Infected with: Generic.Virtob.1.CF8E7090

C:\hp\KBD\STATIC\RU\weather.htm	
Infected with: Generic.Virtob.1.7A0B1559

C:\hp\KBD\STATIC\Sv\buttonconfig.htm	
Infected with: Generic.Virtob.1.98F70A57

C:\hp\KBD\STATIC\Sv\chat.htm	
Infected with: Generic.Virtob.1.B0148A98

C:\hp\KBD\STATIC\Sv\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\Sv\email.htm	
Infected with: Generic.Virtob.1.F41D683E

C:\hp\KBD\STATIC\Sv\Entertainment.htm	
Infected with: Generic.Virtob.1.91E4E259

C:\hp\KBD\STATIC\Sv\Finance.htm	
Infected with: Generic.Virtob.1.7FA2D45E

C:\hp\KBD\STATIC\Sv\help.htm	
Infected with: Generic.Virtob.1.7508E3FE

C:\hp\KBD\STATIC\Sv\HP.htm	
Infected with: Generic.Virtob.1.387919A6

C:\hp\KBD\STATIC\Sv
ews.htm	
Infected with: Generic.Virtob.1.7780B785

C:\hp\KBD\STATIC\Sv\Search.htm	
Infected with: Generic.Virtob.1.D7F61E36

C:\hp\KBD\STATIC\Sv\Shopping.htm	
Infected with: Generic.Virtob.1.17A1FA1A

C:\hp\KBD\STATIC\Sv\sports.htm	
Infected with: Generic.Virtob.1.42FA1FAF

C:\hp\KBD\STATIC\Sv\weather.htm	
Infected with: Generic.Virtob.1.4825AC34

C:\hp\KBD\STATIC\TH\buttonconfig.htm	
Infected with: Generic.Virtob.1.D0B71D68

C:\hp\KBD\STATIC\TH\Chat.htm	
Infected with: Generic.Virtob.1.1387964A

C:\hp\KBD\STATIC\TH\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\TH\email.htm	
Infected with: Generic.Virtob.1.0054B109

