[Virus] Infecté par virus et cheval de troie

Voici les nouveaux rapports demandés

SDFix: Version 1.44
-------------------

29/11/2006 - 20:34:10,73

Microsoft Windows XP [version 5.1.2600]

Running from C:\DOCUME~1\Pascal\Bureau\SDFix

Stage One - Safe Mode
Service Check...

Service Name:
------------
MsaSvc
MSDisk
wlmsngr

FilePath:
--------
C:\WINDOWS\System32\msasvc.exe
"C:\WINDOWS\System32\irdvxc.exe" /service
"C:\WINDOWS\wlmsngr.exe"

MsaSvc Deleted...
MSDisk Deleted...
wlmsngr Deleted...

Starting Registry Repairs...

Restoring Default Hosts File...

Stage One Complete

Rebooting...

Stage Two - Normal Mode

Checking For Malware:
--------------------

C:\WINDOWS\wlmsngr.exe

Backing Up and Removing any Files Found...

Final Check:

Services:
---------

[COLOR=RED][B]Rootkit pe386 Present![/COLOR][/B]

Authorized Applications Export:

Files:
------

Checking For Hidden Files:

C:\WINDOWS\system32\.exe
C:\WINDOWS\system32\soofvby.exe
C:\hiberfil.sys
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys
C:\WINDOWS\system32\byxwxvu.dll
C:\WINDOWS\system32\cbxvttr.dll
C:\WINDOWS\system32\ddcywwv.dll
C:\WINDOWS\system32\gebxwuv.dll
C:\WINDOWS\system32\hggggfc.dll
C:\WINDOWS\system32\iifcaya.dll
C:\WINDOWS\system32\nnlji.dll
C:\WINDOWS\system32\tuvvwtr.dll
C:\WINDOWS\system32\urqolki.dll
C:\WINDOWS\system32\urqqrrp.dll

Backups folder: - C:\DOCUME~1\Pascal\Bureau\SDFix\backups\backups.zip

FINISHED!

Script clean par Malekal_morte - http://www.malekal.com

Microsoft Windows XP [version 5.1.2600]
Script execute en mode sans echec

*** Suppression de fichiers sur C:

*** Suppression des fichiers dans C:\WINDOWS\

*** Suppression des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\msasvc.exe FOUND
C:\WINDOWS\system32\irdvxc.exe FOUND
C:\WINDOWS\system32\mcrh.tmp FOUND
C:\WINDOWS\system32\msnlive.exe FOUND
C:\WINDOWS\system32\mysvcc.exe FOUND
C:\WINDOWS\system32\o FOUND
C:\WINDOWS\system32\spoolsvc.exe FOUND
C:\WINDOWS\system32\winnnit.exe FOUND

*** Suppression des clefs du registre effectuee..

VundoFix V6.2.13

Checking Java version...

Scan started at 13:03:28 29/11/2006

Listing files found while scanning....

C:\WINDOWS\System32\jkklk.dll
C:\WINDOWS\System32\klkkj.ini

Beginning removal...

Attempting to delete C:\WINDOWS\System32\jkklk.dll
C:\WINDOWS\System32\jkklk.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\klkkj.ini
C:\WINDOWS\System32\klkkj.ini Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.13

Checking Java version...

Scan started at 16:39:17 29/11/2006

Listing files found while scanning....

Beginning removal...

Attempting to delete C:\WINDOWS\SYSTEM32\ddccdcb.dll
C:\WINDOWS\SYSTEM32\ddccdcb.dll Has been deleted!

Performing Repairs to the registry.
Done!

Logfile of HijackThis v1.99.1
Scan saved at 20:40:04, on 29/11/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\Avast\aswUpdSv.exe
E:\Avast\ashServ.exe
E:\Avast\ashWebSv.exe
E:\Avast\ashMaiSv.exe
E:\Avast\ashDisp.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?redirfallthru=http%3a%2f%2fwww.msn.fr%2fhelp%2fHelp4%2f%3f
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - e:\Acrobat Reader 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A0946F43-6A2C-44AB-A1F8-F3566E2BA48F} - C:\WINDOWS\System32\nnlji.dll
O2 - BHO: (no name) - {A3F7584C-5C8F-49C5-94B5-598D0D4E9CFA} - C:\WINDOWS\System32\jkklk.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {CB650C14-E5CB-41F3-ADEA-0F6026439179} - C:\WINDOWS\System32\urqqrrp.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] E:\Avast\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: nnlji - C:\WINDOWS\System32\nnlji.dll
O20 - Winlogon Notify: urqqrrp - C:\WINDOWS\SYSTEM32\urqqrrp.dll
O21 - SSODL: hksrv.dll - {4A7EF852-8AFC-4E60-8BE8-34743534EACC} - hksrv.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - E:\Avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - E:\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - E:\Avast\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - E:\Avast\ashWebSv.exe" /service (file missing)

Merci pour la suite,