Trojan.Vundo.ERH bloqué (?) par Bitdefender

Bibif · le 6 juin 2008

Bonjour,

Cher Zébulon, j'ai encore besoin de tes lumières...

Sur le PC Windows XP SP2 accessible par un téléchargeur fou de 12ans (mon fils!), les symptomes sont les suivants

1/ à l'ouverture des sessions:

- Deux sessions d'utilisateurs n'affichent pas les icones du bureau

- Une troisième s'ouvre correctement

2/ Sur toutes les sessions, Bitdefender (à jour) détecte Trojan.Vundo.ERH ET LE BLOQUE! "Votre PC n'a pas été infecté".

Mais il est impossible de travailler pour autant. Please help!

Ci-joint:

- scan de bitdefender (Trojan et backdoor détectés)

- Rapport hijack

Merci de votre aide,

Bibif

1/ SCAN BITDEFENDER:

//-----------------------------------------------------------------

//

// Produit BitDefender Antivirus Plus v10

// Produit 10.2

//

// Créé le: 05/06/2008 19:04:03

//

//-----------------------------------------------------------------

Statistiques

Chemin cible: C:\

D:\

Dossiers : 24616

Fichiers : 1768393

Processus Mémoire analysés : 73

Archives : 112123

Fichiers enpaquetés : 317042

Virus trouvés : 12

Fichiers infectés : 22

Processus Mémoire infectés : 0

Fichiers suspects : 9

Alertes : 0

Fichiers désinfectés : 2

Fichiers effacés : 0

Fichiers déplacés : 4

Erreurs I/O : 63

Temps d'analyse :=04:20:22

Fichiers/seconde :113

Statistiques Spywares

Registres analysés : 396

Registres infectés : 0

Cookies analysés : 37

Cookies infectés : 0

Fichiers spyware infectés : 0

Menaces Spyware détectées : 0

Définitions virus : 1251326

Plugins d'analyse : 16

Plugins archives : 42

Plug-ins décompression : 7

Plug-ins messagerie : 6

Plug-ins système : 5

Options d'analyse

Détection

[X] Analyser le secteur de boot

[X] Processus mémoire

[X] Analyser les archives

[X] Analyser les fichiers enpaquetés

[X] Analyser la messagerie

Masque fichiers

[ ] Programmes

[X] Tous les fichiers

[ ] Extensions définies par l'utilisateur:

[ ] Exclure les extensions: ;

Action

Objets infectés

[ ] Ignorer

[X] Désinfecter

[ ] Effacer

[ ] Mettre en quarantaine

[ ] Demander l'action

Seconde action

[ ] Ignorer

[ ] Effacer

[X] Mettre en quarantaine

[ ] Demander l'action

Options d'analyse

[X] Activer les alertes

[X] Activer l'heuristique

[ ] Afficher tous les fichiers dans le journal

[X] Fichier journal: D:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1212685443.log

Options d'analyse Spyware

[X] Analyse contre les risques non-viraux

[ ] Ecarter de l'analyse les dialers et les applications

[X] Clés de registres

[X] Cookies

Résumé:

C:\Program Files\PokÃ©lord Script\PokÃ©lord Script v2.0.1\meuh.dll Infecté: Backdoor.Bot.10951

C:\Program Files\PokÃ©lord Script\PokÃ©lord Script v2.0.1\meuh.dll Désinfection impossible

C:\Program Files\PokÃ©lord Script\PokÃ©lord Script v2.0.1\meuh.dll Déplacé

C:\SaveDELL-Mensuel\SaveDell-061031 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.AFC639D1

C:\SaveDELL-Mensuel\SaveDell-061031 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-061031 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.92E11825

C:\SaveDELL-Mensuel\SaveDell-061031 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.AFC639D1

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.92E11825

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite BB.pst=>[subject: Ils se battent pour la paix][From: jckat]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\SaveDELL-Mensuel\SaveDell-061224 obsolete\OutlookBF\Boite BB.pst=>[subject: 20/11 : Veolia, Prosodie, Sagem,...][From: laviefinanciere@laposte.net]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.AFC639D1

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.92E11825

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite BB.pst=>[subject: Ils se battent pour la paix][From: jckat]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\SaveDELL-Mensuel\Savedell-070217 obsolete\OutlookBF\Boite BB.pst=>[subject: 20/11 : Veolia, Prosodie, Sagem,...][From: laviefinanciere@laposte.net]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.92E11825

