Virus BV:AutoRun-G [Wrm] detecté..HELP Fermé

Question

Bonjour,

Avast m'a detecté un virus BV:AutoRun-G [Wrm] qui était sur ma clef et visiblement sur mon ordi maintenant. J'ai le droit à un message toutes les 5 sec, c ultra reloud.

D'autres post parlent de ce soucis, j'ai tenté d'utiliser USBFix, et quand j'ai voulu supprimer les agents infectieux, tous mes icones du bureau ont disparus, j'ai du redémarrer direct.

J'ai donc décidé d'arrêter de tenter des trucs sans conseil, car je sais que svt les rapports des logiciels doivent être lus par des spécialistes. 

Je copie colle 2 rapports :  celui de Hijack et celui de USBFix

Merci de votre aide

Hijack : 
Scan saved at 14:54:36, on 29/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Thunderbird	hunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.univ-lyon1.fr:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin
pjpi150_04.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://ma-config.com/activex/hardwaredetection_3_0_3_1.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Service de détection de Symantec System Center (NSCTOP) - Unknown owner - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: VNC Server (winvnc) - www.ultravnc.fr - C:\Program Files\UltraVNC\WinVNC.exe 

Celui de USBFIx

############################## [ UsbFix V3.026 | Scan ]

# User : Stéphanie (Administrateurs) # STEPHCASS
# Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 23:10:08 | 29/05/2009

# Genuine Intel(R) CPU           T2050  @ 1.60GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : Norton Internet Security 2006 2006 [ Enabled | (!) Outdated ]
# AV : avast! antivirus 4.8.1335 [VPS 090529-0] 4.8.1335 [ Enabled | Updated ]
# FW : Norton Internet Worm Protection[ (!) Disabled ]2006
# FW : Norton Internet Security 2006[ Enabled ]2006

# C:\ # Disque fixe local # 92,91 Go (28,9 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible # 3,73 Go (2,27 Go free) [UDISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" 
HKCU_Main:   "Start Page"="https://www.msn.com/fr-fr" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="St‚phanie" 
HKLM_logon:  "AltDefaultUserName"="St‚phanie" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    RTHDCPL=RTHDCPL.EXE 
HKLM_Run:    Alcmtr=ALCMTR.EXE 
HKLM_Run:    AGRSMMSG=AGRSMMSG.exe 
HKLM_Run:    TPSMain=TPSMain.exe 
HKLM_Run:    TFncKy=TFncKy.exe 
HKLM_Run:    TDispVol=TDispVol.exe 
HKLM_Run:    DLA=C:\WINDOWS\System32\DLA\DLACTRLW.EXE 
HKLM_Run:    IntelZeroConfig="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" 
HKLM_Run:    IntelWireless="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless 
HKLM_Run:    avast!=C:\PROGRA~1\Avast4\ashDisp.exe 
HKLM_Run:    SpeedTouch USB Diagnostics="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    LVCOMSX=C:\WINDOWS\system32\LVCOMSX.EXE 
HKLM_Run:    Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
HKLM_Run:    TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background  
HKCU_Run:    ares="C:\Program Files\Ares\Ares.exe" -h  
HKCU_Run:    SUPERAntiSpyware=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe  

################## [ Fichiers # Dossiers infectieux ]

Found ! C:ecycler\k-1-3542-4232123213-7676767-8888886\hn.exe  
E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe" ( présent ! )  
Found ! E:\autorun.inf  
Found ! E:ecycler\k-1-3542-4232123213-7676767-8888886\hn.exe  

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{37cf118c-53ec-11dd-8c94-00a0d14c5d63}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{54aff1f4-caa2-11dd-8d5a-00a0d14c5d63}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{6d95cc7e-ce1d-11db-8a58-00a0d14c5d63}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{c77b0a7a-88f5-11db-89fe-00a0d14c5d63}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{e8837b8a-6cd9-11dc-8b1d-00a0d14c5d63}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{e8837b93-6cd9-11dc-8b1d-00a0d14c5d63}\Shell\Auto\Command  
HKCU\...\Explorer\MountPoints2\{e8837b93-6cd9-11dc-8b1d-00a0d14c5d63}\Shell\AutoRun\Command  

################## [ Informations # Fichier Suspect ]


################## [ Cracks # Keygens # Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.026 ! ]

Utilisateur anonyme · Answer

Salut ,


et quand j'ai voulu supprimer les agents infectieux, tous mes icones du bureau ont disparus

c est normal UsbFix arrete beaucoup de processus .

