Antivirs 2009, au secours!!

Bonjour,
Merci pour tes conseils et je te joins en retour les résultats que tu m'as demandé, l'analyse VitumundoBegone a été faite après RSIT.exe proposé par Destrio5.
L'antivirus installé sur le Pc est OfficeScan de TrendMicro
Merci


VBG .txt :

[11/19/2008, 11:22:23] - VirtumundoBeGone v1.5 ( "E:\VirtumundoBeGone.exe" )
[11/19/2008, 11:22:34] - Detected System Information:
[11/19/2008, 11:22:34] - Windows Version: 5.1.2600, Service Pack 2
[11/19/2008, 11:22:34] - Current Username: rivgauch (Admin)
[11/19/2008, 11:22:34] - Windows is in NORMAL mode.
[11/19/2008, 11:22:34] - Searching for Browser Helper Objects:
[11/19/2008, 11:22:34] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:34] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:34] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:34] - BHO 5: {8F67E146-FB6C-418F-9FE5-37AA2206D92E} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\cbXRLbAt
[11/19/2008, 11:22:34] - Found: HKLM\...\Winlogon\Notify\cbXRLbAt - This is probably Virtumundo.
[11/19/2008, 11:22:34] - Assigning {8F67E146-FB6C-418F-9FE5-37AA2206D92E} MSEvents Object
[11/19/2008, 11:22:34] - BHO list has been changed! Starting over...
[11/19/2008, 11:22:34] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:34] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:34] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:34] - BHO 5: {8F67E146-FB6C-418F-9FE5-37AA2206D92E} (MSEvents Object)
[11/19/2008, 11:22:34] - ALERT: Found MSEvents Object!
[11/19/2008, 11:22:34] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 11:22:34] - BHO 7: {b93227db-845f-4849-b891-fd70d0c59a21} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\kkhqkj
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\kkhqkj, continuing.
[11/19/2008, 11:22:34] - BHO 8: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - Finished Searching Browser Helper Objects
[11/19/2008, 11:22:34] - *** Detected MSEvents Object
[11/19/2008, 11:22:34] - Trying to remove MSEvents Object...
[11/19/2008, 11:22:35] - Terminating Process: IEXPLORE.EXE
[11/19/2008, 11:22:36] - Terminating Process: RUNDLL32.EXE
[11/19/2008, 11:22:37] - Disabling Automatic Shell Restart
[11/19/2008, 11:22:37] - Terminating Process: EXPLORER.EXE
[11/19/2008, 11:22:37] - Suspending the NT Session Manager System Service
[11/19/2008, 11:22:37] - Terminating Windows NT Logon/Logoff Manager
[11/19/2008, 11:22:38] - Re-enabling Automatic Shell Restart
[11/19/2008, 11:22:38] - File to disable: C:\WINDOWS\system32\cbXRLbAt.dll
[11/19/2008, 11:22:38] - Renaming C:\WINDOWS\system32\cbXRLbAt.dll -> C:\WINDOWS\system32\cbXRLbAt.dll.vir
[11/19/2008, 11:22:38] - File successfully renamed!
[11/19/2008, 11:22:38] - Removing HKLM\...\Browser Helper Objects\{8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Removing HKCR\CLSID\{8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Adding Kill Bit for ActiveX for GUID: {8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Deleting ATLEvents/MSEvents Registry entries
[11/19/2008, 11:22:38] - Removing HKLM\...\Winlogon\Notify\cbXRLbAt
[11/19/2008, 11:22:38] - Searching for Browser Helper Objects:
[11/19/2008, 11:22:38] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:38] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:38] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:38] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - No filename found. Continuing.
[11/19/2008, 11:22:38] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:38] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 11:22:38] - BHO 6: {b93227db-845f-4849-b891-fd70d0c59a21} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - Checking for HKLM\...\Winlogon\Notify\kkhqkj
[11/19/2008, 11:22:38] - Key not found: HKLM\...\Winlogon\Notify\kkhqkj, continuing.
[11/19/2008, 11:22:38] - BHO 7: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - No filename found. Continuing.
[11/19/2008, 11:22:38] - Finished Searching Browser Helper Objects
[11/19/2008, 11:22:38] - Finishing up...
[11/19/2008, 11:22:38] - A restart is needed.
[11/19/2008, 11:22:49] - Attempting to Restart via STOP error (Blue Screen!)

___________________________________________________________________________________________


HIJACKTHIS :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:29:49, on 19/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\OfcPfwSvc.exe
C:\WINDOWS\TEMP\SHD4A9.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Documents and Settings\rivgauch\Bureau\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ac-caen.fr/calvados
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.64.29:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {659CF972-2485-4BC2-BFD8-30BF7310407B} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {12a95c0d-07df-198b-9484-f548bd72239b} - {b93227db-845f-4849-b891-fd70d0c59a21} - C:\WINDOWS\system32\kkhqkj.dll (file missing)
O2 - BHO: (no name) - {D8992A81-8A2C-467B-B3AC-34272BA29DEF} - C:\WINDOWS\system32\yayaWpnO.dll
O2 - BHO: (no name) - {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://anti-virus.in.ac-caen.fr/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/RemoveCtrl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE724185-F86A-4144-9BC5-43A761A1E72B}: NameServer = 192.168.114.5,172.30.64.21
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O20 - AppInit_DLLs: kkhqkj.dll
O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Pare-feu OfficeScanNT (OfcPfwSvc) - Trend Micro Inc. - C:\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\OfficeScan NT\tmlisten.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

Bonjour,

Merci pour ton courrier, je me permet de te retourner la réponse à ta proposition de démarche par la copie des 2 fichiers textes info et log :