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.AFC639D1

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Désinfection impossible

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite BB.pst=>[subject: Ils se battent pour la paix][From: jckat]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\SaveDELL-Mensuel\SaveDell-BASE\OutlookBF\Boite BB.pst=>[subject: 20/11 : Veolia, Prosodie, Sagem,...][From: laviefinanciere@laposte.net]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP799\A0169957.dll Infecté: Backdoor.Bot.10951

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP799\A0169957.dll Désinfection impossible

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP799\A0169957.dll Déplacé

C:\WINDOWS\system32\xxyvVpMD.dll Infecté: Trojan.Vundo.ERH

C:\WINDOWS\system32\xxyvVpMD.dll Désinfection impossible

C:\WINDOWS\system32\xxyvVpMD.dll Déplacement impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>keygen.exe Infecté: Trojan.Downloader.Harnig.ZC

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>keygen.exe Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>keygen.exe Déplacement impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>serial.exe Infecté: Trojan.Retapu.D

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>serial.exe Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Application Data\Mozilla\Firefox\Profiles\40fs12lo.default\Cache\47356EA3d01=>(RAR Sfx o)=>serial.exe Déplacement impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\h67aadjb.exe=>(NSIS o)=>lzma_solid_nsis0005 Infecté: Backdoor.Bot.10951

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\h67aadjb.exe=>(NSIS o)=>lzma_solid_nsis0005 Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\h67aadjb.exe=>(NSIS o)=>lzma_solid_nsis0005 Déplacement impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\TFR99.tmp=>www.Dance_dec_jpg_Msn.com Infecté: Backdoor.Sdbot.BNI

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\TFR99.tmp=>www.Dance_dec_jpg_Msn.com Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Local Settings\Temp\TFR99.tmp Déplacé

D:\Documents and Settings\PropriÃ©taire\Mes documents\Jeux Mobile\800 Jeux Java Gratuits\NBA_2005.jar=>anims.mrg Infecté: Trojan.Exploit.Pngfile.A

D:\Documents and Settings\PropriÃ©taire\Mes documents\Jeux Mobile\800 Jeux Java Gratuits\NBA_2005.jar=>anims.mrg Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Mes documents\Jeux Mobile\800 Jeux Java Gratuits\NBA_2005.jar Déplacé

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>keygen.exe Infecté: Trojan.Downloader.Harnig.ZC

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>keygen.exe Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>keygen.exe Déplacement impossible

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>serial.exe Infecté: Trojan.Retapu.D

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>serial.exe Désinfection impossible

D:\Documents and Settings\PropriÃ©taire\Mes documents\Mes tÃ©lÃ©chargements\trackmania_united_key.exe=>(RAR Sfx o)=>serial.exe Déplacement impossible

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Terabyte Club.xls][From: Speciale, Nancy]=>tbclub.xls Infecté: XM.Laroux.AE

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Terabyte Club.xls][From: Speciale, Nancy]=>tbclub.xls Désinfecté

D:\NCR_Archives\Exchange\MAILBOX.PST Recompression des archives réussie

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Terabyte Club at 59 and counting][From: Jahnke, Mark]=>TeraClub.zip=>TeraClub.xls Infecté: XM.Laroux.AE

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Terabyte Club at 59 and counting][From: Jahnke, Mark]=>TeraClub.zip=>TeraClub.xls Désinfecté

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Terabyte Club at 59 and counting][From: Jahnke, Mark]=>TeraClub.zip Recompression des archives réussie

D:\NCR_Archives\Exchange\MAILBOX.PST Recompression des archives réussie

D:\NCR_Archives\Exchange\MAILBOX.PST=>[subject: Re:][From: metisus:Terri Lerose]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

D:\SaveDell\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.92E11825

D:\SaveDell\OutlookBF\Boite aux lettres.pst=>[subject: RE : A warm wish ! from Frederic et Emmanuelle][From: Bernard Fitoussi]=>(body)=>(Compressed Rtf) Désinfection impossible

D:\SaveDell\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Infecté: Generic.Peed.Eml.AFC639D1

D:\SaveDell\OutlookBF\Boite aux lettres.pst=>[subject: A warm wish ! from Frederic et Emmanuelle][From: fbrachfeld@ifrance.com]=>(body)=>(Compressed Rtf) Désinfection impossible