C:\hp\KBD\STATIC\TH\Entertainment.htm	
Infected with: Generic.Virtob.1.9CFFA0C4

C:\hp\KBD\STATIC\TH\Finance.htm	
Infected with: Generic.Virtob.1.30DE7BAC

C:\hp\KBD\STATIC\TH\HP.htm	
Infected with: Generic.Virtob.1.0E1FB418

C:\hp\KBD\STATIC\TH\People.htm	
Infected with: Generic.Virtob.1.5D6CF8B6

C:\hp\KBD\STATIC\TH\Search.htm	
Infected with: Generic.Virtob.1.A51E5968

C:\hp\KBD\STATIC\TH\Shopping.htm	
Infected with: Generic.Virtob.1.F426ED30

C:\hp\KBD\STATIC\TH\Sports.htm	
Infected with: Generic.Virtob.1.10C7E7AF

C:\hp\KBD\STATIC\TH\video.htm	
Infected with: Generic.Virtob.1.CF8E7090

C:\hp\KBD\STATIC\TH\weather.htm	
Infected with: Generic.Virtob.1.7A0B1559

C:\hp\KBD\STATIC\TR\buttonconfig.htm	
Infected with: Generic.Virtob.1.A8DDB473

C:\hp\KBD\STATIC\TR\Chat.htm	
Infected with: Generic.Virtob.1.65AD00FC

C:\hp\KBD\STATIC\TR\Connect.htm	
Infected with: Generic.Virtob.1.09480307

C:\hp\KBD\STATIC\TR\email.htm	
Infected with: Generic.Virtob.1.D7892E85

C:\hp\KBD\STATIC\TR\Entertainment.htm	
Infected with: Generic.Virtob.1.E475062E

C:\hp\KBD\STATIC\TR\Finance.htm	
Infected with: Generic.Virtob.1.DC4F8131

C:\hp\KBD\STATIC\TR\help.htm	
Infected with: Generic.Virtob.1.242C8846

C:\hp\KBD\STATIC\TR\HP.htm	
Infected with: Generic.Virtob.1.94AB1A0B

C:\hp\KBD\STATIC\TR\People.htm	
Infected with: Generic.Virtob.1.B2DE506C

C:\hp\KBD\STATIC\TR\Search.htm	
Infected with: Generic.Virtob.1.CB323DF8

C:\hp\KBD\STATIC\TR\Shopping.htm	
Infected with: Generic.Virtob.1.2E3BC7CB

C:\hp\KBD\STATIC\TR\Sports.htm	
Infected with: Generic.Virtob.1.74C73745

C:\hp\KBD\STATIC\TR\video.htm	
Infected with: Generic.Virtob.1.51C20C69

C:\hp\KBD\STATIC\TR\weather.htm	
Infected with: Generic.Virtob.1.1D1E38F0

C:\hp\KBD\STATIC\ZH\buttonconfig.htm	
Infected with: Generic.Virtob.1.36FCF11B

C:\hp\KBD\STATIC\ZH\Chat.htm	
Infected with: Generic.Virtob.1.B4D5DB75

C:\hp\KBD\STATIC\ZH\Connect.htm	
Infected with: Generic.Virtob.1.B186BF67

C:\hp\KBD\STATIC\ZH\email.htm	
Infected with: Generic.Virtob.1.79607168

C:\hp\KBD\STATIC\ZH\Entertainment.htm	
Infected with: Generic.Virtob.1.B9D73BC1

C:\hp\KBD\STATIC\ZH\Finance.htm	
Infected with: Generic.Virtob.1.98457CA4

C:\hp\KBD\STATIC\ZH\help.htm	
Infected with: Generic.Virtob.1.15054259

C:\hp\KBD\STATIC\ZH\HP.htm	
Infected with: Generic.Virtob.1.8596CBF5

C:\hp\KBD\STATIC\ZH\People.htm	
Infected with: Generic.Virtob.1.8E21D1B2

C:\hp\KBD\STATIC\ZH\Search.htm	
Infected with: Generic.Virtob.1.E6262F67

C:\hp\KBD\STATIC\ZH\Shopping.htm	
Infected with: Generic.Virtob.1.155B87FE

C:\hp\KBD\STATIC\ZH\Sports.htm	
Infected with: Generic.Virtob.1.42F51158

C:\hp\KBD\STATIC\ZH_CN\buttonconfig.htm	
Infected with: Generic.Virtob.1.05BED757

C:\hp\KBD\STATIC\ZH_CN\Chat.htm	
Infected with: Generic.Virtob.1.66D52CAD

C:\hp\KBD\STATIC\ZH_CN\Connect.htm	
Infected with: Generic.Virtob.1.B186BF67

C:\hp\KBD\STATIC\ZH_CN\email.htm	
Infected with: Generic.Virtob.1.0910244C

C:\hp\KBD\STATIC\ZH_CN\Entertainment.htm	
Infected with: Generic.Virtob.1.E0A1E9AE

C:\hp\KBD\STATIC\ZH_CN\Finance.htm	
Infected with: Generic.Virtob.1.933B2291

C:\hp\KBD\STATIC\ZH_CN\help.htm	
Infected with: Generic.Virtob.1.0BB5F63C

C:\hp\KBD\STATIC\ZH_CN\HP.htm	
Infected with: Generic.Virtob.1.3DC10CA8

C:\hp\KBD\STATIC\ZH_CN\People.htm	
Infected with: Generic.Virtob.1.92337D49

C:\hp\KBD\STATIC\ZH_CN\Search.htm	
Infected with: Generic.Virtob.1.E85C5E60

C:\hp\KBD\STATIC\ZH_CN\Shopping.htm	
Infected with: Generic.Virtob.1.2FC50B50

C:\hp\KBD\STATIC\ZH_CN\Sports.htm	
Infected with: Generic.Virtob.1.6F1D0258

C:\hpecovery\wizard\fscommand\AppRecoveryLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\AppRecoveryLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\CDLogic.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\CDLogic_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\CreatorLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\CreatorLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RecordnowLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RecordnowLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RestoreLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RestoreLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RTCDLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RTCDLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RunLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\RunLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\SysRecoveryLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\SysRecoveryLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\WizardLink.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\fscommand\WizardLink_ret.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpecovery\wizard\SWR_Wizard.exe	
Infected with: Win32.Virtob.6.Gen

C:\hpegister\REGINIT.EXE	
Infected with: Win32.Virtob.6.Gen

C:\hp\support\HPSysInfo.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\VINETLINK\autorun.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\VINETLINK\VINETLINK.exe	
Infected with: Win32.Virtob.6.Gen

C:\hp\VINETLINK\VINETLINK.htm	
Infected with: Generic.Virtob.1.3E008E74

C:\Program Files\3B Software\Windows Clean-Up Pro\Support.htm	
Infected with: Generic.Virtob.1.AE360F7E

C:\Program Files\Adobe\Adobe Photoshop CS2\Activation ReadMe.htm	
Infected with: Generic.Virtob.1.97D6C9EE

C:\Program Files\Adobe\Adobe Photoshop CS2\Help\additional how to content\Add_001.html	
Infected with: Generic.Virtob.1.6784A9E0

C:\Program Files\Adobe\Adobe Photoshop CS2\Help\additional how to content\HowToInstructions.html	
Infected with: Generic.Virtob.1.DDD47433

C:\Program Files\Adobe\Adobe Photoshop CS2\ImageReady.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\da_dk\License.html	
Infected with: Generic.Virtob.1.9371EBA3

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\de_de\License.html	
Infected with: Generic.Virtob.1.01C7623C

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\en_gb\License.html	
Infected with: Generic.Virtob.1.76618164

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\en_us\License.html	
Infected with: Generic.Virtob.1.EE44A687

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\es_es\License.html	
Infected with: Generic.Virtob.1.4F0ED8E2

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\fi_fi\License.html	
Infected with: Generic.Virtob.1.2A591C44

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\fr_fr\License.html	
Infected with: Generic.Virtob.1.C0D41D6F

