Virus

Bonjour,

J'ai choppé un virus que je n'identifie pas et j'aurais besoin d'aide. J'ai fait quelques analyses et nettoyage,voici les logs:

Logfile of HijackThis v1.99.1
Scan saved at 22:32:53, on 27/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Eroca\Eroca.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\Excentrix\Excentrix.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\DOCUME~1\DAVIDM~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Documents and Settings\David Marchand\Bureau\hijack\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {97d73d82-ae10-b5c2-119b-a18f07567a92} - C:\WINDOWS\system32\rgiiyc.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe /normal-run2
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Eroca] C:\Program Files\Eroca\Eroca.exe
O4 - HKCU\..\Run: [Numpczrf] "C:\Program Files\s?stem32\w?aclt.exe"
O4 - HKCU\..\Run: [Eetr] "C:\PROGRA~1\SSTEM~1\cmd.exe" -vt yazb
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Excentrix.lnk = C:\WINDOWS\Excentrix\Excentrix.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

ComboFix 08-05-27.4 - David Marchand 2008-05-27 22:15:23.1 - [color=red][b]FAT32/b/colorx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.114 [GMT -4:00]
Endroit: C:\Documents and Settings\David Marchand\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!/b/color
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\David Marchand\Application Data\SpeedRunner
C:\Documents and Settings\David Marchand\Application Data\SpeedRunner\SpeedRunner.exe
C:\Documents and Settings\David Marchand\Application Data\SpeedRunner\SRUninstall.exe
C:\Documents and Settings\David Marchand\Menu Démarrer\Programmes\Outerinfo
C:\Documents and Settings\David Marchand\Menu Démarrer\Programmes\Outerinfo\Terms.lnk
C:\Documents and Settings\David Marchand\Menu Démarrer\Programmes\Outerinfo\Uninstall.lnk
C:\Program Files\sstem~1
C:\Program Files\sstem~1\cmd.exe
C:\Program Files\sstem~1\s?stem\
C:\Program Files\sstem3~1
C:\WINDOWS\BM04aabe31.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cmrtxhyw.dll
C:\WINDOWS\system32\fccaWolJ.dll
C:\WINDOWS\system32\hgGxXQiG.dll
C:\WINDOWS\system32\hjmshrhv.exe
C:\WINDOWS\system32\ibqrnspo.dll
C:\WINDOWS\system32\igrjccdk.exe
C:\WINDOWS\system32\JloWaccf.ini
C:\WINDOWS\system32\tgwjbtfv.exe
C:\WINDOWS\system32\wbvjdkjo.ini
C:\WINDOWS\system32\yemdwvro.dll
C:\Program Files\sstem3~1\w?aclt.exe . . . . Echec de suppression
C:\WINDOWS\system32\bqzpas.sys . . . . Echec de suppression

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_cmdservice
-------\Legacy_network_monitor
-------\Service_bqzpas

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-04-28 to 2008-05-28 ))))))))))))))))))))))))))))))))))))
.

2008-05-27 21:09 . 2008-05-27 21:09 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-05-27 20:24 . 2008-05-27 20:24 <REP> d-------- C:\Documents and Settings\David Marchand\Application Data\Malwarebytes
2008-05-27 20:23 . 2008-05-27 20:23 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-27 20:23 . 2008-05-27 20:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-27 20:23 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-27 20:23 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-27 20:21 . 2008-05-27 20:21 <REP> d--hs---- C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ
2008-05-27 20:04 . 2008-05-27 20:04 <REP> d-------- C:\WINDOWS\LastGood.Tmp
2008-05-27 20:00 . 2008-05-27 20:00 <REP> d-------- C:\Program Files\Eroca
2008-05-25 17:39 . 2008-05-25 19:45 4,982 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-25 16:49 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-05-25 16:49 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-05-25 16:49 . 2008-05-15 23:22 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-05-25 16:49 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-05-25 16:49 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\404Fix.exe
2008-05-25 16:49 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-05-25 16:49 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-25 16:49 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-11 19:11 . 2008-05-11 19:11 <REP> d--hs---- C:\FOUND.001
2008-05-04 19:16 . 57,776 C:\WINDOWS\system32\bqzpas.sys
2008-05-04 19:16 . 2008-05-27 20:57 27,136 --------- C:\WINDOWS\system32\winzoa32.dll
2008-05-04 19:16 . 2008-05-04 19:16 13,824 --a------ C:\uieqr.exe
2008-05-04 19:16 . 2008-05-04 19:21 2 --a------ C:\127503618