Laisse l outil faire son job ,


 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau

• choisis l'option 2 ( Suppression )

• Ton bureau disparaitra et le pc redémarrera .

• Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 


• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

Safari · Answer

Je suis allée jusqu'au bout avec USBFix. Voici le rapport :


############################## [ UsbFix V3.026 | Cleaning ]

# User : Stéphanie (Administrateurs) # STEPHCASS
# Update on 26/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 00:01:28 | 30/05/2009

# Genuine Intel(R) CPU           T2050  @ 1.60GHz
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : Norton Internet Security 2006 2006 [ Enabled | (!) Outdated ]
# AV : avast! antivirus 4.8.1335 [VPS 090529-0] 4.8.1335 [ Enabled | Updated ]
# FW : Norton Internet Worm Protection[ (!) Disabled ]2006
# FW : Norton Internet Security 2006[ Enabled ]2006

# C:\ # Disque fixe local # 92,91 Go (28,9 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque amovible # 3,73 Go (2,27 Go free) [UDISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avast4\setup\avast.setup
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\UltraVNC\WinVNC.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! C:ecycler\k-1-3542-4232123213-7676767-8888886\hn.exe    
E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe" ( présent ! )  
Deleted ! -> E:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe 
Deleted ! E:\autorun.inf    

################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\{37cf118c-53ec-11dd-8c94-00a0d14c5d63}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{54aff1f4-caa2-11dd-8d5a-00a0d14c5d63}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{6d95cc7e-ce1d-11db-8a58-00a0d14c5d63}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{c77b0a7a-88f5-11db-89fe-00a0d14c5d63}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{e8837b8a-6cd9-11dc-8b1d-00a0d14c5d63}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{e8837b93-6cd9-11dc-8b1d-00a0d14c5d63}\Shell\Auto\Command  

################## [ Listing des fichiers présent ]