INFO.txt logfile of random's system information tool 1.04 2008-11-19 11:06:12

======Uninstall list======

-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Broadcom Advanced Control Suite-->MsiExec.exe /I{058B32E2-6310-4359-B2D4-1988390C3B83}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\rivgauch\Bureau\HijackThis.exe" /uninstall
Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2776 PCI\VEN_8086&DEV_2772
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LiveUpdate 2.6 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office 2000 SR-1 Professional-->MsiExec.exe /I{0001040C-78E1-11D2-B60F-006097C998E7}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
NMAS Client-->MsiExec.exe /I{9B427732-573E-4E78-B6FA-AC3E5A218BA2}
OpenOffice.org 2.3-->MsiExec.exe /I{B087B0C3-F595-485A-B86B-73326BA8693A}
PDFCreator 0.7.1}-->C:\Program Files\PDFCreator\unins000.exe
PowerArchiver-->C:\Program Files\PowerArchiver\UNINST.EXE
PowerDVD 5.7-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
SearchAssist-->C:\DELL\SearchAssist\UninstSA.bat
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Trend Micro OfficeScan Client-->"C:\OfficeScan NT\ntrmv.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Trend Micro OfficeScan Client
AV: Trend Micro OfficeScan Client
FW: Pare-feu pour client - version d'entreprise Trend Micro OfficeScan
FW: Pare-feu pour client - version d'entreprise Trend Micro OfficeScan

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0409
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

___________________________________________________________________________________________


Logfile of random's system information tool 1.04 (written by random/random)
Run by rivgauch at 2008-11-19 11:05:24
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 67 GB (87%) free of 76 GB
Total RAM: 1014 MB (66% free)

LOGFILE of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:07, on 19/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\OfcPfwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\OfficeScan NT\pccntmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\TEMP\SZ6648.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\wscntfy.exe
C:\OfficeScan NT\pccntupd.exe
E:\RSIT.exe
C:\Program Files\trend micro\rivgauch.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ac-caen.fr/calvados
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.64.29:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {0215818D-615E-4864-9DDE-10B04A334A50} - C:\WINDOWS\system32\yayaWpnO.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {659CF972-2485-4BC2-BFD8-30BF7310407B} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {8F67E146-FB6C-418F-9FE5-37AA2206D92E} - C:\WINDOWS\system32\cbXRLbAt.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {12a95c0d-07df-198b-9484-f548bd72239b} - {b93227db-845f-4849-b891-fd70d0c59a21} - C:\WINDOWS\system32\kkhqkj.dll (file missing)
O2 - BHO: (no name) - {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://anti-virus.in.ac-caen.fr/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/RemoveCtrl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE724185-F86A-4144-9BC5-43A761A1E72B}: NameServer = 192.168.114.5,172.30.64.21
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O20 - AppInit_DLLs: kkhqkj.dll
O20 - Winlogon Notify: cbXRLbAt - C:\WINDOWS\SYSTEM32\cbXRLbAt.dll
O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Pare-feu OfficeScanNT (OfcPfwSvc) - Trend Micro Inc. - C:\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\OfficeScan NT\tmlisten.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

Re,

Aucun prg comme : " CID Help ", "Circle Developement" ou "Adverts

Voici le rapport de LopSD :

--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) CPU 3.06GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A07
USER : rivgauch ( Administrator )
BOOT : Normal boot
Antivirus : Trend Micro OfficeScan Client 7.3 (Activated)
Firewall : Pare-feu pour client - version d'entreprise Trend Micro OfficeScan 7.3 (Activated)
C:\ (Local Disk) - NTFS - Total:74 Go (Free:64 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( 19/11/2008|14:25 )

--------------------\\ Listing des dossiers dans APPLIC~1

[06/12/2006|15:23] C:\DOCUME~1\admin\APPLIC~1\Adobe
[19/08/2004|14:24] C:\DOCUME~1\admin\APPLIC~1\Identities
[06/12/2006|16:03] C:\DOCUME~1\admin\APPLIC~1\Microsoft
[06/12/2006|13:26] C:\DOCUME~1\admin\APPLIC~1\Microsoft Web Folders
[06/12/2006|13:52] C:\DOCUME~1\admin\APPLIC~1\OfficeUpdate12
[06/12/2006|14:00] C:\DOCUME~1\admin\APPLIC~1\PDFCreator
[07/12/2006|09:49] C:\DOCUME~1\admin\APPLIC~1\Symantec

[19/08/2004|14:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
[19/08/2004|14:10] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[13/02/2008|09:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[28/08/2008|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[19/11/2008|12:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[04/07/2008|13:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[19/08/2004|14:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[29/08/2008|07:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[10/01/2007|09:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
[06/12/2006|12:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[04/07/2008|13:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

[19/08/2004|14:24] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[19/08/2004|14:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[19/08/2004|14:10] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[19/08/2004|14:10] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[03/11/2008|14:28] C:\DOCUME~1\rivgauch\APPLIC~1\Adobe
[29/04/2008|10:30] C:\DOCUME~1\rivgauch\APPLIC~1\CyberLink
[27/09/2007|13:53] C:\DOCUME~1\rivgauch\APPLIC~1\Help
[19/08/2004|14:24] C:\DOCUME~1\rivgauch\APPLIC~1\Identities
[03/10/2007|09:02] C:\DOCUME~1\rivgauch\APPLIC~1\Macromedia
[19/11/2008|12:01] C:\DOCUME~1\rivgauch\APPLIC~1\Malwarebytes
[04/07/2008|13:07] C:\DOCUME~1\rivgauch\APPLIC~1\Microsoft
[19/11/2008|11:57] C:\DOCUME~1\rivgauch\APPLIC~1\Mozilla
[19/11/2008|14:06] C:\DOCUME~1\rivgauch\APPLIC~1\OpenOffice.org2
[22/05/2008|15:19] C:\DOCUME~1\rivgauch\APPLIC~1\PDFcreator
[16/06/2008|14:55] C:\DOCUME~1\rivgauch\APPLIC~1\Sun

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[19/11/2008 14:05][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[25/06/2008|07:38] C:\Program Files\Adobe
[19/11/2006|17:50] C:\Program Files\Analog Devices
[19/11/2006|18:04] C:\Program Files\BAE
[28/08/2008|09:57] C:\Program Files\CCleaner
[19/08/2004|14:15] C:\Program Files\ComPlus Applications
[19/11/2006|18:04] C:\Program Files\CyberLink
[28/10/2008|15:39] C:\Program Files\Disney Interactive
[04/07/2008|13:03] C:\Program Files\Fichiers communs
[10/10/2008|13:31] C:\Program Files\InstallShield Installation Information
[13/11/2008|17:08] C:\Program Files\Internet Explorer
[28/08/2008|09:42] C:\Program Files\Java
[19/11/2008|12:01] C:\Program Files\Malwarebytes' Anti-Malware
[13/11/2008|17:12] C:\Program Files\Messenger
[13/09/2007|15:05] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[19/08/2004|14:18] C:\Program Files\microsoft frontpage
[06/12/2006|13:26] C:\Program Files\Microsoft Office
[04/07/2008|13:07] C:\Program Files\Microsoft SQL Server Compact Edition
[06/12/2006|13:28] C:\Program Files\Microsoft Visual Studio
[13/11/2008|17:03] C:\Program Files\Movie Maker
[19/11/2008|14:14] C:\Program Files\Mozilla Firefox
[10/10/2008|14:00] C:\Program Files\msn
[19/08/2004|14:14] C:\Program Files\MSN Gaming Zone
[13/11/2008|17:03] C:\Program Files\NetMeeting
[28/08/2008|09:17] C:\Program Files\OCS Inventory Agent
[07/03/2008|11:55] C:\Program Files\OpenOffice.org 2.3
[13/11/2008|17:03] C:\Program Files\Outlook Express
[06/12/2006|14:00] C:\Program Files\PDFCreator
[06/12/2006|13:59] C:\Program Files\PowerArchiver
[19/08/2004|14:16] C:\Program Files\Services en ligne
[06/12/2006|13:51] C:\Program Files\Snapshot Viewer
[10/10/2008|14:20] C:\Program Files\Spybot - Search & Destroy
[10/10/2008|13:31] C:\Program Files\Symantec
[19/11/2008|11:06] C:\Program Files\trend micro
[19/08/2004|14:24] C:\Program Files\Uninstall Information
[12/11/2007|16:52] C:\Program Files\Windows Media Connect 2
[13/11/2008|17:04] C:\Program Files\Windows Media Player
[13/11/2008|17:01] C:\Program Files\Windows NT
[19/08/2004|14:16] C:\Program Files\WindowsUpdate
[19/08/2004|14:18] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[13/02/2008|09:36] C:\Program Files\Fichiers communs\Adobe
[06/12/2006|13:28] C:\Program Files\Fichiers communs\Designer
[06/12/2006|15:14] C:\Program Files\Fichiers communs\InstallShield
[19/11/2006|18:01] C:\Program Files\Fichiers communs\Java
[04/07/2008|13:05] C:\Program Files\Fichiers communs\Microsoft Shared
[19/08/2004|14:16] C:\Program Files\Fichiers communs\MSSoap
[19/08/2004|14:10] C:\Program Files\Fichiers communs\ODBC
[19/08/2004|14:16] C:\Program Files\Fichiers communs\Services
[19/08/2004|14:10] C:\Program Files\Fichiers communs\SpeechEngines
[10/01/2007|09:32] C:\Program Files\Fichiers communs\Symantec Shared
[13/11/2008|17:03] C:\Program Files\Fichiers communs\System
[04/07/2008|13:04] C:\Program Files\Fichiers communs\WindowsLiveInstaller

--------------------\\ Process

( 34 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\rivgauch\LOCALS~1\Temp\nsb1D4.tmp
C:\DOCUME~1\rivgauch\LOCALS~1\Temp\nsb1D5.tmp
C:\DOCUME~1\rivgauch\Cookies\rivgauch@advertising[2].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@adin.bigpoint[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.seafight.bigpoint[2].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.thepimps.bigpoint[2].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@banner.cotedazurpalace[2].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@cotedazurpalace[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@www.cotedazurpalace[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@adopt.euroclick[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@partygaming.122.2o7[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@partypoker[1].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.seafight.bigpoint[2].txt
C:\DOCUME~1\rivgauch\Cookies\rivgauch@banner.32vegas[2].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE


--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-19 14:27:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[F:36][D:8]-> C:\DOCUME~1\rivgauch\LOCALS~1\Temp
[F:95][D:0]-> C:\DOCUME~1\rivgauch\Cookies
[F:1594][D:4]-> C:\DOCUME~1\rivgauch\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 19/11/2008|14:27 - Option : [1]

--------------------\\ Fin du rapport a 14:27:58

Merci

Merci, alors dans l'ordre comme demandé :