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2007-09-18 15:41 41,392 ----a-w C:\Documents and Settings\David Marchand\Application Data\GDIPFONTCACHEV1.DAT
2007-07-14 17:26 15,831,317 ----a-w C:\Program Files\YamiPod.exe
2007-04-27 20:36 781 ----a-w C:\Program Files\Readme.txt
2007-01-13 22:55 13,880 ----a-w C:\Program Files\googletoolbardownloader_fr_signed.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97d73d82-ae10-b5c2-119b-a18f07567a92}]
C:\WINDOWS\system32\rgiiyc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-04 19:23 68856]
"Eroca"="C:\Program Files\Eroca\Eroca.exe" [2008-05-27 20:00 125952]
"Numpczrf"="C:\Program Files\s?stem32\w?aclt.exe" [ ]
"Eetr"="C:\PROGRA~1\SSTEM~1\cmd.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
"LaunchApp"="" []
"RTHDCPL"="RTHDCPL.EXE" [2006-08-16 11:23 16248320 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-08-16 11:21 2879488 C:\WINDOWS\SkyTel.exe]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-08-16 11:20 53248]
"ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 11:15 45056]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-07-31 21:02 346112]
"Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-07-28 10:40 208896]
"eLockMonitor"="C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [ ]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-10 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-10 20:00 455168]
"ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-08-30 09:57 442368]
"Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-08-15 20:34 766041]
"eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-09-23 13:08 61440]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-01-15 03:10 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18 270648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\ABC\\ABC.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\uieqr.exe"=

R3 psdfilter;psdfilter;C:\WINDOWS\system32\Drivers\psdfilter.sys [2006-04-07 20:17]
R3 psdvdisk;psdvdisk;C:\WINDOWS\system32\Drivers\psdvdisk.sys [2006-03-08 17:10]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3983490b-d40b-11dc-b332-0016368d819e}]
\shell\autorun\command - F:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 22:19:35
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 7.0\READER\READER_SL.EXE
C:\ACER\EMPOWERING TECHNOLOGY\EPERFORMANCE\MEMCHECK.EXE
C:\ACER\EMPOWERING TECHNOLOGY\ACER.EMPOWERING.FRAMEWORK.LAUNCHER.EXE
C:\WINDOWS\EXCENTRIX\EXCENTRIX.EXE
C:\PROGRAM FILES\FICHIERS COMMUNS\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
C:\WINDOWS\EHOME\EHRECVR.EXE
C:\WINDOWS\EHOME\EHSCHED.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\ACER\EMPOWERING TECHNOLOGY\ELOCK\SERVICE\ELOCKSERV.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\DOCUME~1\DAVIDM~1\LOCALS~1\Temp\RtkBtMnt.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-05-27 22:22:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-28 02:22:20

Pre-Run: 9,487,810,560 octets libres
Post-Run: 9,679,339,520 octets libres

176 --- E O F --- 2008-05-26 02:53:35

SmitFraudFix v2.322

Rapport fait à 17:38:33,75, 25/05/2008
Executé à partir de C:\Documents and Settings\David Marchand\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est FAT32
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\uieqr.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\Excentrix\Excentrix.exe
C:\WINDOWS\mrofinu.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\DOCUME~1\DAVIDM~1\LOCALS~1\Temp\RtkBtMnt.exe
C:\WINDOWS\TEMP\D83E.tmp
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David Marchand

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\David Marchand\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DAVIDM~1\FAVORIS