D:\SaveDell\OutlookBF\Boite BB.pst=>[subject: Ils se battent pour la paix][From: jckat]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

D:\SaveDell\OutlookBF\Boite BB.pst=>[subject: 20/11 : Veolia, Prosodie, Sagem,...][From: laviefinanciere@laposte.net]=>(body)=>(Compressed Rtf) Suspect: Exploit.Iframe.Vulnerability

2/RAPPORT HIJACK

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:01:49, on 06/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\UAService.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Apps\Powercinema\PCMService.exe

C:\apps\ABoard\ABoard.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\apps\ABoard\AOSD.exe

C:\Program Files\NETGEAR\WG111T Configuration Utility\wlan111t.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

D:\Utilitaires PC\HijackThis\hijackthis202.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {93311CF1-18D6-4C1D-B8E4-4A45166B0968} - C:\WINDOWS\system32\qoMfdDwx.dll

O2 - BHO: {2d736349-19e2-0cf8-7ab4-92bfc702ba7b} - {b7ab207c-fb29-4ba7-8fc0-2e91943637d2} - C:\WINDOWS\system32\iyrvcfnm.dll

O2 - BHO: (no name) - {C83F6149-4782-4DAB-A478-96F195A376A2} - C:\WINDOWS\system32\xxyvVpMD.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [ulead AutoDetector v2] C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [bM8ba6231f] Rundll32.exe "C:\WINDOWS\system32\rwfuwnqc.dll",s

O4 - HKLM\..\Run: [88951083] rundll32.exe "C:\WINDOWS\system32\mhfqmdfx.dll",b

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-21-925967871-2353556621-442134179-1010\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (User 'Laurence')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?

O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk.disabled

O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar4.dll/cmwordtrans.html

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar4.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar4.dll/cmsimilar.html

O8 - Extra context menu item: Post Image to Blog - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5003

O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar4.dll/cmsearch.html

O8 - Extra context menu item: Tag This Image - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5002

O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5000

O8 - Extra context menu item: Upload Image to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5001

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar4.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm

O15 - Trusted Zone: http://toolbar.imageshack.us

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1165769445515

O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://esupport.epson-europe.com/selftest/...rg/ESTPTest.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab

O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O20 - Winlogon Notify: xxyvVpMD - C:\WINDOWS\SYSTEM32\xxyvVpMD.dll

O23 - Service: .nen394cl - - (no file)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: SecuROM User Access Service (UserAccess) - Unknown owner - C:\WINDOWS\system32\UAService.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

--

End of file - 14757 bytes

pear · le 6 juin 2008

Bonjour,

Imprimez ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Télécharger Malwarebytes' Anti-Malware (MBAM)

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes.

Double-cliquer sur l'icône Download_mbam-setup.exe sur le bureau pour démarrer l'installation.

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet).

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

vérifiez que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue.

La fenêtre principale de MBAM s'affiche :

Dans l'onglet analyse, vérifier que "Exécuter une analyse approfondie" est coché et cliquer sur le bouton Rechercher pour démarrer l'analyse.

L' analyse prendra un certain temps, soyez patient !

Un message s'affichera, en indiquant la fin .

Cliquer sur OK pour continuer.

Si des malwares ont été détectés, leur liste s'affiche.

En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

Fermer le bloc-note.

Fermer MBAM en cliquant sur Quitter.

Poster le rapport .

et, ensuite,un nouvel Hijackthis

Bibif · le 6 juin 2008

Bonjour,

Imprimez ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

Télécharger Malwarebytes' Anti-Malware (MBAM)

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes.

Double-cliquer sur l'icône Download_mbam-setup.exe sur le bureau pour démarrer l'installation.

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet).

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

vérifiez que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue.

La fenêtre principale de MBAM s'affiche :

Dans l'onglet analyse, vérifier que "Exécuter une analyse approfondie" est coché et cliquer sur le bouton Rechercher pour démarrer l'analyse.

L' analyse prendra un certain temps, soyez patient !

Un message s'affichera, en indiquant la fin .

Cliquer sur OK pour continuer.

Si des malwares ont été détectés, leur liste s'affiche.

En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

MBAM va ouvrir le bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

Fermer le bloc-note.

Fermer MBAM en cliquant sur Quitter.