[16/01/2006 18:37|--a------|0] - C:\AUTOEXEC.BAT
[25/11/2008 18:33|--ahs----|220] - C:\boot.ini
[05/08/2004 13:00|-rahs----|4952] - C:\Bootfont.bin
[18/09/2007 14:10|--a------|311882] - C:\carte.bmp
[18/09/2007 14:10|--a------|43583] - C:\carte.jpg
[03/10/2007 20:47|--a------|74] - C:\CMLoader.log
[24/09/2007 18:07|--a------|8494] - C:\CollierCoord.txt
[24/09/2007 18:15|--a------|29431] - C:\CollierGeno.txt
[16/01/2006 18:37|--a------|0] - C:\CONFIG.SYS
[30/05/2007 17:07|--a------|1091] - C:\convert3popcgenepop.res
[30/05/2007 16:45|--a------|36942] - C:\convert3popcgenepop.txt
[30/05/2007 17:09|--a------|2023] - C:\convert3popcgenepopNm.res
[30/05/2007 16:43|--a------|35622] - C:\convert3popchevreuil.txt
[30/10/2007 16:03|--a------|3847] - C:\coord.dbf
[30/10/2007 16:01|--a------|2613] - C:\coord.txt
[07/11/2007 21:18|--a------|1076] - C:\coordtestbis.txt
[07/11/2007 21:02|--a------|327] - C:\corrditest.dbf
[07/11/2007 21:02|--a------|912] - C:\corrditest.shp
[07/11/2007 21:02|--a------|332] - C:\corrditest.shx
[04/10/2007 13:33|--a------|133] - C:\DealioAu.log
[09/03/2009 17:11|--a------|225] - C:\DispZ3Centre.txt
[09/03/2009 17:11|--a------|225] - C:\DispZ3Extre.txt
[16/01/2006 18:37|-rahs----|0] - C:\IO.SYS
[24/09/2007 18:19|--a------|34986] - C:\joint.txt
[09/03/2009 17:21|--a------|34] - C:\lien1.dbf
[09/03/2009 17:21|--a------|100] - C:\lien1.shp
[09/03/2009 17:21|--a------|100] - C:\lien1.shx
[09/03/2009 17:47|--a------|34] - C:\lien2.dbf
[09/03/2009 17:47|--a------|100] - C:\lien2.shp
[09/03/2009 17:47|--a------|100] - C:\lien2.shx
[09/03/2009 17:14|--a------|34] - C:\liendisp.dbf
[09/03/2009 17:14|--a------|100] - C:\liendisp.shp
[09/03/2009 17:14|--a------|100] - C:\liendisp.shx
[09/03/2009 16:52|--a------|840] - C:\liens1.dbf
[09/03/2009 16:52|--a------|9352] - C:\liens1.shp
[09/03/2009 16:52|--a------|948] - C:\liens1.shx
[30/05/2007 16:15|--a------|5893] - C:\mar1.txt
[30/05/2007 16:15|--a------|12229] - C:\mar2.txt
[30/05/2007 16:14|--a------|5893] - C:\margeriaz.txt
[16/01/2006 18:37|-rahs----|0] - C:\MSDOS.SYS
[29/05/2008 18:49|--a------|460] - C:
d.dbg
[05/08/2004 13:00|-rahs----|47564] - C:\NTDETECT.COM
[21/11/2008 16:05|-rahs----|252240] - C:
tldr
[09/03/2009 16:48|--a------|840] - C:\oursinsedz1.dbf
[09/03/2009 16:48|--a------|1372] - C:\oursinsedz1.shp
[09/03/2009 16:48|--a------|948] - C:\oursinsedz1.shx
[?|?|?] - C:\pagefile.sys
[28/05/2008 15:18|--a------|122786] - C:\pointchevreuil.dbf
[28/05/2008 15:18|--a------|6948] - C:\pointchevreuil.sbn
[28/05/2008 15:18|--a------|812] - C:\pointchevreuil.sbx
[28/05/2008 15:18|--a------|9788] - C:\pointchevreuil.shp
[28/05/2008 15:18|--a------|2868] - C:\pointchevreuil.shx
[24/10/2006 17:57|--a------|274432] - C:\pscp.exe
[30/05/2007 16:13|--a------|10726] - C:eserve.txt
[30/05/2007 16:13|--a------|3812] - C:essuite.txt
[30/05/2007 16:14|--a------|17214] - C:\semnoz.txt
[18/11/2007 22:35|--a------|4120129] - C:\SpeedTouch301.zip
[09/03/2009 17:28|--a------|129] - C:\spider1.dbf
[09/03/2009 17:30|--a------|100] - C:\spider1.shp
[09/03/2009 17:30|--a------|100] - C:\spider1.shx
[23/02/2007 21:37|--ah-----|268] - C:\sqmdata00.sqm
[27/02/2007 15:47|--ah-----|268] - C:\sqmdata01.sqm
[02/03/2007 01:26|--ah-----|268] - C:\sqmdata02.sqm
[02/03/2007 17:48|--ah-----|292] - C:\sqmdata03.sqm
[08/03/2007 01:19|--ah-----|268] - C:\sqmdata04.sqm
[08/03/2007 11:48|--ah-----|268] - C:\sqmdata05.sqm
[12/03/2007 02:00|--ah-----|268] - C:\sqmdata06.sqm
[13/03/2007 10:57|--ah-----|268] - C:\sqmdata07.sqm
[14/03/2007 01:36|--ah-----|268] - C:\sqmdata08.sqm
[16/03/2007 02:31|--ah-----|268] - C:\sqmdata09.sqm
[21/03/2007 10:46|--ah-----|268] - C:\sqmdata10.sqm
[24/12/2006 21:06|--ah-----|268] - C:\sqmdata11.sqm