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\it_it\License.html	
Infected with: Generic.Virtob.1.95BE1E74

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\ja_jp\License.html	
Infected with: Generic.Virtob.1.0C469B5B

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\ko_kr\License.html	
Infected with: Generic.Virtob.1.561C51BB

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal
l_nl\License.html	
Infected with: Generic.Virtob.1.CA5A96EE

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal
o_no\License.html	
Infected with: Generic.Virtob.1.36B35136

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\pt_br\License.html	
Infected with: Generic.Virtob.1.5D52A2E9

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\sv_se\License.html	
Infected with: Generic.Virtob.1.703FBD68

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\zh_cn\License.html	
Infected with: Generic.Virtob.1.7011B4D4

C:\Program Files\Adobe\Adobe Photoshop CS2\Legal\zh_tw\License.html	
Infected with: Generic.Virtob.1.F804D63F

C:\Program Files\Adobe\Adobe Photoshop CS2\Photoshop.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Plug-Ins\Adobe Photoshop Only\Extensions\Bigger Tiles\About Bigger Tiles.html	
Infected with: Generic.Virtob.1.DFBAA4C9

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Basic\FrameSet.htm	
Infected with: Generic.Virtob.1.0974262D

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Basic\IndexPage.htm	
Infected with: Generic.Virtob.1.1E7ADB5B

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Basic\SubPage.htm	
Infected with: Generic.Virtob.1.5C72CCF6

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Feedback\FrameSet.htm	
Infected with: Generic.Virtob.1.CEF90139

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Feedback\IndexPage.htm	
Infected with: Generic.Virtob.1.33E3BEC3

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Feedback\SubPage.htm	
Infected with: Generic.Virtob.1.3C3147B2

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Info Only\FrameSet.htm	
Infected with: Generic.Virtob.1.8DF48CB1

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Info Only\IndexPage.htm	
Infected with: Generic.Virtob.1.CDD78CFD

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 1 - Info Only\SubPage.htm	
Infected with: Generic.Virtob.1.1044AF8A

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 2 - Feedback\FrameSet.htm	
Infected with: Generic.Virtob.1.349FE32C

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 2 - Feedback\IndexPage.htm	
Infected with: Generic.Virtob.1.64B66004

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Centered Frame 2 - Feedback\SubPage.htm	
Infected with: Generic.Virtob.1.1EE22768

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Dotted Border - Black On White\IndexPage.htm	
Infected with: Generic.Virtob.1.7CEF00BE

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Dotted Border - Black On White\SubPage.htm	
Infected with: Generic.Virtob.1.6FF42202

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Dotted Border - White on Black\IndexPage.htm	
Infected with: Generic.Virtob.1.91DA0184

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Dotted Border - White on Black\SubPage.htm	
Infected with: Generic.Virtob.1.A7260A5F

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Flash - Gallery 1\IndexPage.htm	
Infected with: Generic.Virtob.1.F6FE1995

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Flash - Gallery 2\IndexPage.htm	
Infected with: Generic.Virtob.1.F6FE1995

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Gray Thumbnails\FrameSet.htm	
Infected with: Generic.Virtob.1.606D9BC6

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Gray Thumbnails\IndexPage.htm	
Infected with: Generic.Virtob.1.92A98E82

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Gray Thumbnails\SubPage.htm	
Infected with: Generic.Virtob.1.322C005E

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal - Feedback\FrameSet.htm	
Infected with: Generic.Virtob.1.3DFD230D

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal - Feedback\IndexPage.htm	
Infected with: Generic.Virtob.1.9204C7F0

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal - Feedback\SubPage.htm	
Infected with: Generic.Virtob.1.CEA89DAF

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Gray\FrameSet.htm	
Infected with: Generic.Virtob.1.29413CE1

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Gray\IndexPage.htm	
Infected with: Generic.Virtob.1.3003D94F

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Gray\SubPage.htm	
Infected with: Generic.Virtob.1.03CDF7CA

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Neutral\FrameSet.htm	
Infected with: Generic.Virtob.1.0CAB128F

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Neutral\IndexPage.htm	
Infected with: Generic.Virtob.1.A6CB2414

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Neutral\SubPage.htm	
Infected with: Generic.Virtob.1.9A637219

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Slideshow\FrameSet.htm	
Infected with: Generic.Virtob.1.72F145F1

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Slideshow\IndexPage.htm	
Infected with: Generic.Virtob.1.0B20240B

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Horizontal Slideshow\SubPage.htm	
Infected with: Generic.Virtob.1.733AF90F

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple\IndexPage.htm	
Infected with: Generic.Virtob.1.831554EB

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple\SubPage.htm	
Infected with: Generic.Virtob.1.BE67207C

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Horizontal Thumbnails\FrameSet.htm	
Infected with: Generic.Virtob.1.F1BBDF95

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Horizontal Thumbnails\IndexPage.htm	
Infected with: Generic.Virtob.1.4B77EAB2

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Horizontal Thumbnails\SubPage.htm	
Infected with: Generic.Virtob.1.B0EF49F1

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Thumbnail Table\IndexPage.htm	
Infected with: Generic.Virtob.1.D60BE7CD

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Thumbnail Table\SubPage.htm	
Infected with: Generic.Virtob.1.8624A265

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Vertical Thumbnails\FrameSet.htm	
Infected with: Generic.Virtob.1.DCD1B9AD

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Vertical Thumbnails\IndexPage.htm	
Infected with: Generic.Virtob.1.40EBB58E

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Simple - Vertical Thumbnails\SubPage.htm	
Infected with: Generic.Virtob.1.B9ECFA5F

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table - Minimal\IndexPage.htm	
Infected with: Generic.Virtob.1.AFE3B189

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table - Minimal\SubPage.htm	
Infected with: Generic.Virtob.1.8A0C9A71

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table 1\IndexPage.htm	
Infected with: Generic.Virtob.1.36965F3A

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table 1\SubPage.htm	
Infected with: Generic.Virtob.1.30E10658

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table 2\IndexPage.htm	
Infected with: Generic.Virtob.1.45E9384A

C:\Program Files\Adobe\Adobe Photoshop CS2\Presets\Web Photo Gallery\Table 2\SubPage.htm	
Infected with: Generic.Virtob.1.9C6E529D

C:\Program Files\Adobe\Adobe Photoshop CS2\Required\Droplet Template.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Constrain 350, Make JPG 30.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Constrain to 200x200 pixels.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Constrain to 64X64 pixels.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make Button.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make GIF (128 colors).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make GIF (32, no dither).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make GIF (64 colors).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make JPEG (quality 10).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make JPEG (quality 30).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Make JPEG (quality 60).exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Multi-Size Save.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adobe\Adobe Photoshop CS2\Samples\Droplets\ImageReady Droplets\Unsharp Mask.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Adverts\uninst.exe	
Infected with: Trojan.Fatobfus.AM

C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\ATI Control Panel\atiadaxx.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\ATI Control Panel\atiiprxx.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\ATI Control Panel\atiphexx.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\ATI Control Panel\atiprbxx.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\MCE\Transcode\ATIConvert.html	
Infected with: Generic.Virtob.1.3F3D369C

C:\Program Files\ATI Technologies\MCE\Transcode\ATIRecTV.html	
Infected with: Generic.Virtob.1.56E9AE86

C:\Program Files\ATI Technologies\MCE\Transcode\ATISchedule.html	
Infected with: Generic.Virtob.1.92F25BAC

C:\Program Files\ATI Technologies\MCE\Transcode\MCEAppReg.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\AusLogics Disk Defrag\axuninstall.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\AusLogics Disk Defrag\diskdefrag.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\AusLogics Disk Defrageports\C_Disk_Defrag_Report.html	
Infected with: Generic.Virtob.1.78C1FCF0

C:\Program Files\Clean Ram\cleanram.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1\HXFSetup.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Eusing Free Registry Cleaner\Regcleaner.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Eusing Free Registry Cleaner\UNWISE.EXE	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\ATI Technologies\Multimedia\atixcode.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\GTK\2.0\bin\iconv.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\HP\Memories Disc\2.0\hpodlog3.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\HP\Memories Disc\2.0\hpodrend.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\HP\Memories Disc\2.0\hpodserv.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriver.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriver2.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriver.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriver2.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver2.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\9\Intel 32\IDriver.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Driver\9\Intel 32\IDriver2.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\engine\6\Intel 32\IKernel.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\Audio.htm	
Infected with: Generic.Virtob.1.EEE868F6

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\configuration.htm	
Infected with: Generic.Virtob.1.3F559E2A

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\DecMain.htm	
Infected with: Generic.Virtob.1.88C088CD

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\environment.htm	
Infected with: Generic.Virtob.1.1711FD52

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\karaoke.htm	
Infected with: Generic.Virtob.1.1CB21D41

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\subpicture.htm	
Infected with: Generic.Virtob.1.CF84A87F

C:\Program Files\Fichiers communs\InterVideo\MCE\Dec\videodisplay.htm	
Infected with: Generic.Virtob.1.6E6C01F5

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\LightScribe\LSUpdate.htm	
Infected with: Generic.Virtob.1.36137CC6

C:\Program Files\Fichiers communs\Microsoft Shared\MSInfo\msinfo32.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Belle journée.htm	
Infected with: Generic.Virtob.1.C986AF37

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Camemberts.htm	
Infected with: Generic.Virtob.1.93CCCFC1

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Céramique.htm	
Infected with: Generic.Virtob.1.F2F93E17

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Feuilles.htm	
Infected with: Generic.Virtob.1.87A9EDA3

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Fiesta.htm	
Infected with: Generic.Virtob.1.9E290687

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Glacier.htm	
Infected with: Generic.Virtob.1.D86DB35F

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Lierre.htm	
Infected with: Generic.Virtob.1.9FCCD345

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Nature.htm	
Infected with: Generic.Virtob.1.C17E082E

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Punch aux agrumes.htm	
Infected with: Generic.Virtob.1.8865F5EC

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Réseau.htm	
Infected with: Generic.Virtob.1.0F8BFF9A

