Quel virus ? quel remède ?

ankerdouez -  
kevin05 Messages postés 3636 Date d'inscription   Statut Contributeur sécurité Dernière intervention   -
Bonjour,

Mon ordinateur a dû etre infecté et je ne sais pas quoi faire. Voici les symptômes dans l'ordre chronologique :
- "désactivation" de mon anti-virus (Avast) et de mon fire-wall (Zonz-alarm). Ils ne sont plus reconnus par XP (applications non valides avec mentions des fichiers concernés ds win32).
- perte de ma connection internet
- pb avec ma carte son (+ de lecture ou fichiers audio non reconnus par W. média ou XG player) et impossibilité d'ouverture pour certaines applications (pas toutes)
Si quelqu'un a une idée quant à ce pb et à la possibilité de sa correction, merci d'avance pour vos suggestions.
A voir également:

3 réponses

Réponse 1 / 3
kevin05 Messages postés 3636 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
 
Salut


Télécharge FindyKill (Merci à Chiquitine29 !!)

Fais un clic droit sur le lien, Enregistrer la cible sous (Internet Explorer) ou Enregistrer la cible du lien sous (Firefox) …
Choisis d’enregistrer le fichier sur le bureau.

Double clique sur FindyKill.exe
Choisis l’option 1 (Recherche)
Un rapport va s’ouvrir, poste le dans ta prochaine réponse.

Note :
Le rapport FindyKill.txt est sauvegardé à la racine du disque (C:\FindyKill.txt)
1
ankerdouez
 
Merci Kevin !

Voici le rapport (une précision supp. : je récupère ma connexion internet en redémarrent le syst. mais elle s'interrompt au bout de qques instants) :

############################## [ FindyKill V4.718 ]

# User : thomas (Administrateurs) # UNICORNI-037CCE
# Update on 01/03/09
# Start at: 21:29:55 | 05/03/2009

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled
# FW : ZoneAlarm Firewall[ Enabled ]7.0.462.000

# A:\ # Lecteur de disquettes 3 « pouces
# C:\ # Disque fixe local # 24,82 Go (1,13 Go free) # NTFS
# D:\ # Disque fixe local # 48,83 Go (9,61 Go free) # NTFS
# E:\ # Disque fixe local # 21,1 Go (6,55 Go free) # FAT32
# F:\ # Disque fixe local # 230,64 Go (60,06 Go free) [Stockage] # NTFS
# H:\ # Disque CD-ROM
# I:\ # Disque CD-ROM

############################## [ Processus actifs ]

D:\windows\System32\smss.exe
D:\windows\system32\csrss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\system32\spoolsv.exe
D:\windows\Explorer.EXE
D:\WINDOWS\system32\CTsvcCDA.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\CDBurnerXP\NMSAccessU.exe
D:\windows\system32\svchost.exe
D:\windows\system32\wdfmgr.exe
D:\windows\system32\DRIVERS\WtSrv.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\Program Files\Canon\CAL\CALMAIN.exe
D:\WINDOWS\system32\PowerDesk8\Matrox.PowerDesk.PDeskNet.exe
D:\windows\system32\CTHELPER.EXE
D:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE
D:\windows\system32\SxgTkBar.exe
D:\windows\system32\WService.EXE
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe
D:\Documents and Settings\thomas\Application Data\m\flec006.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\thomas\Application Data\drivers\downld\271156.exe
D:\windows\system32\wintems.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe" (668)
"D:\Documents and Settings\thomas\Application Data\m\flec006.exe" (2940)
"D:\Documents and Settings\thomas\Application Data\drivers\downld\271156.exe" (3704)
"D:\windows\system32\wintems.exe" (288)

################## [ Fichiers / Dossiers infectieux D:\ ]


################## [ D:\windows ]


################## [ D:\windows\system32 ]

Found ! - D:\windows\system32\mdelk.exe
Found ! - D:\windows\system32\wintems.exe
Found ! - D:\windows\system32\ban_list.txt

################## [ D:\windows\system32\drivers ]

Found ! - "D:\windows\system32\drivers\down"

################## [ D:\.. Application Data ... ]

Found ! - "D:\Documents and Settings\thomas\Application Data\m\flec006.exe"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\list.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\data.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\srvlist.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\shared"
Found ! - "D:\Documents and Settings\thomas\Application Data\m"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\srosa2.sys"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\wfsintwq.sys"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\downld"

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

# Presence des fichiers :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.718 ! ]
0
ankerdouez
 
suite du rapport :

################## [ D:\windows\system32\drivers ]

Found ! - "D:\windows\system32\drivers\down"

################## [ D:\.. Application Data ... ]

Found ! - "D:\Documents and Settings\thomas\Application Data\m\flec006.exe"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\list.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\data.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\srvlist.oct"
Found ! - "D:\Documents and Settings\thomas\Application Data\m\shared"
Found ! - "D:\Documents and Settings\thomas\Application Data\m"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\srosa2.sys"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\wfsintwq.sys"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe"
Found ! - "D:\Documents and Settings\thomas\Application Data\drivers\downld"

################## [ Registre / Clés infectieuses ]

Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\bisoft
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\DateTime4
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\FFC
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\FirtR
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\MuleAppData
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\patch
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! - HKEY_CURRENT_USER\Software\bisoft
Found ! - HKEY_CURRENT_USER\Software\DateTime4
Found ! - HKEY_CURRENT_USER\Software\FirtR
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]

