Virus ds Sys. Vol. Inf. ds mon disque D:\

Bonjour et merci d’avance pour l’aide!

J’ai des virus dans mon disque D:\. J’ai fais un scan avec HijackThis, AVG-AS et Bit Defender et le plus intéressant c’est qui a seulement Bit Defender qui les trouves mais tente de faire les mises à jour pareil même si il les supprimes. Donc ils sont encore dans mon PC!

J’ai débuté avec CCleaner ensuite avec HijackThis, qui en passant ne changeras rien aux résultats des autres tests puisqu’il ne va pas sur le disque D:\. AVG-AS en mode sans échec pour terminer avec Bit Defender. Entre chaque scan j’ai ‘rebooté’ l’ordi et j’ai aussi fais un System Restore sur le disque D:\. Je suis au bout de mais ressources… :o(

Pourquoi que Bit Defender voit ce qu’AVG-AS ne voit pas?

Voici les rapports des scans mentionnés, pour commencer HijackThis…

Logfile of HijackThis v1.99.1
Scan saved at 5:30:47 PM, on 30/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\HP\KBD\KBD.EXE
C:\Documents and Settings\HP_Administrator\Desktop\HijackThis.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hp-consumer.my.aol.ca/?icid=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.trafficswarm.com/login
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.trafficswarm.com/login
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A7A4174-FF89-4DDE-BD7A-2C26F205C257}: NameServer = 192.168.2.2
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Mon disque C:\ est correct, tout ce passe sur le D:\...
________________________________________________________

Maintenant AVG-AS…

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 8:57:41 PM 30/03/2007

+ Résultat de l'analyse:



C:\Program Files\Instant Buzz\IBMH.dll -> Adware.InstantBuzz : Aucune action entreprise.


Fin du rapport

InstantBuzz est ok! Mais rien dans mon disque D:\!?!?!
_______________________________________________________

Pour terminer Bit Defender…

BitDefender Online Scanner
Scan report generated at: Sat, Mar 31, 2007 - 04:00:14

Scan path: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Messenger\dannylelievre32@hotmail.com\Sharing Folders;C:\Documents and Settings\HP_Administrator\Dan's Docs;C:\Documents and Settings\All Users\Documents;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;C:\Documents and Settings\HP_Administrator\Dan's Docs;C:\Documents and Settings\HP_Administrator\Desktop\backups;C:\Documents and Settings\HP_Administrator\Desktop\Exercices;C:\Documents and Settings\HP_Administrator\Desktop\Music;C:\Documents and Settings\HP_Administrator\Desktop\MySourceOf Music;C:\Documents and Settings\HP_Administrator\Desktop\Navilog;C:\Documents and Settings\HP_Administrator\Desktop\Protection;C:\Documents and Settings\HP_Administrator\Desktop\Studio MetalSource;

Statistics
Time 01:53:17
Files 667870
Folders 9123
Boot Sectors 5
Archives 16248
Packed Files 76552

Results
Identified Viruses 4
Infected Files 4
Suspect Files 0
Warnings 0
Disinfected 0
Deleted Files 4

Engines Info
Virus Definitions 409127
Engine build AVCORE v1.0 (build 2397) (i386) (Feb 8 2007 14:24:08)
Scan plugins 14
Archive plugins 38
Unpack plugins 6
E-mail plugins 6
System plugins 1

Scan Settings
First Action Delete
Second Action None
Heuristics Yes
Enable Warnings Yes
Scanned Extensions *;
Exclude Extensions
Scan Emails Yes
Scan Archives Yes
Scan Packed Yes
Scan Files Yes
Scan Boot Yes


Scanned File Status
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0018 Infected with: Trojan.Dloader.HK
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0018 Deleted
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe Update failed
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0019 Infected with: Dropped:Application.Adware.NewDotNet.A
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0019 Deleted
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe Update failed
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0020 Infected with: Trojan.Muldrop.A
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0020 Deleted
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe Update failed
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0021 Infected with: Trojan.Dropper.Agent.ER
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe=>wise0021 Deleted
D:\System Volume Information\_restore{6194C0E3-4DAF-4C5A-BD03-5D21F3E3AC4B}\RP2\A0000084.exe Update failed

Comme je disais c’est le seul qui trouve qlq choses dans mon disque D:\...!

Qu’est que je peux faire maintenant pour les supprimer?

Merci encore pour votre aide…!

TropJean ;o)