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Sucreries.htm	
Infected with: Generic.Virtob.1.C437A1A7

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Technique.htm	
Infected with: Generic.Virtob.1.470A3924

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Tournesol.htm	
Infected with: Generic.Virtob.1.8B15C2E3

C:\Program Files\Fichiers communs\Microsoft Shared\Papier à lettres\Vierge.htm	
Infected with: Generic.Virtob.1.F99BEB2E

C:\Program Files\Fichiers communs\Microsoft Shared\Speech\sapisvr.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Audio\Launch.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Data\Launch.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\HTML\FRA\err_not_connected.htm	
Infected with: Generic.Virtob.1.D4879C05

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\LeaderReg.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Mediahub.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Archive.htm	
Infected with: Generic.Virtob.1.029D9D96

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Backup.htm	
Infected with: Generic.Virtob.1.4BF07534

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Burn_image.htm	
Infected with: Generic.Virtob.1.3A945383

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\CD_from_discs.htm	
Infected with: Generic.Virtob.1.B8B1BDDE

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\CD_from_files.htm	
Infected with: Generic.Virtob.1.A6D6A879

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Control_panel.htm	
Infected with: Generic.Virtob.1.EA58FDB3

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Data_disc.htm	
Infected with: Generic.Virtob.1.6995D43F

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\DLA.htm	
Infected with: Generic.Virtob.1.EB4E6F8A

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Exact_copy1.htm	
Infected with: Generic.Virtob.1.F56EA9AE

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Exact_copy2.htm	
Infected with: Generic.Virtob.1.2552B7B8

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Glossary.htm	
Infected with: Generic.Virtob.1.DF3B40DD

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Image_files.htm	
Infected with: Generic.Virtob.1.6789975E

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Index.htm	
Infected with: Generic.Virtob.1.4C161258

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Jukebox_disc.htm	
Infected with: Generic.Virtob.1.5BB9EF17

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Listen.htm	
Infected with: Generic.Virtob.1.413E27B1

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Media_guide.htm	
Infected with: Generic.Virtob.1.E95F492F

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Mini_UI.htm	
Infected with: Generic.Virtob.1.F4F81137

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\More_help.htm	
Infected with: Generic.Virtob.1.0C782A6A

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Save_image.htm	
Infected with: Generic.Virtob.1.4E98749C

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Saving_a_project.htm	
Infected with: Generic.Virtob.1.E8F9C3A3

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Starting_a_project.htm	
Infected with: Generic.Virtob.1.A7E5F292

C:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\Main\Tutorial\Upgrading.htm	
Infected with: Generic.Virtob.1.0D1421E9

C:\Program Files\Fichiers communs\System\ado\MDACReadme.htm	
Infected with: Generic.Virtob.1.BB934354

C:\Program Files\FrenchOtto\eula.htm	
Infected with: Generic.Virtob.1.8FC9046B

C:\Program Files\FrenchOtto\interim.htm	
Infected with: Generic.Virtob.1.810DB361

C:\Program Files\FrenchOtto\otto.htm	
Infected with: Generic.Virtob.1.439ED8D9

C:\Program Files\FrenchOtto\ottogame.htm	
Infected with: Generic.Virtob.1.7A31CAF3

C:\Program Files\FrenchOtto\uninstallotto.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\GXTranscoder.net\Encoder\aacenc32.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\GXTranscoder.net\Encoder\MAC.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\GXTranscoder.net\Encoder\wma.exe	
Infected with: Win32.Virtob.6.Gen

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\general\blank.htm	
Infected with: Generic.Virtob.1.00E549FA

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\generaleminder.htm	
Infected with: Generic.Virtob.1.8E2BE6C3

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\generalestart.htm	
Infected with: Generic.Virtob.1.A428D846

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\general\start.htm	
Infected with: Generic.Virtob.1.6652D463

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\0_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\1_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\2_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\3_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\4_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\5_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\Common	emplates\offers\6_offer_html.htmt	
Infected with: Generic.Virtob.1.F1A21E3E

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\de\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.A65E9106

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\de\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.20E66DCA

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_au\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.67077707

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_au\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.DE103958

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_ca\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.67077707

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_ca\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.DE103958

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_ca\ui\content\faq3.htm	
Infected with: Generic.Virtob.1.8265A93B

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_gb\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.A3FF6072

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_gb\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.EEC6705A

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_nz\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.67077707

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_nz\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.DE103958

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_sg\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.67077707

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_sg\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.DE103958

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_us\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.67077707

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_us\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.DE103958

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\en_us\ui\content\faq3.htm	
Infected with: Generic.Virtob.1.8265A93B

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\es_mx\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.4A8524A1

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\es_mx\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.B33E7D81

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\fr\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.F37EF4E0

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\fr\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.3B4EA2E0

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\fr_be\ui\content\faq1.htm	
Infected with: Generic.Virtob.1.F37EF4E0

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\fr_be\ui\content\faq2.htm	
Infected with: Generic.Virtob.1.3B4EA2E0

