Rootkits par kilos

Bonjour,

Quelqu'un peut-il m'aider à nettoyer mon odinateur?

J'ai suivi avec attention les étapes du très bon petit tutorial: http://www.commentcamarche.net/faq/sujet 3174 virus methode preliminaire de desinfection version fr

Donc voilà, j'ai nettoyé pas mal de trucs avec CCleaner, puis AVGCleaner (rien a signalé, peut-être parce que j'ai Kaspersky). Suivent le rapport de bitdefender, et celui de hijackthis.

Merci!!

jb

BITDEFENDER

BitDefender Online Scanner



Scan report generated at: Wed, Mar 19, 2008 - 23:37:02





Scan path: A:\;C:\;D:\;E:\;F:\;







Statistics

Time
03:41:37

Files
945955

Folders
9696

Boot Sectors
4

Archives
1254

Packed Files
50234




Results

Identified Viruses
7

Infected Files
9

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
9




Engines Info

Virus Definitions
1016341

Engine build
AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins
16

Archive plugins
41

Unpack plugins
7

E-mail plugins
6

System plugins
5




Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions


Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes




Scanned File
Status



C:\System Volume Information\_restore{38B7DF0A-90D5-4424-9BAD-6C63042F5834}\RP572\A0511456.exe
Detected with: Adware.Adtomi.AF

C:\System Volume Information\_restore{38B7DF0A-90D5-4424-9BAD-6C63042F5834}\RP572\A0511456.exe
Deleted

C:\System Volume Information\_restore{38B7DF0A-90D5-4424-9BAD-6C63042F5834}\RP572\A0511457.exe
Detected with: Adware.Adtomi.AC

C:\System Volume Information\_restore{38B7DF0A-90D5-4424-9BAD-6C63042F5834}\RP572\A0511457.exe
Deleted

C:\WINDOWS\AUTOEXEC.BAT
Infected with: Trojan.VB.SP.A

C:\WINDOWS\AUTOEXEC.BAT
Disinfection failed

C:\WINDOWS\AUTOEXEC.BAT
Deleted

C:\WINDOWS\win.ini
Infected with: Trojan.Vb.Sp.A

C:\WINDOWS\win.ini
Deleted

C:\WINDOWS\winiini.fin
Infected with: Trojan.Vb.Sp.A

C:\WINDOWS\winiini.fin
Deleted

C:\WINDOWS\winlog.vbs
Infected with: Trojan.VB.SP.A

C:\WINDOWS\winlog.vbs
Disinfection failed

C:\WINDOWS\winlog.vbs
Deleted

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>lsp_.dll
Detected with: Application.Sahagent.AC

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>lsp_.dll
Disinfection failed

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>lsp_.dll
Deleted

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab
Update failed

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>SAHUninstall_.exe
Detected with: Application.Sahagent.D

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>SAHUninstall_.exe
Disinfection failed

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab=>SAHUninstall_.exe
Deleted

E:\Documents and Settings\jb\Local Settings\Temporary Internet Files\Content.IE5\CPK9ANU7\bunSetup[1].cab
Update failed

E:\Documents and Settings\jb\Menu Démarrer\Programmes\Démarrage\PowerReg SchedulerV2.exe
Detected with: Application.Powerreg.Scheduler.C

E:\Documents and Settings\jb\Menu Démarrer\Programmes\Démarrage\PowerReg SchedulerV2.exe
Disinfection failed

E:\Documents and Settings\jb\Menu Démarrer\Programmes\Démarrage\PowerReg SchedulerV2.exe
Deleted





HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:42:21 p.m., on 19/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\IObit\Advanced WindowsCare V2\MemCleaner.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mdm.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Notepad++\notepad++.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://localhost/home/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Archivos de programa\Scpad\scpsssh2.dll
O2 - BHO: DBBManageUI - {69FC0024-10EB-480A-BBF2-3BF4E78E17B1} - C:\Archivos de programa\Core Services\DebugBar\DebugInfoBar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Companion.JS BHO - {ADDEE521-F1CC-4B89-8C88-B2CF625B9163} - C:\Archivos de programa\Core Services\Companion.JS\CompanionJS.dll
O2 - BHO: (no name) - {ADF08889-BF54-40A8-A4AE-FCABE6229D43} - (no file)
O3 - Toolbar: DebugBar - {3E1201F4-1707-409F-BB45-A5F192381DA0} - C:\Archivos de programa\Core Services\DebugBar\DebugToolBar.dll
O4 - HKLM\..\Run: [SmartRAM] C:\Archivos de programa\IObit\Advanced WindowsCare V2\MemCleaner.exe /m
O4 - HKLM\..\Run: [AVP] "C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\ARCHIV~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Anti-Banner - C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Companion.JS - {0402343A-B530-482b-AA27-A61CEC3E4D2E} - C:\Archivos de programa\Core Services\Companion.JS\CompanionJS.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A750DBB3-3B87-4786-9FD9-746AC24C6602}: NameServer = 200.204.0.10 200.204.0.10
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\Player\__CDS2.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\ARCHIV~1\KASPER~1\KASPER~1.0\adialhk.dll
O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Archivos de programa\Scpad\scpLIB.dll
O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Archivos de programa\Scpad\scpLIB.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Archivos de programa\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE