[Résolu] windows has detected spyware infection
Forum Sécurité - Virus : [Résolu] windows has detected spyware infection
AntiVir PersonalEdition Classic
Report file date: mercredi 19 septembre 2007 15:53
Scanning for 1075504 virus strains and unwanted programs.
Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Resp
Computer name: STEF
Version information:
BUILD.DAT : 268 15604 Bytes 31/08/2007 13:04:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 12:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 11:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 14:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 11:35:20
ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 31/05/2006 11:32:40
ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 10/07/2007 11:32:46
ANTIVIR2.VDF : 6.39.1.120 1918464 Bytes 12/09/2007 13:44:06
ANTIVIR3.VDF : 6.39.1.152 174592 Bytes 19/09/2007 13:44:06
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 19/09/2007 13:44:06
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 09:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 06:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 12:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 07:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 06:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 06:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 10:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 11:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 11:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 08:37:21
Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: H:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium
Start of the scan: mercredi 19 septembre 2007 15:53
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'AcroRd32.exe' - '1' Module(s) have been scanned
Scan process 'dkcktkn.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'Surveyor.exe' - '1' Module(s) have been scanned
Scan process 'Hotsync.exe' - '1' Module(s) have been scanned
Scan process 'DvzIncMsgr.exe' - '1' Module(s) have been scanned
Scan process 'BrMfcMon.exe' - '1' Module(s) have been scanned
Scan process 'BrMfcWnd.exe' - '1' Module(s) have been scanned
Scan process 'AdVantage.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'brctrcen.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'dragdiag.exe' - '1' Module(s) have been scanned
Scan process 'type32.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'fbserver.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'fbguard.exe' - '1' Module(s) have been scanned
Scan process 'dklog.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'brss01a.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'brsvc01a.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
50 processes with 50 modules were scanned
Start scanning boot sectors:
Boot sector 'A:\'
[NOTE] In the drive 'A:\' no data medium is inserted!
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'E:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] No virus was found!
Boot sector 'H:\'
[NOTE] In the drive 'H:\' no data medium is inserted!
Starting to scan the registry.
The registry was scanned ( '34' files ).
Starting the file scan:
Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.
Begin scan in 'C:\' <SYSTEM_STEF>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Resp\Bureau\ComboFix.exe
[0] Archive type: RAR SFX (self extracting)
--> setpath.cfexe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '475e2ab3.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20070919-135229-233-findfast.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47542d19.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20070919-135229-987-autorun.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47542d1d.qua'!
C:\qoobox\Quarantine\C\DOCUME~1\Resp\APPLIC~1\13006.exe.vir
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47212d56.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\printer.exe.vir
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '475a2d98.qua'!
C:\SDFix\backups\backups.zip
[0] Archive type: ZIP
--> backups/printer.exe
[DETECTION] Contains suspicious code HEUR/Malware
--> backups/shell.exe
[DETECTION] Contains suspicious code HEUR/Malware
--> backups/spoolvs.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47542d91.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP824\A0431556.dll
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ddc.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431788.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252de9.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431793.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252dee.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431794.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252df1.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431795.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252df4.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431797.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252df6.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431810.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252df9.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431811.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252dfb.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431812.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252dfe.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431816.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e00.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431817.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e03.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431818.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e05.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431819.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e07.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431826.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e0a.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431827.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e0c.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431829.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e0e.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431830.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e12.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431850.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e15.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431851.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e17.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431852.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e19.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431853.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e1b.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431860.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e1d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431861.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e20.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431862.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e22.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0431864.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e23.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0432859.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e25.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0432860.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e28.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0432861.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e29.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0432863.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e2c.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433860.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e2e.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433861.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e30.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433862.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e33.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433863.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e35.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433873.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e37.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433874.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e39.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433875.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e3b.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0433876.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e3d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0434884.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e3f.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0434885.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e41.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0434886.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e43.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP831\A0434887.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e45.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434890.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e48.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434891.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e4a.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434892.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e4b.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434893.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e4d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434918.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e50.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0434927.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e53.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435005.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e56.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435006.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e58.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435007.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e5a.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435008.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e5c.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435016.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e5e.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435017.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e60.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435018.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e62.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP832\A0435019.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e64.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435021.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e67.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435022.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e6e.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435023.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e70.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435024.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e73.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435055.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e76.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP833\A0435056.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e79.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435130.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e7d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435131.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e7f.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435132.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e81.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435133.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e83.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435134.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e86.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435145.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e88.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435161.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e8a.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435162.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e8c.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435163.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e8d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435253.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e91.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435254.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e93.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435255.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e95.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435256.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e97.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435272.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e99.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435273.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e9b.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435274.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252e9d.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435275.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ea0.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435277.dll
[DETECTION] Is the Trojan horse TR/Click.Agent.AC
[INFO] The file was moved to '47252ec0.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435278.dll
[DETECTION] Is the Trojan horse TR/Click.Agent.AC
[INFO] The file was moved to '47252ec2.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435279.exe
[DETECTION] Contains detection pattern of the worm WORM/Gaobot.197632
[INFO] The file was moved to '47252ec4.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435283.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.cpg.1
[INFO] The file was moved to '47252ec8.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435344.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ed0.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435345.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ed2.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435346.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ed6.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435347.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ed9.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435363.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252edb.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435364.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252edd.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435365.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252edf.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435366.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ee1.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435381.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ee3.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435382.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ee5.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435383.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ee7.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435384.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ee9.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435386.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252eeb.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435391.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252eed.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435392.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252eef.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435393.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ef1.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435423.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ef3.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435475.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ef6.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435476.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252ef8.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435478.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252efa.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP834\A0435479.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252efd.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435485.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f00.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435486.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f02.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435487.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f05.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435488.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f07.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435490.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f09.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435491.exe
[0] Archive type: RAR SFX (self extracting)
--> setpath.cfexe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f0e.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435492.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f12.qua'!
C:\System Volume Information\_restore{F5B16D28-DFC4-4E04-BC04-3F891AAAC2AD}\RP835\A0435493.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '47252f14.qua'!
C:\WINDOWS\system32\xlibgfl254.dll
[DETECTION] Contains suspicious code HEUR/Malware
[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003
[WARNING] The file could not be deleted!
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\KDE9S9IZ\WksPatch[2].exe
[DETECTION] Contains detection pattern of the worm WORM/Nachi.B.1
[INFO] The file was moved to '47643295.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\shell.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '475632d1.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\printer.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] HEUR/Malware:[HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN]:<Printer>=sz
rinter.exe
[INFO] The file was moved to '475a32de.qua'!
C:\_OTMoveIt\MovedFiles\WINDOWS\system32\spoolvs.exe
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '476032df.qua'!
Begin scan in 'D:\'
Search path D:\ could not be opened!
Le périphérique n'est pas prêt.
Begin scan in 'E:\' <DATA_STEF>
Begin scan in 'F:\' <SAVE_CD>
Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.
Begin scan in 'H:\'
Search path H:\ could not be opened!
Le périphérique n'est pas prêt.
End of the scan: mercredi 19 septembre 2007 16:42
Used time: 49:28 min
The scan has been done completely.
4478 Scanning directories
247383 Files were scanned
5 viruses and/or unwanted programs were found
119 Files were classified as suspicious:
0 files were deleted
0 files were repaired
121 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
247378 Files not concerned
7231 Archives were scanned
3 Warnings
6 Notes
Répondre à Angeldark
Bonne continuation 
Répondre à Angeldark
