WIn 32 encore et encore !

Oups !
J'ai oublié de poster les rapports :
1)
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 13:39:48 28/05/2008

+ Résultat de l'analyse:



C:\cfhh.exe -> Backdoor.Bifrose.snu : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\HÚlÞne\Bureau\Univerzal NERO 7 Keygen\Keygen\Nero7Keygen.exe -> Backdoor.Hupigon : Nettoyé.
[128] C:\WINDOWS\TEMP\89A2.tmp -> Downloader.Agent.mgq : Nettoyé et sauvegardé (mise en quarantaine).
C:\lxpkylkt.exe -> Downloader.Injecter.sf : Nettoyé.
C:\Program Files\eChanblard\EvID4226Patch.exe -> Not-A-Virus.Hacktool.EvID : Nettoyé.
C:\Program Files\eChanblard\config\last.zip/EvID4226Patch.exe -> Not-A-Virus.Hacktool.EvID : Nettoyé.
C:\Documents and Settings\HÚlÞne\Cookies\system@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@msnaccountservices.112.2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\WINDOWS\system32\config\systemprofile\Cookies\system@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\HÚlÞne\Local Settings\Temp\Cookies\húlþne@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.


Fin du rapport

2)
BitDefender Online Scanner - Real Time Virus Report
Generated at: Wed, May 28, 2008 - 15:43:16


Scan Info
Scanned Files 105501
Infected Files 8


Virus Detected
Trojan.Downloader.JJZF 1
Trojan.Dropper.Kobcka.C 2
Backdoor.Generic.49351 1
Backdoor.Rustock.NDI 1
Dropped:Trojan.Downloader.Zlob.ABMP 1
Trojan.Patched.BR 2




This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.
3)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:45:50, on 28/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Money\System\reminder.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = https://internetsearchservice.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.free.fr/freebox/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://internetsearchservice.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://internetsearchservice.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://internetsearchservice.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.avast.com/fr-fr/premium-security
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregFre\ereg.ini"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O20 - Winlogon Notify: winctrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

J'ai scanné successivement mon ordi avec chacun d'eux comme je l'ai lu ici. Je pensais bien faire :-(

Mon antivirus du quotidien c'est Avast.
J'ai téléchargé les autres pour produire les rapports qui permettrait à un "spécialiste" de m'aider à éliminer ces Win 32 comme expliquer dans le lien suivant( http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr)

Bref... quelque soit la méthode employée, sais-tu comment je peux éliminer ces vers de mon ordi ?

OK je fais ça ...
ET je reviens te voir!

Merci de te pencher sur mon cas !! D'autant que les jours de mon ordi sont comptés; mon mari a très envie de le formater :-(

Voici le rapport :
BitDefender Online Scanner



Scan report generated at: Sat, May 31, 2008 - 21:44:28





Scan path: A:\;C:\;D:\;E:\;F:\;







Statistics

Time
00:35:08

Files
112258

Folders
2645

Boot Sectors
3

Archives
11418

Packed Files
7631




Results

Identified Viruses
2

Infected Files
4

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
4




Engines Info

Virus Definitions
1255425

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
16

Archive plugins
42

Unpack plugins
7

E-mail plugins
6

System plugins
5




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status

C:\Documents and Settings\HÚlÞne\Local Settings\Temporary Internet Files\Content.IE5\NOG53JH6\wssl62_b[1].exe
Infected with: Trojan.Patched.BR

C:\Documents and Settings\HÚlÞne\Local Settings\Temporary Internet Files\Content.IE5\NOG53JH6\wssl62_b[1].exe
Disinfection failed

C:\Documents and Settings\HÚlÞne\Local Settings\Temporary Internet Files\Content.IE5\NOG53JH6\wssl62_b[1].exe
Deleted

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0005915.dll
Infected with: Trojan.Dropper.Kobcka.C

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0005915.dll
Disinfection failed

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0005915.dll
Deleted

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0008922.dll
Infected with: Trojan.Dropper.Kobcka.C

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0008922.dll
Disinfection failed

C:\System Volume Information\_restore{58EB694D-FC85-460A-B0C6-5CF33F5C4476}\RP13\A0008922.dll
Deleted

C:\WINDOWS\Temp\825F.tmp
Infected with: Trojan.Patched.BR

C:\WINDOWS\Temp\825F.tmp
Disinfection failed

C:\WINDOWS\Temp\825F.tmp
Deleted