Forum de FilmDeCulte

Bon, je sais pas si vous pourrez m'aider, mais vu que je cherche depuis ce matin la solution, ça coûte rien de demander ici aussi. Merci d'avance à qui pourra m'aider.

Depuis ce matin, Norton me signale toutes les cinq minutes la présence du virus Bloodhound.W32.EP, dans le répertoire C:\DOCUME~1\REGIS\LOCALS~1\TEMP\4.exe.

J'ai donc fait un scan Hijackthis, qui donne ça:

Logfile of HijackThis v1.99.1
Scan saved at 16:45:48, on 06/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Documents and Settings\Régis\Bureau\snd-anydvd4[1].3.0.1.cracked.exe\AnyDVD.exe
C:\WINDOWS\System32\zhgch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Belkin\Belkin 802.11g Wireless Card Configuration Utility\utility.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\1.exe
C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\2.exe
C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\3.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Régis\Bureau\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.filmdeculte.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fourni par Club Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.club-internet.fr:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 61.152.108.76 wooll.host7.tfidc.com
O1 - Hosts: 61.152.108.76 www.work009.com
O1 - Hosts: 61.152.108.76 my.m365m.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AnyDVD] C:\Documents and Settings\Régis\Bureau\snd-anydvd4[1].3.0.1.cracked.exe\AnyDVD.exe
O4 - HKLM\..\Run: [JVM0.12] C:\WINDOWS\System32\zhgch.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Easy PDF Creator] C:\Program Files\Easy PDF Creator\EasyPDFCreator.exe
O4 - HKLM\..\Run: [wdfmgr32] C:\WINDOWS\System32\wdfmgr32.exe
O4 - HKLM\..\Run: [wdfmgr32.exe] C:\WINDOWS\System32\wdfmgr32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\Run: [mhs2] C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\1.exe
O4 - HKLM\..\Run: [wlzs2] C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\2.exe
O4 - HKLM\..\Run: [zts2] C:\DOCUME~1\RÉGIS\LOCALS~1\Temp\3.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Belkin 802.11g Wireless Card Utility.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Télécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Tout t&élécharger avec NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.Sony-europe.com
O15 - Trusted Zone: *.Sonystyle-europe.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/ka ... nicode.cab
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://static.impots.gouv.fr/abos/securite/xenroll.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/selfte ... TPTest.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D759F09E-E3FD-4C4E-91C1-1320DCAC9926}: NameServer = 192.168.0.1
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FICHIE~1\SONYSH~1\AVLib\Sptisrv.exe



Et surtout un kapersky, alarmiste au possible, qui donne ça:

KASPERSKY ONLINE SCANNER REPORT
Wednesday, December 06, 2006 4:34:58 PM
Operating System: Microsoft Windows XP Home Edition, (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 6/12/2006
Kaspersky Anti-Virus database records: 234441


Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 65949
Number of viruses found 13
Number of infected objects 113 / 0
Number of suspicious objects 0
Duration of the scan process 01:40:34

Infected Object Name Virus Name Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\9AR82985\drsmartload556a[1].exe Infected: Trojan-Downloader.Win32.Adload.as skipped

C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\zhgch.exe Infected: Trojan-Downloader.Win32.Agent.jc skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\ad.RB0 Infected: Trojan-Clicker.JS.Agent.e skipped

C:\WINDOWS\system32\dllt.dll Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\WINDOWS\system32\xydll.dll Infected: Trojan-PSW.Win32.OnLineGames.aw skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\swlgpz72.exe Infected: Trojan-Downloader.Win32.Harnig.cu skipped

C:\WINDOWS\loadnew.exe Infected: Trojan-Downloader.Win32.Harnig.cu skipped

C:\WINDOWS\Intel\rundll32.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\Régis\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Temp\mhs.dll Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\62601.exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\mhs2.dll Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\48151.exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\zts2.dll Infected: Trojan-PSW.Win32.OnLineGames.cj skipped

C:\Documents and Settings\Régis\Local Settings\Temp\19433.exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\mhs.exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Temp\zbnzyvvt.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\tmncdywy.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\czlkbazi.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\bnwvitrj.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\oilvwkgk.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\aizvgqyx.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\ynmpwgwp.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\htdxwtty.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\ispkpain.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\ioufqedq.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\dsxvoscx.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\aagqyjep.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Documents and Settings\Régis\Local Settings\Temp\~DFA22B.tmp Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Historique\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Historique\History.IE5\MSHist012006120620061207\index.dat Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Temporary Internet Files\Content.IE5\4LUV456N\zt[1].exe Infected: Trojan-PSW.Win32.OnLineGames.cj skipped

C:\Documents and Settings\Régis\Local Settings\Temporary Internet Files\Content.IE5\Z44LOEJY\mh2[1].exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Identities\{585D1AFE-9F4D-4877-A4E5-855ED71C3788}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Identities\{585D1AFE-9F4D-4877-A4E5-855ED71C3788}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Identities\{585D1AFE-9F4D-4877-A4E5-855ED71C3788}\Microsoft\Outlook Express\cleanup.log Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Identities\{585D1AFE-9F4D-4877-A4E5-855ED71C3788}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped

C:\Documents and Settings\Régis\Local Settings\Application Data\Identities\{585D1AFE-9F4D-4877-A4E5-855ED71C3788}\Microsoft\Outlook Express\Boîte de réception.dbx Object is locked skipped

C:\Documents and Settings\Régis\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Régis\Application Data\Adobe\Acrobat\7.0\Updater\udlog.txt Object is locked skipped

C:\Documents and Settings\Régis\ntuser.dat Object is locked skipped

C:\Program Files\Internet Explorer\PLUGINS\System64.sys Infected: Trojan-PSW.Win32.QQPass.pp skipped

C:\Program Files\Apoint\dzwewguj.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\ggfwmcgr.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\urxbszed.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\xqouivym.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\yvngawbi.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\lyqzdthw.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\gnfveemn.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\ahtptujh.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\yvkpifph.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\ufvovonh.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\mjfzaody.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\jvshejel.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\klrthiee.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\wbxhsbxs.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\dbhaktxu.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Apoint\qorqqowh.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Adobe\Acrobat 6.0\Distillr\aahxjbmv.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Adobe\Acrobat 6.0\Distillr\nxovuabs.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Adobe\Acrobat 6.0\Distillr\qysahgdt.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Adobe\Acrobat 6.0\Distillr\akglaeif.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\Norton AntiVirus\Quarantine\2EBC6930.doc Infected: Virus.MSWord.Title skipped

C:\Program Files\iPod\bin\lsnqkafw.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\iPod\bin\yjitsikd.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\iPod\bin\jzkritim.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\Program Files\iPod\bin\fwckmlja.dll Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0194978.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0194981.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0194982.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0195000.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0195003.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP307\A0195007.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0196295.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0196299.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0196301.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0197315.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0197319.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0197322.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0197352.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0197356.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0198385.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0198389.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0198391.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199386.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199392.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199395.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199415.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199420.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199421.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP316\A0199441.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0200451.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0200493.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0200496.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0202492.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0202500.dll Infected: Trojan-PSW.Win32.Delf.tf skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0204514.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0204526.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0205526.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207576.bat Infected: Trojan-PSW.Win32.QQPass.pp skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207526.exe Infected: Trojan-PSW.Win32.OnLineGames.cr skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207577.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207578.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207579.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207580.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207581.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207582.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207583.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207584.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207585.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207586.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207587.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207588.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0207589.dll Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0208521.dll Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0208522.dll Infected: Trojan-PSW.Win32.OnLineGames.aw skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0208532.DLL Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0208533.DLL Infected: Trojan-PSW.Win32.OnLineGames.aw skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP317\A0208536.exe Infected: Trojan-PSW.Win32.OnLineGames.bs skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0191926.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0191929.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0191931.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0193942.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0193945.exe Infected: Trojan-PSW.Win32.OnLineGames.bt skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP306\A0193946.exe Infected: Trojan-PSW.Win32.Nilage.ayc skipped

C:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP318\change.log Object is locked skipped

D:\System Volume Information\_restore{DB4607B3-9650-4F7E-9DEC-094CD0FB4EE2}\RP318\change.log Object is locked skipped

Scan process completed.


Donc je flippe totalement... Et je ne sais vraiment pas quoi faire pour règler ces problèmes... Sauvez-moi !!!

_________________

*

Ah nous on avait un truc dans le genre aussi ... on s'est fait volé l'ordi ça a réglé le problème.

NON.(enfin pas moi, je te sauverai pas quoi, je comprends rien, donc crève)

_________________

Oh le pirate!

Tu es bien puni

Non, sans rire, c'est pas drole du tout. Courage!

LOL..bein voilà, Zad t'as la solution, tu le tapes sur un banc et quelqu'un va le nettoyer pour toi.

_________________

super merci, la prochain fois tu t'abstiens, stp? Merci. C'est déjà assez relou comme ça...

_________________

*

tu devrais aller sur des forums spécialisés je vois pas qui ici peut analyser des résultats comme ça (ton virus à surement attaqué la base de registre, à partir de là il n'y que les connaisseurs qui peuvent te répondre ..).

voui, voui, c'est ce que j'ai fait, c'est ce que je veux dire en disant que je me fais chier là-dessus depuis ce matin... j'ai essayé plein de trucs, envoyé le problème sur plein de forums spécialisés... donc voilà, je me suis dit, tiens, fdc, on sait jamais...

_________________

*

_________________
- Nazi violent 1961-2013?
"my... "double anale", c'est ce que je crois?" Chlochette
"J'ai toujours aimé la culture nain" Sponge

essaie de passer cet antivirus en ligne pour voir si tu as son nom réel :

http://www.secuser.com/antivirus/index.htm

_________________
- Nazi violent 1961-2013?
"my... "double anale", c'est ce que je crois?" Chlochette
"J'ai toujours aimé la culture nain" Sponge

ou tu peux essayer de passer directement stinger :

http://vil.nai.com/vil/stinger/

_________________
- Nazi violent 1961-2013?
"my... "double anale", c'est ce que je crois?" Chlochette
"J'ai toujours aimé la culture nain" Sponge

j'ai déjà fait secuser ce matin... sans résultat... je vais tenter stinger, merci

_________________

*

Pour l'alerte que tu as eu sur BloodHound je ne saurais pas trop dire, par contre ya un truc moche c'est :

O4 - HKLM\..\Run: [JVM0.12] C:\WINDOWS\System32\zhgch.exe

A ta place je dégagerai cette clé de registre qui correspond certainement à un troyen. Pour expliquer, c'est une clé qui permet de lancer à chaque démarrage de ton PC l'executable zhgch.exe dans ton system32, et cet exécutable ne correspond à rien de connu. Il ressemble plutot à un truc généré aléatoirement par un virus ou un troyen. Bref le mieux c'est de supprimer cette clé et de redémarrer le PC. A partir de là tu pourras supprimer zhgch.exe dans c:\windows\system32, et avec un peu dee chance ton antivirus sera plus efficace à éradiquer la menace avec ce process éteint.

Le chemin complet pour supprimer la clé :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

PS : si tu n'es pas confiant, plutot que de supprimer, renomme en rajoutant old à la fin de la clé en en mettant .old à la place de .exe sur le fichier, comme ça tu pourras faire marche arrière plus facilement