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Helper\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="http://join2day.com/abc/S/shishkin/shishkin14.JPG"
"SubscribedURL"="http://join2day.com/abc/S/shishkin/shishkin14.JPG"
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="http://join2day.com/abc/S/shishkin/shishkin34.JPG"
"SubscribedURL"="http://join2day.com/abc/S/shishkin/shishkin34.JPG"
"FriendlyName"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\2]
"Source"="http://join2day.com/abc/S/shishkin/shishkin23.JPG"
"SubscribedURL"="http://join2day.com/abc/S/shishkin/shishkin23.JPG"
"FriendlyName"=""

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Atheros AR5005G Wireless Network Adapter - Miniport d'ordonnancement de paquets
DNS Server Search Order: 24.200.241.37
DNS Server Search Order: 24.201.245.77
DNS Server Search Order: 24.200.243.189

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0480DBCB-1C00-4B84-9A6D-35ED9C262EEA}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0480DBCB-1C00-4B84-9A6D-35ED9C262EEA}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0480DBCB-1C00-4B84-9A6D-35ED9C262EEA}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\..\{0480DBCB-1C00-4B84-9A6D-35ED9C262EEA}: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=24.200.241.37 24.201.245.77 24.200.243.189

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

BitDefender Online Scanner

Scan report generated at: Tue, May 27, 2008 - 21:55:50

Scan path: C:\;D:\;E:\;

Statistics

Time
00:43:34

Files
179763

Folders
6331

Boot Sectors
4

Archives
7798

Packed Files
11914

Results

Identified Viruses
16

Infected Files
39

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
36

Engines Info

Virus Definitions
1246895

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
16

Archive plugins
42

Unpack plugins
7

E-mail plugins
6

System plugins
5

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\WINDOWS\system32\crypts.dll
Infected with: Trojan.Downloader.Agent.ZJM

C:\WINDOWS\system32\crypts.dll
Deleted

C:\WINDOWS\system32\kcaqjwxm.dll
Infected with: Trojan.Vundo.EOG

C:\WINDOWS\system32\kcaqjwxm.dll
Deleted

C:\WINDOWS\system32\rbyfxdif.dll
Infected with: Trojan.Vundo.EOL

C:\WINDOWS\system32\rbyfxdif.dll
Deleted

C:\WINDOWS\system32\wukndfsk.dll
Infected with: Trojan.Vundo.EOG

C:\WINDOWS\system32\wukndfsk.dll
Deleted

C:\WINDOWS\system32\rynwnsaj.dll
Infected with: Trojan.Vundo.EOI

C:\WINDOWS\system32\rynwnsaj.dll
Deleted

C:\WINDOWS\system32\nojynmvi.dll
Infected with: Trojan.Vundo.EOL

C:\WINDOWS\system32\nojynmvi.dll
Deleted

C:\WINDOWS\Temp\D83E.tmp
Infected with: Trojan.Patched.BR

C:\WINDOWS\Temp\D83E.tmp
Disinfection failed

C:\WINDOWS\Temp\D83E.tmp
Deleted

C:\WINDOWS\Temp\A2CE.tmp
Infected with: Trojan.Patched.BR

C:\WINDOWS\Temp\A2CE.tmp
Disinfection failed

C:\WINDOWS\Temp\A2CE.tmp
Deleted

C:\WINDOWS\Temp\C02C.tmp
Infected with: Trojan.Patched.BR

C:\WINDOWS\Temp\C02C.tmp
Disinfection failed

C:\WINDOWS\Temp\C02C.tmp
Deleted

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\asappsrv.dll
Detected with: Adware.CommAd.A

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\asappsrv.dll
Deleted

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\command.exe
Infected with: Trojan.Generic.107114

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\command.exe
Deleted

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\l3IZuqk0nqIVsZ11vAk.vbs
Detected with: Adware.Isearch.D

C:\WINDOWS\RGF2aWQgTWFyY2hhbmQ\l3IZuqk0nqIVsZ11vAk.vbs
Deleted

C:\Documents and Settings\David Marchand\Local Settings\Temp\NDR7.tmp
Infected with: Trojan.Downloader.JJRL