# Presence des fichiers :


################## [ Registre / Mountpoint2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.718 ! ]
0
Réponse 2 / 3
kevin05 Messages postés 3636 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
 
Nettoyage :

--> Double clic sur le raccourci FindyKill sur ton bureau
--> Au menu principal, choisis l’option 2 (Suppression)


/!\ Il y aura deux redémarrages, laisse travailler l’outil jusqu’à l’apparition du message "nettoyage effectué" /!\

/!\ Ne te sert pas du pc durant la suppression, ton bureau ne sera pas accessible, c’est normal ! /!\</gras>

Ensuite poste le rapport FindyKill.txt

Notes :
* Le rapport FindyKill.txt est sauvegardé à la racine du disque (C:\ FindyKill.txt)
* Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide
0
ankerdouez
 
Suite et fin (j'espère) du pb.
Je n'ai pas encore fait le tour du PC mais après réinstallation Avast et Zone alarm fonctionnent, la carte son également.
Ci dessous le rapport de Findykill. Dois-je encore effectuer d'autres opérations pour m'assurer que tout va bien ?
Encore merci pour ce coup de main.


############################## [ FindyKill V4.718 ]

# User : thomas (Administrateurs) # UNICORNI-037CCE
# Update on 01/03/09
# Start at: 10:17:54 | 06/03/2009

# Intel(R) Pentium(R) 4 CPU 3.00GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Disabled
# FW : ZoneAlarm Firewall[ Enabled ]7.0.462.000

# A:\ # Lecteur de disquettes 3 « pouces
# C:\ # Disque fixe local # 24,82 Go (1,13 Go free) # NTFS
# D:\ # Disque fixe local # 48,83 Go (9,67 Go free) # NTFS
# E:\ # Disque fixe local # 21,1 Go (6,55 Go free) # FAT32
# F:\ # Disque fixe local # 230,64 Go (60,06 Go free) [Stockage] # NTFS
# H:\ # Disque CD-ROM
# I:\ # Disque CD-ROM

############################## [ Active Processes ]

D:\windows\System32\smss.exe
D:\windows\system32\csrss.exe
D:\windows\system32\winlogon.exe
D:\windows\system32\services.exe
D:\windows\system32\lsass.exe
D:\windows\system32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\System32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\system32\svchost.exe
D:\windows\system32\spoolsv.exe
D:\WINDOWS\system32\CTsvcCDA.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\Program Files\CDBurnerXP\NMSAccessU.exe
D:\windows\system32\svchost.exe
D:\windows\system32\wdfmgr.exe
D:\windows\system32\DRIVERS\WtSrv.exe
D:\WINDOWS\system32\MsPMSPSv.exe
D:\Program Files\Canon\CAL\CALMAIN.exe
D:\WINDOWS\system32\PowerDesk8\Matrox.PowerDesk.PDeskNet.exe
D:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE
D:\windows\system32\SxgTkBar.exe
D:\windows\system32\WService.EXE
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe
D:\windows\system32\wintems.exe
D:\Documents and Settings\thomas\Application Data\m\flec006.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected processes stopped ]

"D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe" (1884)
"D:\windows\system32\wintems.exe" (2140)
"D:\Documents and Settings\thomas\Application Data\m\flec006.exe" (3196)

################## [ Infected Files / Folders D:\ ]


################## [ D:\windows ]


################## [ D:\windows\system32 ]

Deleted ! - D:\windows\system32\mdelk.exe
Deleted ! - D:\windows\system32\wintems.exe
Deleted ! - D:\windows\system32\ban_list.txt

################## [ D:\windows\system32\drivers ]

Deleted ! - "D:\windows\system32\drivers\down"

################## [ D:\.. Application Data ... ]

Deleted ! - "D:\Documents and Settings\thomas\Application Data\m\flec006.exe"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\m\list.oct"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\m\data.oct"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\m\srvlist.oct"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\m\shared"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\m"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\drivers\srosa2.sys"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\drivers\wfsintwq.sys"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\drivers\downld"
Deleted ! - "D:\Documents and Settings\thomas\Application Data\drivers"

################## [ Registry / Infected keys ]

Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_CURRENT_USER\Software\bisoft
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4
Deleted ! - HKEY_CURRENT_USER\Software\FirtR
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\patch
Deleted ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\FFC
Deleted ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\MuleAppData
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Deleted ! - HKEY_USERS\S-1-5-21-220523388-1958367476-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

################## [ Cleaning Removable drives ]

# Deleting files :


################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

45f99e31 D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe
160fa0e8069f9ff6e4a2ac4737f074a3 D:\Documents and Settings\thomas\Application Data\drivers\winupgro.exe

Suspect ! "D:\Program Files\Messenger\msmsgs.exe"
# Taille : 815104 # MD5 : 160FA0E8069F9FF6E4A2AC4737F074A3


################## [ PEH Corrupted ]

D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Program Files\Zone Labs\ZoneAlarm\zatutor.exe
D:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

################## [ ! End of Report # FindyKill V4.718 ! ]
0
Réponse 3 / 3
kevin05 Messages postés 3636 Date d'inscription   Statut Contributeur sécurité Dernière intervention   147
 
Relance fyndikill choisie l'option 4
0

Discussions similaires

Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
message de postmaster incessant !
wasap -
wasap -

9 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Message Apple virus !!
Souclik67 -
MPMP10 -

3 réponses
4 virus en raison d’un porno ????
valou -
Bello040420 -

9 réponses