Poster le rapport .

et, ensuite,un nouvel Hijackthis

Bonsoir Pear,

J'ai suivi tes instructions à la lettre.

Ci-dessous les deux rapports:

-MBAM et HIJACK

Merci de ton aide,

Bibif

1/ Voici le rapport MBAM:

Malwarebytes' Anti-Malware 1.15

Version de la base de données: 834

19:06:53 06/06/2008

mbam-log-6-6-2008 (19-06-53).txt

Type de recherche: Examen complet (C:\|D:\|)

Eléments examinés: 367564

Temps écoulé: 1 hour(s), 35 minute(s), 18 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 3

Clé(s) du Registre infectée(s): 11

Valeur(s) du Registre infectée(s): 3

Elément(s) de données du Registre infecté(s): 2

Dossier(s) infecté(s): 16

Fichier(s) infecté(s): 45

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\mhfqmdfx.dll (Trojan.Vundo) -> Unloaded module successfully.

C:\WINDOWS\system32\qoMfdDwx.dll (Trojan.Vundo) -> Unloaded module successfully.

C:\WINDOWS\system32\xxyvVpMD.dll (Trojan.Vundo) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{93311cf1-18d6-4c1d-b8e4-4a45166b0968} (Trojan.Vundo) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{93311cf1-18d6-4c1d-b8e4-4a45166b0968} (Trojan.Vundo) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{c83f6149-4782-4dab-a478-96f195a376a2} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c83f6149-4782-4dab-a478-96f195a376a2} (Trojan.Vundo) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\88951083 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c83f6149-4782-4dab-a478-96f195a376a2} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM8ba6231f (Trojan.Agent) -> Delete on reboot.

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomfddwx -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomfddwx -> Delete on reboot.

Dossier(s) infecté(s):

C:\Program Files\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\capoeirafighter (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzflashdimension (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzpong (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\luigisrevengeinteractive (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\motocross (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\princeofpersia (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\sonic (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\streetfighter (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\supersnowboardx (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\tabletennis (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\trampoline (Adware.EGDAccess) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\WINDOWS\system32\fhinujcs.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\scjunihf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mhfqmdfx.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\xfdmqfhm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\qoMfdDwx.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\xwDdfMoq.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xwDdfMoq.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xxyvVpMD.dll (Trojan.Vundo) -> Delete on reboot.

C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP799\A0169973.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

D:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\H01KLVEO\CA6NU7AH (Trojan.Vundo) -> Quarantined and deleted successfully.

D:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\PQ0SKLDE\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\capoeirafighter\capoeirafighter.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\capoeirafighter\capoeirafighter.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\capoeirafighter\capoeirafighter.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzflashdimension\dragonballzflashdimension.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzflashdimension\dragonballzflashdimension.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzflashdimension\dragonballzflashdimension.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzpong\dragonballzpong.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzpong\dragonballzpong.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\dragonballzpong\dragonballzpong.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\luigisrevengeinteractive\luigisrevengeinteractive.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\luigisrevengeinteractive\luigisrevengeinteractive.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\luigisrevengeinteractive\luigisrevengeinteractive.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\motocross\motocross.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\motocross\motocross.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\princeofpersia\princeofpersia.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\princeofpersia\princeofpersia.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\princeofpersia\princeofpersia.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\sonic\sonic.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\sonic\sonic.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\sonic\sonic.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\streetfighter\streetfighter.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\streetfighter\streetfighter.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\streetfighter\streetfighter.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\supersnowboardx\supersnowboardx.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\supersnowboardx\supersnowboardx.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\supersnowboardx\supersnowboardx.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\tabletennis\tabletennis.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\tabletennis\tabletennis.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\trampoline\trampoline.html (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\trampoline\trampoline.jpg (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\Program Files\InternetGameBox\ressources\favoris\content\favoris\trampoline\trampoline.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\rwfuwnqc.dll (Trojan.Agent) -> Delete on reboot.

C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

D:\Documents and Settings\Propriétaire\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.

2/ RAPPORT HIJACK

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:13:02, on 06/06/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\system32\UAService.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\svchost.exe

C:\Apps\Powercinema\PCMService.exe

C:\apps\ABoard\ABoard.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\apps\ABoard\AOSD.exe

C:\Program Files\Fichiers communs\Ulead Systems\AutoDetector\monitor.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe