Rapport Findkill, virus bagle

Bonjour,

Tout d'abord je vous remercie d'avance pour l'intérêt que vous porterez à cette demande.

J'ai attrapé le ver Bagle. J'ai lancé FindKill. Ne sachant comment procédé pour la suite je vous soumets le rapport ci dessous et me réjouis d'une future réponse.

Merci



############################## | FindyKill V5.043 |

# User : Samuel (Administrateurs) # BIBISCH
# Update on 12/05/2010 by El Desaparecido
# Start at: 19:49:45 | 31.05.2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Processeur Intel Pentium III Xeon
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.7.986 [VPS 100330-1] 4.7.986 [ Enabled | Updated ]

# C:\ # Disque fixe local # 149.04 Go (9.54 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM

############################## | Processus infectieux stoppés |

"C:\Documents and Settings\Samuel\Application Data\drivers\winupgro.exe" (2568)
"C:\Documents and Settings\Samuel\Application Data\m\flec006.exe" (2592)
"C:\Documents and Settings\Samuel\Application Data\hidires\flec003.exe" -run (3044)
"C:\WINDOWS\wintems.exe" (252)

################## | Eléments infectieux |

C:\WINDOWS\ban_list.txt
C:\WINDOWS\mdelk.exe
C:\WINDOWS\wintems.exe
C:\WINDOWS\system32\srosa2.sys
C:\WINDOWS\system32\wfsintwq.sys
C:\Documents and Settings\Samuel\Application Data\drivers
C:\Documents and Settings\Samuel\Application Data\drivers\downld
C:\Documents and Settings\Samuel\Application Data\drivers\winupgro.exe
C:\Documents and Settings\Samuel\Application Data\hidires
C:\Documents and Settings\Samuel\Application Data\hidires\config
C:\Documents and Settings\Samuel\Application Data\hidires\config\AC_BootstrapIPs.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\AC_SearchStrings.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\AC_ServerMetURLs.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\cancelled.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\clients.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\clients.met.bak
C:\Documents and Settings\Samuel\Application Data\hidires\config\cryptkey.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\emfriends.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\key_index.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\known.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\known2_64.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\load_index.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\nodes.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\preferences.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\preferences.ini
C:\Documents and Settings\Samuel\Application Data\hidires\config\preferencesKad.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\server.met
C:\Documents and Settings\Samuel\Application Data\hidires\config\server_met.old
C:\Documents and Settings\Samuel\Application Data\hidires\config\shareddir.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\src_index.dat
C:\Documents and Settings\Samuel\Application Data\hidires\config\statistics.ini
C:\Documents and Settings\Samuel\Application Data\hidires\config\StoredSearches.met
C:\Documents and Settings\Samuel\Application Data\hidires\downloads.bak
C:\Documents and Settings\Samuel\Application Data\hidires\downloads.txt
C:\Documents and Settings\Samuel\Application Data\hidires\file.exe
C:\Documents and Settings\Samuel\Application Data\hidires\flec003.exe
C:\Documents and Settings\Samuel\Application Data\hidires\flec005.exe
C:\Documents and Settings\Samuel\Application Data\hidires\Incoming
C:\Documents and Settings\Samuel\Application Data\hidires\lang
C:\Documents and Settings\Samuel\Application Data\hidires\names.txt
C:\Documents and Settings\Samuel\Application Data\hidires\server.txt
C:\Documents and Settings\Samuel\Application Data\hidires\skins
C:\Documents and Settings\Samuel\Application Data\hidires\Temp
C:\Documents and Settings\Samuel\Application Data\hidires\WDIR
C:\Documents and Settings\Samuel\Application Data\hidires\webserver
C:\Documents and Settings\Samuel\Application Data\m
C:\Documents and Settings\Samuel\Application Data\m\data.oct
C:\Documents and Settings\Samuel\Application Data\m\flec006.exe
C:\Documents and Settings\Samuel\Application Data\m\list.oct
C:\Documents and Settings\Samuel\Application Data\m\srvlist.oct
C:\Documents and Settings\Samuel\Application Data\m\shared

################## | Registre |

[HKLM\SYSTEM\CurrentControlSet\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet001\Services\sK9Ou0s]
[HKLM\SYSTEM\ControlSet003\Services\sK9Ou0s]
[HKLM\SYSTEM\CurrentControlSet\Services\srosa]
[HKLM\SYSTEM\ControlSet001\Services\srosa]
[HKLM\SYSTEM\ControlSet003\Services\srosa]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S]
[HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
[HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA]
[HKCU\Software\bisoft]
[HKCU\Software\DateTime4]
[HKCU\Software\MuleAppData]
[HKCU\Software\WS4001]
[HKCR\ed2k]
[HKCU\Software\Classes\ed2k]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run] "german.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run] "mule_st_key"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "flec003.exe"
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run] "flec003.exe"
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\bisoft]
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\DateTime4]
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\MuleAppData]
[HKCU\Software\Local AppWizard-Generated Applications\key_generator]
[HKCU\Software\Local AppWizard-Generated Applications\winupgro]
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Local AppWizard-Generated Applications\key_generator]
[HKU\S-1-5-21-1801674531-507921405-725345543-1003\Software\Local AppWizard-Generated Applications\winupgro]

################## | Etat |

# Affichage des fichiers cachés : OK

Clé manquante : HKLM\...\SafeBoot | Mode sans echec non fonctionnel !

# (!) Ndisuio -> Start = 4 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 3 ( Good = 2 | Bad = 4 )
# (!) Ip6Fw -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) SharedAccess -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wuauserv -> Start = 4 ( Good = 2 | Bad = 4 )
# (!) wscsvc -> Start = 4 ( Good = 2 | Bad = 4 )

################## | ! Fin du rapport # FindyKill V5.043 ! |