Rapport OTMoveIt3 :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Amok Eggs Four Web\\ deleted successfully.
========== FILES ==========
File/Folder C:\Documents and Settings\All Users\Application Data\part dead amok eggs not found.
File/Folder C:\DOCUME~1\rivgauch\LOCALS~1\Temp\nsb1D4.tmp not found.
File/Folder C:\DOCUME~1\rivgauch\LOCALS~1\Temp\nsb1D5.tmp not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@advertising[2].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@adin.bigpoint[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.seafight.bigpoint[2].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.thepimps.bigpoint[2].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@banner.cotedazurpalace[2].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@cotedazurpalace[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@www.cotedazurpalace[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@adopt.euroclick[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@partygaming.122.2o7[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@partypoker[1].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@fr.seafight.bigpoint[2].txt not found.
File/Folder C:\DOCUME~1\rivgauch\Cookies\rivgauch@banner.32vegas[2].txt not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\WU9CA0.EXE scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11192008_171608

Files moved on Reboot...
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\WU9CA0.EXE not found!





Puis rapport VirtumundoBeGone :


[11/19/2008, 11:22:23] - VirtumundoBeGone v1.5 ( "E:\VirtumundoBeGone.exe" )
[11/19/2008, 11:22:34] - Detected System Information:
[11/19/2008, 11:22:34] - Windows Version: 5.1.2600, Service Pack 2
[11/19/2008, 11:22:34] - Current Username: rivgauch (Admin)
[11/19/2008, 11:22:34] - Windows is in NORMAL mode.
[11/19/2008, 11:22:34] - Searching for Browser Helper Objects:
[11/19/2008, 11:22:34] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:34] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:34] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:34] - BHO 5: {8F67E146-FB6C-418F-9FE5-37AA2206D92E} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\cbXRLbAt
[11/19/2008, 11:22:34] - Found: HKLM\...\Winlogon\Notify\cbXRLbAt - This is probably Virtumundo.
[11/19/2008, 11:22:34] - Assigning {8F67E146-FB6C-418F-9FE5-37AA2206D92E} MSEvents Object
[11/19/2008, 11:22:34] - BHO list has been changed! Starting over...
[11/19/2008, 11:22:34] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:34] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:34] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:34] - BHO 5: {8F67E146-FB6C-418F-9FE5-37AA2206D92E} (MSEvents Object)
[11/19/2008, 11:22:34] - ALERT: Found MSEvents Object!
[11/19/2008, 11:22:34] - BHO 6: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 11:22:34] - BHO 7: {b93227db-845f-4849-b891-fd70d0c59a21} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - Checking for HKLM\...\Winlogon\Notify\kkhqkj
[11/19/2008, 11:22:34] - Key not found: HKLM\...\Winlogon\Notify\kkhqkj, continuing.
[11/19/2008, 11:22:34] - BHO 8: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 11:22:34] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:34] - No filename found. Continuing.
[11/19/2008, 11:22:34] - Finished Searching Browser Helper Objects
[11/19/2008, 11:22:34] - *** Detected MSEvents Object
[11/19/2008, 11:22:34] - Trying to remove MSEvents Object...
[11/19/2008, 11:22:35] - Terminating Process: IEXPLORE.EXE
[11/19/2008, 11:22:36] - Terminating Process: RUNDLL32.EXE
[11/19/2008, 11:22:37] - Disabling Automatic Shell Restart
[11/19/2008, 11:22:37] - Terminating Process: EXPLORER.EXE
[11/19/2008, 11:22:37] - Suspending the NT Session Manager System Service
[11/19/2008, 11:22:37] - Terminating Windows NT Logon/Logoff Manager
[11/19/2008, 11:22:38] - Re-enabling Automatic Shell Restart
[11/19/2008, 11:22:38] - File to disable: C:\WINDOWS\system32\cbXRLbAt.dll
[11/19/2008, 11:22:38] - Renaming C:\WINDOWS\system32\cbXRLbAt.dll -> C:\WINDOWS\system32\cbXRLbAt.dll.vir
[11/19/2008, 11:22:38] - File successfully renamed!
[11/19/2008, 11:22:38] - Removing HKLM\...\Browser Helper Objects\{8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Removing HKCR\CLSID\{8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Adding Kill Bit for ActiveX for GUID: {8F67E146-FB6C-418F-9FE5-37AA2206D92E}
[11/19/2008, 11:22:38] - Deleting ATLEvents/MSEvents Registry entries
[11/19/2008, 11:22:38] - Removing HKLM\...\Winlogon\Notify\cbXRLbAt
[11/19/2008, 11:22:38] - Searching for Browser Helper Objects:
[11/19/2008, 11:22:38] - BHO 1: {0215818D-615E-4864-9DDE-10B04A334A50} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - Checking for HKLM\...\Winlogon\Notify\yayaWpnO
[11/19/2008, 11:22:38] - Key not found: HKLM\...\Winlogon\Notify\yayaWpnO, continuing.
[11/19/2008, 11:22:38] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 11:22:38] - BHO 3: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - No filename found. Continuing.
[11/19/2008, 11:22:38] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 11:22:38] - BHO 5: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 11:22:38] - BHO 6: {b93227db-845f-4849-b891-fd70d0c59a21} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - Checking for HKLM\...\Winlogon\Notify\kkhqkj
[11/19/2008, 11:22:38] - Key not found: HKLM\...\Winlogon\Notify\kkhqkj, continuing.
[11/19/2008, 11:22:38] - BHO 7: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 11:22:38] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 11:22:38] - No filename found. Continuing.
[11/19/2008, 11:22:38] - Finished Searching Browser Helper Objects
[11/19/2008, 11:22:38] - Finishing up...
[11/19/2008, 11:22:38] - A restart is needed.
[11/19/2008, 11:22:49] - Attempting to Restart via STOP error (Blue Screen!)