C:\Program Files\Hewlett-Packard\Easy Internet signup\FrontEnd\fr_ca\ui\co

Oliver · Answer

dsl mais il y en a bien plus juste que sa copi coller pas au compte sa c'est 1/15 eme peut etre mais on dirai toute le meme virus quesque je doit faire?

green day · Answer

Salut

Télécharge ATF Cleaner par Atribune sur ton Bureau : http://www.infos-du-net.com/telecharger/ATF-Cleaner,0301-10869.html
Double-clique ATF-Cleaner.exe afin de lancer le programme. 
Sous l'onglet Main, choisis : Select All 
Clique sur le bouton Empty Selected 

Si tu utilises le navigateur Firefox : Clique Firefox au haut et choisis : Select All 
Clique le bouton Empty Selected 
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite. 
Clique Exit, du menu prinicipal, afin de fermer le programme. 

ensuite fais un scan avec avg et poste le stp

++

Oliver · Answer

d'accor !! mais j'utilise opera..

green day · Answer

je ne vois pas de rapport avec avg ?! :)

 c'est un programme ! idem pour AFT

++

Oliver · Answer

voila ATF Cleaner a supprimé 350 mo 

et avg donne ceci:

Report name:Complete Test
Start time:2007-10-27 12:35:27
End time:2007-10-27 13:27:29  (total: 52:00.4 Min)
Launch method:Scanning launched manually
Scanning result No viruses found
Report status:Scanning completed successfully

Scanned:88525
Threat found:0
Cleaned:0
Moved to vault:0
Deleted:0
Errors:0

green day · Answer

ok,

Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    * Démarrer en mode sans echec
    * Double cliquer combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt , poste le stp