[03/01/2007 16:51|--ah-----|268] - C:\sqmdata12.sqm
[06/01/2007 19:36|--ah-----|268] - C:\sqmdata13.sqm
[09/01/2007 13:26|--ah-----|268] - C:\sqmdata14.sqm
[15/01/2007 16:23|--ah-----|280] - C:\sqmdata15.sqm
[24/01/2007 15:18|--ah-----|268] - C:\sqmdata16.sqm
[08/02/2007 15:46|--ah-----|268] - C:\sqmdata17.sqm
[15/02/2007 23:53|--ah-----|268] - C:\sqmdata18.sqm
[21/02/2007 12:32|--ah-----|268] - C:\sqmdata19.sqm
[23/02/2007 21:37|--ah-----|244] - C:\sqmnoopt00.sqm
[27/02/2007 15:47|--ah-----|244] - C:\sqmnoopt01.sqm
[02/03/2007 01:26|--ah-----|244] - C:\sqmnoopt02.sqm
[02/03/2007 17:48|--ah-----|244] - C:\sqmnoopt03.sqm
[08/03/2007 01:19|--ah-----|244] - C:\sqmnoopt04.sqm
[08/03/2007 11:48|--ah-----|244] - C:\sqmnoopt05.sqm
[12/03/2007 02:00|--ah-----|244] - C:\sqmnoopt06.sqm
[13/03/2007 10:57|--ah-----|244] - C:\sqmnoopt07.sqm
[14/03/2007 01:36|--ah-----|244] - C:\sqmnoopt08.sqm
[16/03/2007 02:31|--ah-----|244] - C:\sqmnoopt09.sqm
[21/03/2007 10:46|--ah-----|244] - C:\sqmnoopt10.sqm
[24/12/2006 21:06|--ah-----|244] - C:\sqmnoopt11.sqm
[03/01/2007 16:51|--ah-----|244] - C:\sqmnoopt12.sqm
[06/01/2007 19:36|--ah-----|244] - C:\sqmnoopt13.sqm
[09/01/2007 13:26|--ah-----|244] - C:\sqmnoopt14.sqm
[15/01/2007 16:23|--ah-----|244] - C:\sqmnoopt15.sqm
[24/01/2007 15:18|--ah-----|244] - C:\sqmnoopt16.sqm
[08/02/2007 15:46|--ah-----|244] - C:\sqmnoopt17.sqm
[15/02/2007 23:53|--ah-----|244] - C:\sqmnoopt18.sqm
[21/02/2007 12:32|--ah-----|244] - C:\sqmnoopt19.sqm
[04/04/2006 23:43|--ah-----|388] - C:\SWSTAMP.TXT
[26/05/2009 14:05|--a------|92] - C:\TCleaner.txt
[30/05/2007 17:09|--a------|34645] - C:	emp.tmp
[08/01/2007 18:52|--a------|2796] - C:	est.dbf
[09/03/2009 17:49|--a------|100] - C:	est.shp
[09/03/2009 17:49|--a------|100] - C:	est.shx
[07/11/2007 20:59|--a------|56450] - C:	estgraphe.dbf
[07/11/2007 20:59|--a------|11372] - C:	estgraphe.sbn
[07/11/2007 20:59|--a------|708] - C:	estgraphe.sbx
[07/11/2007 20:59|--a------|10852] - C:	estgraphe.shp
[07/11/2007 20:59|--a------|3172] - C:	estgraphe.shx
[29/05/2008 17:33|--a------|65] - C:	heme1.dbf
[29/05/2008 17:33|--a------|100] - C:	heme1.shp
[29/05/2008 17:33|--a------|100] - C:	heme1.shx
[03/06/2007 01:10|--a------|93] - C:	heme5.DAT
[03/06/2007 01:18|--a------|93] - C:	heme5.dbf
[03/06/2007 01:10|--a------|12] - C:	heme5.ID
[03/06/2007 01:10|--a------|2048] - C:	heme5.MAP
[03/06/2007 01:18|--a------|148] - C:	heme5.sbn
[03/06/2007 01:18|--a------|116] - C:	heme5.sbx
[03/06/2007 01:18|--a------|876] - C:	heme5.shp
[03/06/2007 01:18|--a------|124] - C:	heme5.shx
[03/06/2007 01:10|--a------|142] - C:	heme5.tab
[30/05/2009 00:02|--a------|9760] - C:\UsbFix.txt
[03/06/2007 01:16|--a------|584] - C:\ZonalSt_shp1.dbf
[03/06/2007 01:16|--a------|616] - C:\ZonalSt_shp1.dbf.xml
[03/06/2007 01:19|--a------|852] - C:\ZonalSt_shp2.dbf
[03/06/2007 01:19|--a------|616] - C:\ZonalSt_shp2.dbf.xml
[08/12/2008 10:46|--a------|2699264] - E:\OralOncfs.ppt
[08/12/2008 14:47|--a------|5698048] - E:\presentation orale.ppt
[17/03/2009 14:41|--a------|4214272] - E:\ExpoClubNaturaliste.ppt

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ Informations # Fichier Suspect ]


################## [ Cracks # Keygens # Serials ]

# -> Nothing found !  

################## [ ! Fin du rapport # UsbFix V3.026 ! ]

Utilisateur anonyme · Answer

toujours des soucis ?

Utilisateur anonyme · Answer

pour avast redémarre le pc 

si au redémarrage il ne repointe pas le bout de son nez :


va dans programe files puis recherche le dossier alwil (avast) tu rentre dedans et recherche ashDisp.exe tu click dessus > l´icone d´avast devrait reaparaitre

Virus BV:AutoRun-G [Wrm] detecté..HELP

4 réponses

Discussions similaires