[11/19/2008, 16:01:10] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\rivgauch\Bureau\VirtumundoBeGone.exe" )
[11/19/2008, 16:01:13] - Detected System Information:
[11/19/2008, 16:01:13] - Windows Version: 5.1.2600, Service Pack 2
[11/19/2008, 16:01:13] - Current Username: rivgauch (Admin)
[11/19/2008, 16:01:13] - Windows is in NORMAL mode.
[11/19/2008, 16:01:13] - Searching for Browser Helper Objects:
[11/19/2008, 16:01:13] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 16:01:13] - BHO 2: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 16:01:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 16:01:13] - No filename found. Continuing.
[11/19/2008, 16:01:13] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 16:01:13] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 16:01:13] - BHO 5: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 16:01:13] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 16:01:13] - No filename found. Continuing.
[11/19/2008, 16:01:13] - Finished Searching Browser Helper Objects
[11/19/2008, 16:01:13] - Finishing up...
[11/19/2008, 16:01:13] - Nothing found! Exiting...

[11/19/2008, 17:24:46] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\rivgauch\Bureau\VirtumundoBeGone.exe" )
[11/19/2008, 17:24:49] - Detected System Information:
[11/19/2008, 17:24:49] - Windows Version: 5.1.2600, Service Pack 2
[11/19/2008, 17:24:49] - Current Username: rivgauch (Admin)
[11/19/2008, 17:24:49] - Windows is in NORMAL mode.
[11/19/2008, 17:24:49] - Searching for Browser Helper Objects:
[11/19/2008, 17:24:49] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)
[11/19/2008, 17:24:49] - BHO 2: {659CF972-2485-4BC2-BFD8-30BF7310407B} ()
[11/19/2008, 17:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 17:24:49] - No filename found. Continuing.
[11/19/2008, 17:24:49] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/19/2008, 17:24:49] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[11/19/2008, 17:24:49] - BHO 5: {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} ()
[11/19/2008, 17:24:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/19/2008, 17:24:49] - No filename found. Continuing.
[11/19/2008, 17:24:49] - Finished Searching Browser Helper Objects
[11/19/2008, 17:24:49] - Finishing up...
[11/19/2008, 17:24:49] - Nothing found! Exiting...





Et enfin le rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25, on 2008-11-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\OfcPfwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\TEMP\TK9FAC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\OfficeScan NT\pccntmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\rivgauch\Bureau\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ac-caen.fr/calvados
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.64.29:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {659CF972-2485-4BC2-BFD8-30BF7310407B} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://anti-virus.in.ac-caen.fr/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/RemoveCtrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE724185-F86A-4144-9BC5-43A761A1E72B}: NameServer = 192.168.114.5,172.30.64.21
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Pare-feu OfficeScanNT (OfcPfwSvc) - Trend Micro Inc. - C:\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\OfficeScan NT\tmlisten.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

OK, Je dois partir, mais je reprend le contact demain si tu veux bien, en attendant bonne soirée...


Rapport Malwarebytes' Anti-Malware :

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1411
Windows 5.1.2600 Service Pack 2

2008-11-19 18:17:18
mbam-log-2008-11-19 (18-17-18).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 80224
Temps écoulé: 19 minute(s), 54 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001340.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001341.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001342.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001343.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001344.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP3\A0001345.dll (Trojan.Vundo) -> Quarantined and deleted successfully.


Et, rapport HJT :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:20, on 2008-11-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\tmlisten.exe
C:\OfficeScan NT\OfcPfwSvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\OfficeScan NT\pccntupd.exe
C:\WINDOWS\TEMP\MAC1B0.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\rivgauch\Bureau\HJT.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ac-caen.fr/calvados
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.64.29:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {659CF972-2485-4BC2-BFD8-30BF7310407B} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {DE7B29D6-CB14-4A54-B13C-0D1AC53A82E8} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/WinNTChk.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/setup.cab
O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://anti-virus.in.ac-caen.fr/officescan/console/html/AtxEnc.cab
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - https://anti-virus.in.ac-caen.fr/officescan/console/ClientInstall/RemoveCtrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE724185-F86A-4144-9BC5-43A761A1E72B}: NameServer = 192.168.114.5,172.30.64.21
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = i14.in.ac-caen.fr,in.ac-caen.fr,ac-caen.fr
O23 - Service: Scan en temps réel OfficeScanNT (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: Pare-feu OfficeScanNT (OfcPfwSvc) - Trend Micro Inc. - C:\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\OfficeScan NT\tmlisten.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing)

Bonjour,

Voilà la suite de l'histoire... :

Il s'agit du fichier IZFF2D.EXE, qui se trouvait dans le répertoire (C:\WINDOWS\TEMP) à la place de MAC1B0.EXE !