C:\Documents and Settings\David Marchand\Local Settings\Temp\NDR7.tmp
Deleted

C:\Documents and Settings\David Marchand\Local Settings\Temp\!update.exe
Infected with: Trojan.Downloader.JJRL

C:\Documents and Settings\David Marchand\Local Settings\Temp\!update.exe
Deleted

C:\Documents and Settings\David Marchand\Local Settings\Temporary Internet Files\Content.IE5\C9QR0L6N\!update-4495[1].0000
Infected with: Trojan.Downloader.JJRL

C:\Documents and Settings\David Marchand\Local Settings\Temporary Internet Files\Content.IE5\C9QR0L6N\!update-4495[1].0000
Deleted

C:\Documents and Settings\David Marchand\Local Settings\Temporary Internet Files\Content.IE5\ORXZEU71\wssl62_c[1].exe
Infected with: Trojan.Patched.BR

C:\Documents and Settings\David Marchand\Local Settings\Temporary Internet Files\Content.IE5\ORXZEU71\wssl62_c[1].exe
Disinfection failed

C:\Documents and Settings\David Marchand\Local Settings\Temporary Internet Files\Content.IE5\ORXZEU71\wssl62_c[1].exe
Deleted

C:\Documents and Settings\David Marchand\Application Data\Microsoft\Windows\xktvhmx.exe
Infected with: Backdoor.Generic.48098

C:\Documents and Settings\David Marchand\Application Data\Microsoft\Windows\xktvhmx.exe
Disinfection failed

C:\Documents and Settings\David Marchand\Application Data\Microsoft\Windows\xktvhmx.exe
Delete failed

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.16768
Detected with: Adware.CommAd.A

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.16768
Deleted

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.49717
Infected with: Trojan.Downloader.Matcash.J

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.49717
Disinfection failed

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.49717
Deleted

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.76306
Infected with: Trojan.Generic.107114

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.76306
Deleted

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.83694
Detected with: Adware.Purityscan.JA

C:\Documents and Settings\David Marchand\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.83694
Deleted

C:\Program Files\SSTEM~1\cmd.exe
Detected with: Adware.Purityscan.JA

C:\Program Files\SSTEM~1\cmd.exe
Disinfection failed

C:\Program Files\SSTEM~1\cmd.exe
Delete failed

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047650.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047650.ini
Disinfection failed

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047650.ini
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047667.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047667.ini
Disinfection failed

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047667.ini
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047709.ini
Infected with: Trojan.Vundo.DVS

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047709.ini
Disinfection failed

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047709.ini
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047906.exe
Infected with: Trojan.Downloader.Matcash.J

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047906.exe
Disinfection failed

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047906.exe
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047907.exe
Infected with: Backdoor.Rustock.NDI

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047907.exe
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047913.exe
Infected with: Trojan.Packed.EK

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047913.exe
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047935.dll
Infected with: Trojan.Downloader.Agent.ZJM

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047935.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047936.dll
Infected with: Trojan.Vundo.EOG

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047936.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047937.dll
Infected with: Trojan.Vundo.EOL

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047937.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047938.dll
Infected with: Trojan.Vundo.EOG

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047938.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047939.dll
Infected with: Trojan.Vundo.EOI

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047939.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047940.dll
Infected with: Trojan.Vundo.EOL

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047940.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047941.dll
Detected with: Adware.CommAd.A

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047941.dll
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047942.exe
Infected with: Trojan.Generic.107114

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047942.exe
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047943.vbs
Detected with: Adware.Isearch.D

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047943.vbs
Deleted

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047944.exe
Infected with: Backdoor.Generic.48098

C:\System Volume Information\_restore{685E8917-F4C2-4917-B853-9933DBB20427}\RP244\A0047944.exe
Deleted

C:\uieqr.exe
Infected with: Trojan.Spy.ZBot.CB

C:\uieqr.exe
Disinfection failed

C:\uieqr.exe
Delete failed

MERCI!

Configuration: Windows XP
Internet Explorer 6.0