Rootkit Win32:kavos

salut!

merci pour ta reponse, voila le rapport de usbfix :


############################## [ UsbFix V3.016 # Scan ]

# User : zarathoustra (Administrateurs) # MARIA
# Update on 01/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 19:51:00 | 01/05/2009

# Intel(R) Pentium(R) M processor 1.60GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090430-0] 4.8.1335 [ Enabled | Updated ]

# C:\ # Disque fixe local # 55,88 Go (28,33 Go free) # NTFS
# D:\ # Disque CD-ROM # 244,88 Mo (0 Mo free) [NTM_LE_CLASH] # CDFS
# E:\ # Disque amovible # 62,54 Mo (49,32 Mo free) # FAT
# G:\ # Disque fixe local # 372,51 Go (119,53 Go free) [Elements] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
C:\WINDOWS\system32\ZoomingHook.exe
C:\WINDOWS\system32\TCtrlIOHook.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre # Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="zarathoustra"
HKLM_logon: "AltDefaultUserName"="zarathoustra"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: Apoint=C:\Program Files\Apoint2K\Apoint.exe
HKLM_Run: PadTouch=C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
HKLM_Run: AGRSMMSG=AGRSMMSG.exe
HKLM_Run: CeEKEY=C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
HKLM_Run: TPNF=C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
HKLM_Run: TOSHIBA Accessibility=C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe
HKLM_Run: HWSetup=C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP
HKLM_Run: SVPWUTIL=C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL
HKLM_Run: Zooming=ZoomingHook.exe
HKLM_Run: TCtryIOHook=TCtrlIOHook.exe
HKLM_Run: TPSMain=TPSMain.exe
HKLM_Run: SmoothView=C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
HKLM_Run: NDSTray.exe=NDSTray.exe
HKLM_Run: dla=C:\WINDOWS\system32\dla\tfswctrl.exe
HKLM_Run: IgfxTray=C:\WINDOWS\system32\igfxtray.exe
HKLM_Run: HotKeysCmds=C:\WINDOWS\system32\hkcmd.exe
HKLM_Run: TFncKy=TFncKy.exe
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HKLM_Run: CFSServ.exe=CFSServ.exe -NoClient
HKLM_Run: LogitechQuickCamRibbon="C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
HKCU_Run: MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
HKCU_Run: cdoosoft=C:\WINDOWS\system32\olhrwef.exe
HKCU_Run: eMuleAutoStart=C:\Program Files\eMule\emule.exe -AutoStart

################## [ Informations ]


################## [ Fichiers # Dossiers infectieux ]

C:\autorun.inf # -> fichier appelé : "C:\vwewav8.com" ( présent ! )
Found ! C:\vwewav8.com
Found ! C:\autorun.inf
Found ! D:\autorun.inf
E:\autorun.inf # -> fichier appelé : "E:\e2.cmd" ( présent ! )
Found ! E:\vwewav8.com
Found ! E:\autorun.inf
G:\autorun.inf # -> fichier appelé : "G:\vwewav8.com" ( présent ! )
Found ! G:\vwewav8.com
Found ! G:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Found ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Found ! HKU\S-1-5-21-3710637384-1043926316-3897964466-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"

################## [ Registre # Mountpoints2 ]

HKCU\Software\Microsoft\....\MountPoints2\{0bf4609e-2ff6-11de-bdb4-000fb09c3b4b}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{0bf4609e-2ff6-11de-bdb4-000fb09c3b4b}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{9ffa066e-c551-11dd-bd92-000fb09c3b4b}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{9ffa066e-c551-11dd-bd92-000fb09c3b4b}\Shell\open\Command

################## [ ! Fin du rapport # UsbFix V3.016 ! ]


En attente de la suite! merci beaucoup!!! ^^