Fichier IZFF2D.EXE reçu le 2008.11.20 15:10:48 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 2/36 (5.56%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 5.
L'heure estimée de démarrage est entre 70 et 100 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.20.3 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.19 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 Suspicious:W32/Dzan!Gemini
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.528 2008.11.19 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5439 2008.11.19 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.19 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 Porn-Dialer.Win32.CapreDeam.N (vf)
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.19 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.19 -
Information additionnelle
File size: 176195 bytes
MD5...: eaef75ea25567ddadcc99105ff8931fa
SHA1..: a9481771430281b8c6b73b3dad05ad443ec178b3
SHA256: d553e507140f506c5d2b2c63f2c38e86c3e58ff273fd785fe0af2ff675ea5b35
SHA512: e56b94c8126b3a367279572a3df7bd6ab3af2d50f0456dc587307cc392830049
24a4ee11c0666a7828dbb22672deace08c6cf1da51a78626c59ace964f597ecb
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40e426
timedatestamp.....: 0x47020e60 (Tue Oct 02 09:24:48 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1d0ea 0x1e000 6.51 09a89134c2a0569c65116166e2df6aa3
.rdata 0x1f000 0x54e3 0x6000 4.61 1d9ee7e1df347f14cb2972a96a2697d1
.data 0x25000 0x8d28 0x5000 2.98 f899b6d3df9a7f9fd3a63ceadcfffbf0
.rsrc 0x2e000 0x508 0x1000 0.88 920c524c82573abb4a0a4a4c80970f40

( 7 imports )
> WSOCK32.dll: -, -, -
> KERNEL32.dll: GetCurrentProcess, WriteFile, SetFilePointer, GetOEMCP, GetFileAttributesA, FlushFileBuffers, RtlUnwind, GetACP, CreateThread, ExitThread, GetTimeZoneInformation, GetSystemTime, GetLocalTime, GetStartupInfoA, GetCommandLineA, ExitProcess, HeapAlloc, HeapFree, RaiseException, HeapSize, GetCPInfo, GetProcessVersion, GlobalFlags, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, IsBadWritePtr, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetProcAddress, LoadLibraryA, GetCurrentProcessId, lstrcatA, lstrcpyA, WriteProcessMemory, ReadProcessMemory, CloseHandle, OpenProcess, GetExitCodeThread, WaitForSingleObject, GetModuleHandleA, CreateMutexA, GetLastError, GetSystemDirectoryA, TlsGetValue, ResumeThread, GlobalAlloc, LocalReAlloc, TlsSetValue, GlobalReAlloc, GlobalLock, HeapReAlloc, GlobalFree, ResetEvent, LeaveCriticalSection, GlobalHandle, GlobalUnlock, SetLastError, TlsAlloc, lstrcpynA, LCMapStringA, FreeLibrary, SetEvent, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpA, MultiByteToWideChar, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, WaitForMultipleObjects, lstrlenA, LocalAlloc, LocalFree, GetModuleFileNameA, TerminateProcess, MoveFileExA, GetVersion, VirtualAlloc, DeleteFileA, GetTickCount, GetPrivateProfileIntA, CopyFileA, CreateProcessA, Sleep, GetVersionExA, GetComputerNameA, GetTempPathA, GetTempFileNameA, DeleteCriticalSection, CreateEventA, InitializeCriticalSection, GetCurrentDirectoryA, lstrcmpiA, OpenFile, FindFirstFileA, FindNextFileA, FindClose, EnterCriticalSection, _lclose, LCMapStringW, GetStringTypeA, GetStringTypeW
> USER32.dll: LoadStringA, GetNextDlgTabItem, EnableMenuItem, CheckMenuItem, MapWindowPoints, SetMenuItemBitmaps, ModifyMenuA, GetMenuState, LoadBitmapA, GetMenuCheckMarkDimensions, SetWindowTextA, IsWindowEnabled, GetClassNameA, PtInRect, ClientToScreen, GetSysColorBrush, ReleaseDC, GetDC, DestroyMenu, TabbedTextOutA, DrawTextA, GrayStringA, PeekMessageA, GetFocus, SetFocus, AdjustWindowRectEx, GetClientRect, CopyRect, GetSysColor, EnableWindow, GetTopWindow, MessageBoxA, GetParent, GetCapture, WinHelpA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetDlgItem, GetWindowTextA, GetDlgCtrlID, GetKeyState, SetWindowsHookExA, CallNextHookEx, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, GetMessageTime, GetMessagePos, GetForegroundWindow, SetForegroundWindow, GetWindow, GetWindowLongA, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, SendMessageA, PostMessageA, FindWindowA, wsprintfA, KillTimer, DestroyWindow, SetTimer, PostQuitMessage, DefWindowProcA, CreateWindowExA, ShowWindow, UpdateWindow, LoadIconA, LoadCursorA, RegisterClassExA, GetMessageA, DispatchMessageA, TranslateMessage, RegisterWindowMessageA, RemovePropA, CallWindowProcA, SetWindowLongA, SetWindowPos, GetLastActivePopup
> GDI32.dll: SetBkColor, SetTextColor, GetObjectA, CreateBitmap, DeleteObject, GetDeviceCaps, DeleteDC, SaveDC, RestoreDC, SelectObject, GetStockObject, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, PtVisible, RectVisible, ExtTextOutA, Escape, TextOutA
> WINSPOOL.DRV: OpenPrinterA, DocumentPropertiesA, ClosePrinter
> ADVAPI32.dll: CreateServiceA, QueryServiceStatus, RegQueryValueExA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, QueryServiceConfigA, RegDeleteValueA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA, StartServiceA, RegCloseKey, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, DeleteService, RegNotifyChangeKeyValue
> COMCTL32.dll: -