++

Oliver · Answer

voila::: ComboFix 07-10-26.4 - HP_Administrateur 2007-10-27 14:09:06.1 - NTFSx86 MINIMAL Running from: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\RECYCLER\RB4.tmp D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés 2007-09-27 to 2007-10-27 )))))))))))))))))))))))))))))))))))) . 2007-10-27 13:57 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-27 12:34 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-26 15:03 d-------- C:\WINDOWS\BDOSCAN8 2007-10-26 12:20 d-------- C:\WINDOWS\ERUNT 2007-10-26 12:08 1,205,922 --a------ C:\SDFix.exe 2007-10-24 21:23 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Uniblue 2007-10-24 21:15 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-24 21:15 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-24 21:15 61,440 --a------ C:\WINDOWS\system32\Process.exe 2007-10-24 21:15 57,856 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-24 21:15 35,840 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-24 21:15 2,700 --a------ C:\WINDOWS\system32 mp.reg 2007-10-23 22:49 d-------- C:\Program Files\REAPER 2007-10-23 22:49 d-------- C:\Program Files\LimeWire 2007-10-23 22:47 d-------- C:\Program Files\Sony Setup 2007-10-23 22:44 d-------- C:\Program Files\Apple Software Update 2007-10-21 14:13 d-------- C:\Program Files\VirtualDJ(2) 2007-10-21 13:47 d-------- C:\Program Files\IZArc 2007-10-19 21:15 d-------- C:\Program Files\REAPER(2) 2007-10-19 19:32 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Apple Computer 2007-10-10 20:18 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Sony 2007-10-10 20:18 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Publish Providers 2007-10-10 20:18 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\NetMedia Providers 2007-10-06 11:29 d-------- C:\Program Files\Realtek AC97 2007-10-06 11:29 10,465,280 --a------ C:\WINDOWS\system32\RTLCPL.exe 2007-10-06 11:29 315,392 --a------ C:\WINDOWS\alcupd.exe 2007-10-06 11:29 221,184 --a------ C:\WINDOWS\alcrmv.exe 2007-10-06 11:29 156,672 --a------ C:\WINDOWS\system32\RtlCPAPI.dll 2007-10-06 11:29 98,304 --a------ C:\WINDOWS\soundman.exe 2007-10-06 11:29 52,672 --a------ C:\WINDOWS\system32\ChCfg.exe 2007-10-06 11:21 d-------- C:\Documents and Settings\HP_Administrateur\Application Data\WinBatch 2007-10-06 10:57 524,288 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-10-04 20:19 67,256 --ah----- C:\WINDOWS\system32\mlfcache.dat 2007-10-03 23:26 d-------- C:\Program Files\ATITool 2007-10-03 21:06 d-------- C:\Program Files\RegCleaner 2007-10-03 16:40 d-------- C:\WINDOWS\SxsCaPendDel . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-27 16:35 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\AVG7 2007-10-27 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2007-10-26 20:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-10-24 19:59 --------- d-----w C:\Program Files\VstPlugins 2007-10-24 19:59 --------- d-----w C:\Program Files\PC-Doctor 5 for Windows 2007-10-24 19:57 --------- d---a-w C:\Program Files\Fichiers communs\LightScribe 2007-10-24 19:57 --------- d-----w C:\Program Files\FrenchOtto 2007-10-24 19:57 --------- d-----w C:\Program Files\Free Download Manager 2007-10-24 03:07 --------- d-----w C:\Program Files\Java 2007-10-24 02:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-24 02:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-10-24 02:47 --------- d-----w C:\Program Files\GameSpy Arcade 2007-10-24 02:47 --------- d-----w C:\Program Files\Fichiers communs\Real 2007-10-24 02:44 --------- d-----w C:\Program Files\iTunes 2007-10-22 20:23 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\LimeWire 2007-10-18 22:27 --------- d-----w C:\Program Files\RamBoost XP 2007-10-15 23:16 --------- d-----w C:\Program Files\Google 2007-10-08 02:26 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-09-27 01:08 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-09-27 01:07 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-09-27 00:43 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Xfire 2007-09-25 19:53 --------- d-----w C:\Program Files\Eusing Free Registry Cleaner 2007-09-24 23:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2007-09-24 22:59 --------- d-----w C:\Program Files\PerfectToolsXP2 2007-09-24 22:42 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-09-24 22:29 --------- d-----w C:\Program Files\Clean Ram 2007-09-24 22:18 --------- d-----w C:\Program Files\AusLogics Disk Defrag 2007-09-24 22:12 --------- d-----w C:\Program Files\CCleaner 2007-09-21 16:14 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment 2007-09-13 01:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software 2007-09-13 01:36 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\TuneUp Software 2007-09-13 00:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2007-09-07 20:42 --------- d-----w C:\Program Files\Windows Live 2007-09-07 20:42 --------- d-----w C:\Program Files\MSN Messenger 2007-09-07 20:42 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-09-07 20:42 --------- d-----w C:\Program Files\Adverts 2007-09-07 20:39 58,952 ----a-w C:\WINDOWS\system32\MsgPlusLoader.dll 2007-09-07 20:39 --------- d-----w C:\Program Files\MessengerPlus! 3 2007-09-05 20:44 --------- d-----w C:\Program Files\Teamspeak2_RC2 2007-09-03 18:43 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data eamspeak2 2007-08-21 06:17 683,520 -c--a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-20 09:59 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 09:59 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 09:59 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 09:59 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 09:59 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 09:59 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 09:59 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 09:59 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 09:59 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 09:59 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 09:59 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 09:59 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-17 10:22 70,144 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:22 631,808 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-08-06 21:35 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 23:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 23:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2006-09-27 02:35 1 -c--a-w C:\Documents and Settings\HP_Administrateur\SI.bin 2006-03-07 11:58 251 ----a-w C:\Program Files\wt3d.ini 1999-07-07 00:00:00 6 --sh--r C:\WINDOWS\@desktop@.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E691ECB7-D50E-7FF6-C56F-90E8149BCA85}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{edc4bb0f-17ae-4488-bc8c-6181c5395c52}] 2007-06-03 11:42 1354776 --a------ C:\Program Files\virtualdj_radio bvirt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{edc4bb0f-17ae-4488-bc8c-6181c5395c52}"= C:\Program Files\virtualdj_radio bvirt.dll [2007-06-03 11:42 1354776] [HKEY_CLASSES_ROOT\CLSID\{edc4bb0f-17ae-4488-bc8c-6181c5395c52}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EDC4BB0F-17AE-4488-BC8C-6181C5395C52}"= C:\Program Files\virtualdj_radio bvirt.dll [2007-06-03 11:42 1354776] [HKEY_CLASSES_ROOT\CLSID\{EDC4BB0F-17AE-4488-BC8C-6181C5395C52}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:34] "ftutil2"="ftutil2.dll" [2004-06-07 22:05 C:\WINDOWS\system32\ftutil2.dll] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 20:15 C:\WINDOWS\arpwrmsg.exe] "HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 02:35] "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-09-21 13:41] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 00:12] "KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49] "VideotronSA.exe"="C:\Program Files\Vidéotron\Vidéotron Service Agent\VideotronSA.exe" [2007-06-13 13:41] "Services de sécurité Vidéotron"="C:\Program Files\Vidéotron\Services de sécurité Vidéotron\Rps.exe" [2007-06-13 14:39] "-FreedomNeedsReboot"="C:\Program Files\Vidéotron\Services de sécurité Vidéotron\ZkRunOnceR.exe" [2007-06-13 14:41] "PCDrProfiler"="" [] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-13 21:05] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-10-27 12:34] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-10 15:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 15:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion unonce] "IndexCleaner"="C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion unonce] "IndexCleaner"="C:\Program Files\Vidéotron\Services de sécurité Vidéotron\IdxClnR.exe" C:\Documents and Settings\Invité\Menu Démarrer\Programmes\Démarrage\ Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-05-24 00:55:08] C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\ Updates from HP.lnk - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe [2006-03-03 17:24:59] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_CURRENT_USER\software\microsoft\windows\currentversion un-] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background R3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\system32\DRIVERS\AmdLLD.sys R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S1 ATITool;ATITool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\ATITool.sys S1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys S3 bfb6000f-b1fd-44bc-a07b-1e72097d8537;bfb6000f-b1fd-44bc-a07b-1e72097d8537;\??\E:\CDS300\cds300.dll S3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\CBTNDIS5.SYS S3 IPN2120;Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys S3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys S3 Radialpoint Security Services;Services de sécurité Vidéotron;C:\WINDOWS\system32\dllhost.exe /Processid:{80098F68-1220-4F43-80A8-15C7395B8874} [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47640ef8-ab02-11da-a889-806d6172696f}] AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e867464-eaa6-11da-9320-806d6172696f}] AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2006-06-01 21:21:00 C:\WINDOWS\Tasks\Connexion facile à Internet.job" - C:\Program Files\Hewlett-Packard\SDP\HPSdpApp.exe "2007-10-26 21:15:00 C:\WINDOWS\Tasks\Maintenance en 1 clic.job" "2007-10-27 17:16:04 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-27 14:11:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-27 14:12:46 . --- E O F ---

