Bonjour,
Ma machine est infectée avec des vers log.exe et autorun.inf
Voilà ce que ça donne comme résultat avec le rapport de UsbFix:
############################## [ UsbFix V3.011 ]
# User : Administrateur (Administrateurs) # POSTE9
# Update on 23/04/09 by C_XX & Chiquitine29
# Start at: 14:39:26 | 24/04/2009
# Intel(R) Pentium(R) 4 CPU 1.80GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus 8.5 [ Enabled | Updated ]
# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 37,27 Go (23,5 Go free) [SYSTEME] # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque CD-ROM
# F:\ # Disque amovible # 1,94 Go (970,36 Mo free) [NTSIHOU] # FAT32
############################## [ Processus actifs ]
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\csrss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS1\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS1\Explorer.EXE
C:\WINDOWS1\system32\igfxtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS1\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\bycool1\windo.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\WINDOWS1\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS1\System32\alg.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS1\system32\wbem\wmiapsrv.exe
C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil VoIP Plugin.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS1\system32\wbem\wmiprvse.exe
################## [ Registre # Startup ]
HKCU_Main: "Search Page"="http://search.live.com"
HKCU_Main: "Start Page"="http://www.google.fr/"
HKLM_logon: "Userinit"="C:\\WINDOWS1\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="Administrateur"
HKLM_logon: "AltDefaultUserName"="Administrateur"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: IgfxTray=C:\WINDOWS1\system32\igfxtray.exe
HKLM_Run: HotKeysCmds=C:\WINDOWS1\system32\hkcmd.exe
HKLM_Run: AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe
HKLM_Run: NeroFilterCheck=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
HKLM_Run: HPDJ Taskbar Utility=C:\WINDOWS1\system32\spool\drivers\w32x86\3\hpztsb10.exe
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre6\bin\jusched.exe"
HKLM_Run: QuickTime Task="C:\Program Files\QuickTime\QTTask.exe" -atboottime
HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM_Run: SearchSettings=C:\Program Files\pdfforge Toolbar\SearchSettings.exe
HKLM_Run: iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKLM_Run: DRIVESYS1=C:\Windows\System32\bycool1\windo.exe
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
HKCU_Run: SuperCopier2.exe=C:\Program Files\SuperCopier2\SuperCopier2.exe
HKCU_Run: ctfmon.exe=C:\WINDOWS1\system32\ctfmon.exe
HKCU_Run: Yahoo! Pager="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
HKCU_Run: ccleaner="C:\Program Files\CCleaner\CCleaner.exe" /AUTO
HKCU_Run: SUPERAntiSpyware=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
################## [ Informations ]
# Contenu de l'autorun F:\autorun.inf
[AutoRun]
open=log.exe
shellexecute=log.exe
shell\Ouvrir\command=log.exe
shell=Ouvrir
################## [ Fichiers # Dossiers infectieux ]
Found ! F:\log.exe
Found ! F:\autorun.inf
################## [ Registre # Clés Run infectieuses ]
Found ! HKLM\software\microsoft\security center\\ "UpdatesDisableNotify"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "DRIVESYS1"
################## [ Registre # Mountpoints2 ]
HKCU\Software\Microsoft\....\MountPoints2\{0223a272-1f8a-11de-b4d7-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{333475d8-1bc2-11de-b4cf-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{5058707a-29c1-11de-b4f4-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{5058707a-29c1-11de-b4f4-0018e4083d59}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{5058707b-29c1-11de-b4f4-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{5058707c-29c1-11de-b4f4-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{5058707c-29c1-11de-b4f4-0018e4083d59}\Shell\explore\Command
HKCU\Software\Microsoft\....\MountPoints2\{5058707c-29c1-11de-b4f4-0018e4083d59}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{5058707d-29c1-11de-b4f4-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{5058707d-29c1-11de-b4f4-0018e4083d59}\Shell\explore\Command
HKCU\Software\Microsoft\....\MountPoints2\{5058707d-29c1-11de-b4f4-0018e4083d59}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{562b73f8-dbc0-11dd-9554-0008743575ff}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{58ec1e88-2f5a-11de-b506-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{6bb612d5-2993-11de-b4f3-0018e4083d59}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{6bb612d5-2993-11de-b4f3-0018e4083d59}\Shell\explore\Command
HKCU\Software\Microsoft\....\MountPoints2\{6bb612d5-2993-11de-b4f3-0018e4083d59}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{a4d10ecb-f118-11dd-ae2b-0008743575ff}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{a4d10ecb-f118-11dd-ae2b-0008743575ff}\Shell\open\Command
HKCU\Software\Microsoft\....\MountPoints2\{c2830466-1236-11de-a8f4-0008743575ff}\Shell\AutoRun\command
HKCU\Software\Microsoft\....\MountPoints2\{eed85b01-300a-11de-b50b-0018e4083d59}\Shell\AutoRun\command
################## [ ! Fin du rapport # UsbFix V3.011 ! ]