( 59 exports )
__0TmProcessGuard@@QAE@KHH@Z, __0TmProcessGuard@@QAE@PBD0HH@Z, __0TmProcessGuard@@QAE@XZ, __0TmServiceGuard@@QAE@PBD00HH@Z, __0TmServiceGuard@@QAE@PBDKHH@Z, __0TmServiceGuard@@QAE@XZ, __1TmProcessGuard@@UAE@XZ, __1TmServiceGuard@@UAE@XZ, __4TmProcessGuard@@QAEXAAV0@@Z, __4TmServiceGuard@@QAEXAAV0@@Z, ___7TmProcessGuard@@6B@, ___7TmServiceGuard@@6B@, _BackupService@TmServiceGuard@@IAEXXZ, _CheckProcess@TmProcessGuard@@QAE_NAAVCStringArray@@@Z, _GetGuardInfo@TmProcessGuard@@QBEXAAKAAVCString@@1AAH2@Z, _IsIPChanged@@YA_NPBDPADH@Z, _IsMonitor@TmProcessGuard@@IBE_NXZ, _IsNTPlatform@@YA_NXZ, _IsProcessAlive@TmProcessGuard@@MAE_NXZ, _IsProcessAlive@TmServiceGuard@@MAE_NXZ, _IsRetryNow@TmProcessGuard@@IBE_NXZ, _IsTheSame@TmProcessGuard@@QBE_NABVCString@@0@Z, _IsTheSame@TmProcessGuard@@QBE_NK@Z, _IsTheSame@TmProcessGuard@@QBE_NPBV1@@Z, _IsValidProcess@TmProcessGuard@@QBE_NXZ, _QueryAllLog@TmProcessGuard@@QBEXAAVCStringArray@@@Z, _RegWatchDog_Ofc@@YA_NXZ, _RegWatchDog_Ofc_95@@YA_NXZ, _RegWatchDog_Ofc_NTRT@@YA_NXZ, _RegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ, _RegWatchDog_Ofc_PCCNTMON@@YA_NXZ, _RegWatchDog_Ofc_TMLISTEN@@YA_NXZ, _ResetMonitor@TmProcessGuard@@IAEXXZ, _ResetRetryCount@TmProcessGuard@@QAEXXZ, _ResetRetryTick@TmProcessGuard@@QAEXXZ, _ResetRetryVar@TmProcessGuard@@QAEXXZ, _RetryWakeupProcess@TmProcessGuard@@MAE_NXZ, _RetryWakeupProcess@TmServiceGuard@@MAE_NXZ, _SetMonitor@TmProcessGuard@@IAEXXZ, _SetProcessID@TmProcessGuard@@QAEXK@Z, _SetRetryCountLimit@TmProcessGuard@@QAEXH@Z, _SetRetryTickLimit@TmProcessGuard@@QAEXH@Z, _StepMonitor@TmProcessGuard@@IAEXXZ, _StepRetry@TmProcessGuard@@IAEXXZ, _UnRegWatchDog_Ofc@@YA_NXZ, _UnRegWatchDog_Ofc_95@@YA_NXZ, _UnRegWatchDog_Ofc_NTRT@@YA_NXZ, _UnRegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ, _UnRegWatchDog_Ofc_PCCNTMON@@YA_NXZ, _UnRegWatchDog_Ofc_TMLISTEN@@YA_NXZ, C_IsIPChanged, C_RegWatchDog_Ofc, C_RegWatchDog_Ofc_OFCPFWSVC, C_RegWatchDog_Ofc_PCCNTMON, C_RegWatchDog_Ofc_TMLISTEN, C_UnRegWatchDog_Ofc, C_UnRegWatchDog_Ofc_OFCPFWSVC, C_UnRegWatchDog_Ofc_PCCNTMON, C_UnRegWatchDog_Ofc_TMLISTEN



et, pour le fichier C:\OfficeScan NT\pccntupd.exe :

Fichier PccNTUpd.exe reçu le 2008.11.20 15:16:00 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 1/36 (2.78%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 2.
L'heure estimée de démarrage est entre 46 et 66 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Formaté
Impression des résultats Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.

Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.20.3 2008.11.20 -
AntiVir 7.9.0.34 2008.11.20 -
Authentium 5.1.0.4 2008.11.20 -
Avast 4.8.1281.0 2008.11.19 -
AVG 8.0.0.199 2008.11.20 -
BitDefender 7.2 2008.11.20 -
CAT-QuickHeal 10.00 2008.11.20 -
ClamAV 0.94.1 2008.11.20 -
DrWeb 4.44.0.09170 2008.11.20 -
eSafe 7.0.17.0 2008.11.19 -
eTrust-Vet 31.6.6219 2008.11.20 -
Ewido 4.0 2008.11.20 -
F-Prot 4.4.4.56 2008.11.20 -
F-Secure 8.0.14332.0 2008.11.20 -
Fortinet 3.117.0.0 2008.11.20 -
GData 19 2008.11.20 -
Ikarus T3.1.1.45.0 2008.11.20 -
K7AntiVirus 7.10.528 2008.11.19 -
Kaspersky 7.0.0.125 2008.11.20 -
McAfee 5439 2008.11.19 -
Microsoft 1.4104 2008.11.20 -
NOD32 3627 2008.11.20 -
Norman 5.80.02 2008.11.19 -
Panda 9.0.0.4 2008.11.20 -
PCTools 4.4.2.0 2008.11.20 -
Prevx1 V2 2008.11.20 -
Rising 21.04.32.00 2008.11.20 -
SecureWeb-Gateway 6.7.6 2008.11.20 -
Sophos 4.35.0 2008.11.20 -
Sunbelt 3.1.1801.2 2008.11.14 Porn-Dialer.Win32.CapreDeam.N (vf)
Symantec 10 2008.11.20 -
TheHacker 6.3.1.1.159 2008.11.19 -
TrendMicro 8.700.0.1004 2008.11.20 -
VBA32 3.12.8.9 2008.11.19 -
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.19 -
Information additionnelle
File size: 118861 bytes
MD5...: c4f9f5cb0c40cef17a2d98be4ef357bf
SHA1..: bc22d7aace943fba6b11e432f7e96e71460e622c
SHA256: 84a86e39bc74df817ae160e26efbf0ad6425e174a9a80b0d3893f4f3182de921
SHA512: 81d4b7a7f07afa049834e8f2eb2ecc6a3f91e9b24997cff380fe00a8bd9f18ff
429b26d76f1aaf40c17488601c103bbe12f3ecafa9051c1d8f19b49b3b494915
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x405230
timedatestamp.....: 0x44310afc (Mon Apr 03 11:46:04 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x114e6 0x12000 6.44 312ac585884ca4bf1d041016b07fd07e
.rdata 0x13000 0x3f26 0x4000 4.78 c2a5b02b6de8bcfbc7f4c894d55e0213
.data 0x17000 0x8469 0x5000 3.23 e1fd39963a0a8dfd3f3055dddecac7d3
.rsrc 0x20000 0x438 0x1000 1.13 df9186414b05adfc225987d593a7cc92