Oliver · Answer

Alor ?

Oliver · Answer

Salut Green Day je me demendai si sa serai bien de faire un tour ici http://www.secuser.com/antivirus/index.htm 
ou sur bit defender et de désinfecté .. parce que je ne voit plus vraiment ne choix a par réinstallé windows et d'apres moi sa ne ferai surment pas grand chose! Donne moi ton avis stp.

Oliver · Answer

stp!

green day · Answer

Salut

 tu veux réinstaller windows ???

 où en est la situation ???

++

Oliver · Answer

Salut geen day la situation n'a pas changé tout est normal mais je constate q'avec  bitdefender toujour la meme chose..Win32.Virtob.6.Gen.. je me suis renseigné sur se virus qui d'ailleur et fréquent et asser récent pour bitdefender..
pour eu la seule issu et de désinfecté avec bitdefender les fichier qui ne sont pas contaminé de mise a jour du virus d'apres eu ..
D'otre témoiniage dise que la seul facon de se débarasé de (je parle éffectivement de Win32.Virtob.Gen) est de réinstaller windows.
Je n'est pas eu beaucoup de renseignement sur le .6 .Je me demendai donc avant que j'advienne au réeinstalage esque je devrai effectivement testé secuser antivirus ou bitfender et esseillé de désinfecté ou c'est cause perdu?..

Se que je me questionne le plus c'est esque je suis vraiment infecté d'un virus qui persiste ou juste de quelque chose dévinsé du fait que tout est remi a neuf ?

green day · Answer

Re-salut

ok, après quelque recherche, tu couvre là une méchante bébétte plus connue sous le nom de  Win32.Virus.Virut.T

manip pour s'en débarrasser : 

Créer un nouveau dossier sur ton Bureau (Clic-droit > Nouveau > Dossier)
• Télécharger ces 2 fichiers dans ce dossier, et pas ailleurs:
http://download.grisoft.cz/filedir/util/avg_rem_sup.dir/rmvirut/

• Exécute rmvirut.exe, et laisse le faire
• File > Save log > Enregistre le sur le Bureau, pour mieux le retrouver.
• Il se nommera VirusRemover.log, poste le rapport stp

@+

Oliver · Answer

Salut green day... un petit problème survien .. quand je active rmvirut sa fait sa:Une seule partie d'une requête ReadProcessMemory ou WriteProcessMemory a été effectuée. Sa me le faisai aussi quand je télécharge des logiciel otre endroit que mon bureau ou sur un site en particulier des fois sa fait sa mais la je les telechargé un peut partout et sa fait toujours la même chose je fait quoi? je vais retesté ..

green day · Answer

re-salut

 tu as des soucis de téléchargements de manière générale ?!

++

Oliver · Answer

Bon jai mi un otre message mais il n'est pas posté je disai que jai réeusi parce que mon opera et infecté ..je c'est pas trop 
enfin jai réeussi avec explorer mais quand jai exécuté le logiciel sa ma fait sa:The virus is active in memory and may disrupt cleaning.It is necessary to run the remover after system reboot et je n'est donc pas trouvé de log repport mais avoir vu cetais ok ok ok ok cant open ok ok ok cant open alor la sa filai tres rapidement alor je ne c'est plus quesque je doit faire .. que doi je faire?.

green day · Answer

refais la manip stp !

++

Oliver · Answer

re enfin meme truc il a fait la meme chose donc sa fait ok ok juste 1 cant open dans microsoft che pas trop sinon mon defrag ses fait ''cleaned'' et le rapport il y en a pas puisque sa se passe dans le reboot ses tout se que jai

============ Remover for Win32/Virut ===============
Date: 01.11.2007 19:07
Work complete;

green day · Answer

Salut

 ok, 

    * Fais un scan en ligne Kaspersky avec Internet Explorer : https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
    * Clique sur http://pictures.kaspersky.fr/bouton-scann1.jpg
    * Clique maintenant sur J'accepte.
    * Valide l'installation d'un ou de plusieurs ActiveX si c'est nécessaire.
    * Patiente pendant l'installation des Mises à jour.
    * Choisis par la suite l'analyse du Poste de travail
    * Sauvegarde puis colle le rapport généré en fin d'analyse, et poste le stp

++

Virus étrange (indétectable)BLOQUE MON SYSTEM

42 réponses

Discussions similaires

Newsletters