VIRUS WINUPGRO.EXE

Bonjour,

J'ai chopé le virus winupgro.exe et également srosa.sys
Après diagnostic avec Findykill (voir après); j'ai lancé la désinfection et là, écran bleu et impossible de démarrer en mode ss échec. J'ai lu tous les forums mais impossible de trouver une soluce pour éradiquer cette m.....
Quelqu'un peut il me venir en aide s'il vous plait ?
Merci par avance.
Ci-joint le rapport du diag



----------------- FindyKill V4.712 ------------------

* User : Administrateur - LAURENT
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 14/01/09 par Chiquitine29
* Recherche effectuée à 9:52:34 le 17/01/2009
* Windows XP - Internet Explorer 7.0.5730.13

((((((((((((((((( *** Recherche *** ))))))))))))))))))


--------------- [ Processus actifs ] ----------------


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe
C:\WINDOWS\system32\ctfmon.exe
C:\documents and settings\administrateur\local settings\application data\aasmkgi.exe
C:\WINDOWS\system32\cidaemon.exe

--------------- [ Processus infectieux stoppés ] ----------------


"C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe" (164)


--------------- [ Fichiers/Dossiers infectieux ] ----------------


»»»» Presence des fichiers dans C:


»»»» Presence des fichiers dans C:\WINDOWS


»»»» Presence des fichiers dans C:\WINDOWS\Prefetch

Found ! - C:\WINDOWS\prefetch\14783125.EXE-34929E40.pf
Found ! - C:\WINDOWS\prefetch\14840375.EXE-18594A56.pf
Found ! - C:\WINDOWS\prefetch\14865390.EXE-03797BCC.pf
Found ! - C:\WINDOWS\prefetch\15013250.EXE-1C0CF53E.pf
Found ! - C:\WINDOWS\prefetch\15063875.EXE-15E0E8ED.pf
Found ! - C:\WINDOWS\prefetch\183765.EXE-0DFBC2B8.pf
Found ! - C:\WINDOWS\prefetch\199515.EXE-017A2879.pf
Found ! - C:\WINDOWS\prefetch\29552734.EXE-386DB827.pf
Found ! - C:\WINDOWS\prefetch\29571875.EXE-2D89153E.pf
Found ! - C:\WINDOWS\prefetch\296390.EXE-36F54887.pf
Found ! - C:\WINDOWS\prefetch\29692875.EXE-0B66E1E2.pf
Found ! - C:\WINDOWS\prefetch\29746234.EXE-3539DC20.pf
Found ! - C:\WINDOWS\prefetch\324921.EXE-0201A871.pf
Found ! - C:\WINDOWS\prefetch\44302859.EXE-12ED7EB4.pf
Found ! - C:\WINDOWS\prefetch\59014281.EXE-0ACEC9B0.pf
Found ! - C:\WINDOWS\prefetch\59078750.EXE-0F12F3EE.pf
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-0695BA6E.pf
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf
Found ! - C:\WINDOWS\Prefetch\PATCH.EXE-19ADAB51.pf

»»»» Presence des fichiers dans C:\WINDOWS\system32

Found ! [16/01/2009 17:34] - C:\WINDOWS\system32\mdelk.exe
Found ! [16/01/2009 17:34] - C:\WINDOWS\system32\wintems.exe
Found ! [17/01/2009 09:43] - C:\WINDOWS\system32\ban_list.txt

»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers


»»»» Presence des fichiers dans C:\Documents and Settings\Administrateur\Application Data

Found ! [16/01/2009 17:35] - "C:\Documents and Settings\Administrateur\Application Data\m\flec006.exe"
Found ! [17/01/2009 09:37] - "C:\Documents and Settings\Administrateur\Application Data\m\list.oct"
Found ! [17/01/2009 09:38] - "C:\Documents and Settings\Administrateur\Application Data\m\data.oct"
Found ! [17/01/2009 09:38] - "C:\Documents and Settings\Administrateur\Application Data\m\srvlist.oct"
Found ! [17/01/2009 09:43] - "C:\Documents and Settings\Administrateur\Application Data\m\shared"
Found ! [16/01/2009 16:11] - "C:\Documents and Settings\Administrateur\Application Data\m"
Found ! [13/01/2009 16:13] - "C:\Documents and Settings\Administrateur\Application Data\drivers"
Found ! [17/01/2009 09:33] - "C:\Documents and Settings\Administrateur\Application Data\drivers\srosa.sys"
Found ! [17/01/2009 09:33] - "C:\Documents and Settings\Administrateur\Application Data\drivers\srosa2.sys"
Found ! [26/08/2004 04:07] - "C:\Documents and Settings\Administrateur\Application Data\drivers\winupgro.exe"
Found ! [17/01/2009 09:43] - "C:\Documents and Settings\Administrateur\Application Data\drivers\downld"

»»»» Presence des fichiers dans C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp


--------------- [ Registre / Startup ] ----------------

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
Exstora="C:\Program Files\Exstora\Exstora.exe"
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
aasmkgi="c:\documents and settings\administrateur\local settings\application data\aasmkgi.exe" aasmkgi

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
SunJavaUpdateSched=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
IgfxTray=C:\WINDOWS\system32\igfxtray.exe
HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
NoChange=1
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

[HKEY_CURRENT_USER\software\local appwizard-generated applications\Exstora]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\patch]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]

--------------- [ Registre / Clés infectieuses ] ----------------


Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-1220945662-113007714-1417001333-500\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR

/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

--------------- [ Etat / Services ] ----------------

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

/!\ Mode sans echec non fonctionnel !!

Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network

/!\ Mode sans echec non fonctionnel !!



+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

/!\ Ndisuio - Type de démarrage = 4

EapHost - Type de démarrage = 3

/!\ Ip6Fw - Type de démarrage = 4

/!\ SharedAccess - Type de démarrage = 4

/!\ wscsvc - Type de démarrage = 4


--------------- [ Recherche dans supports amovibles] ----------------


+- Informations :

C: - Lecteur fixe

G: - Lecteur amovible


+- presence des fichiers :



--------------- [ Registre / Mountpoint2 ] ----------------

Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{560434aa-8c8e-11dd-a358-0008741b30f0}\Shell\AutoRun\command
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c54851f-cbef-11dc-a2a2-0008741b30f0}\Shell\AutoRun\command
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86544bf9-8714-11dd-a34f-0008741b30f0}\Shell\AutoRun\command
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd476357-a297-11dd-a377-0008741b30f0}\Shell\AutoRun\command
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd476358-a297-11dd-a377-0008741b30f0}\Shell\AutoRun\command


------------------- ! Fin du rapport ! --------------------