( 8 imports )
> KERNEL32.dll: GetExitCodeProcess, GetLastError, MultiByteToWideChar, CloseHandle, GetVersion, GetPrivateProfileStringA, GetVersionExA, CreateProcessA, Sleep, GetTickCount, InterlockedDecrement, SetLastError, lstrcpynA, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, TerminateProcess, OpenProcess, LocalFree, TlsAlloc, GlobalFree, GlobalUnlock, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalAlloc, TlsSetValue, LocalReAlloc, TlsGetValue, WideCharToMultiByte, InterlockedIncrement, GetCurrentThreadId, GetModuleHandleA, GlobalDeleteAtom, GlobalFindAtomA, GlobalAddAtomA, lstrcmpiA, EnterCriticalSection, LoadLibraryA, FreeLibrary, GetProcessVersion, lstrcmpA, GlobalFlags, GetCPInfo, GetOEMCP, LocalAlloc, CreateThread, GetCurrentProcess, WriteFile, SetFilePointer, FlushFileBuffers, GetFileAttributesA, GetACP, RtlUnwind, HeapFree, HeapAlloc, GetStartupInfoA, GetCommandLineA, ExitProcess, RaiseException, HeapSize, HeapReAlloc, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, lstrlenA, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, GetSystemDefaultLangID, lstrcpyA, GetExitCodeThread, WaitForMultipleObjects, GetWindowsDirectoryA, CreateEventA, GetProcAddress, OpenEventA, GetModuleFileNameA, GlobalGetAtomNameA, lstrcatA, GetFileType
> USER32.dll: GetMenuState, GetMenuCheckMarkDimensions, GetSystemMetrics, GetWindowRect, GetWindowPlacement, IsIconic, SystemParametersInfoA, RegisterWindowMessageA, SetWindowPos, SetWindowLongA, GetWindow, SetForegroundWindow, GetForegroundWindow, GetMessagePos, GetMessageTime, RemovePropA, CallWindowProcA, GetPropA, SetPropA, GetClassLongA, DestroyWindow, GetDlgCtrlID, GetWindowTextA, GetDlgItem, GetMenuItemID, GetSubMenu, GetMenuItemCount, GetMenu, GetClassInfoA, WinHelpA, GetCapture, GetTopWindow, CopyRect, GetClientRect, ModifyMenuA, LoadBitmapA, GetSysColor, MapWindowPoints, SetWindowTextA, GetSysColorBrush, ReleaseDC, GetDC, GetClassNameA, PtInRect, ClientToScreen, DestroyMenu, GetFocus, TabbedTextOutA, DrawTextA, GrayStringA, GetNextDlgTabItem, GetKeyState, CallNextHookEx, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, EnableWindow, UnhookWindowsHookEx, LoadStringA, EnableMenuItem, SetMenuItemBitmaps, CheckMenuItem, AdjustWindowRectEx, SetFocus, OpenDesktopA, TranslateMessage, IsWindow, DdeConnect, DdeGetLastError, DdeCreateStringHandleA, wsprintfA, DdeUninitialize, DdeDisconnect, DdeClientTransaction, DdeCreateDataHandle, DdeFreeStringHandle, LoadCursorA, LoadIconA, RegisterClassA, CreateWindowExA, ShowWindow, GetMessageA, CloseDesktop, DdeInitializeA, SendMessageA, PostQuitMessage, DefWindowProcA, MessageBoxA, PeekMessageA, FindWindowA, PostMessageA, MsgWaitForMultipleObjects, DispatchMessageA, PostThreadMessageA, CreateDesktopA, SetThreadDesktop
> GDI32.dll: SetTextColor, SetBkColor, GetObjectA, GetDeviceCaps, DeleteObject, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetStockObject, SaveDC, RestoreDC, SelectObject, SetViewportOrgEx, CreateBitmap, SetMapMode, SetWindowExtEx, DeleteDC, GetClipBox, OffsetViewportOrgEx, ScaleViewportExtEx, SetViewportExtEx, ScaleWindowExtEx
> ADVAPI32.dll: StartServiceA, CloseServiceHandle, ControlService, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, OpenSCManagerA, OpenServiceA, CreateServiceA, QueryServiceStatus, RegDeleteValueA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey
> ole32.dll: CoCreateGuid
> RPCRT4.dll: UuidToStringA, RpcStringFreeA
> WINSPOOL.DRV: DocumentPropertiesA, ClosePrinter, OpenPrinterA
> COMCTL32.dll: -

( 0 exports )

Salut, je n'ai pas pu faire la suite du nettoyage sur la machine mais je suis intéressé pour savoir ce qui selon toi est "bizarre" dans cette affaire...
D'avance merci

Stéphane