Probleme Virus !!! mon anti virus cé effacer et mon spybot aussi

Et je ne sais pas d ou ca provient ....je crois malgré tout que msn est en cause mais chu pu capable d installer d'anti virus, Ccleaner ne marche plus et plus capable d installer spybot que j avais déjà...... un rapport d'ewido :

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 19:59:32 2008-01-01

+ Scan result:

:mozilla.68:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
:mozilla.69:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
:mozilla.70:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
:mozilla.71:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@media.adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned with backup (quarantined).
:mozilla.47:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Adviva : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@adviva[1].txt -> TrackingCookie.Adviva : Cleaned with backup (quarantined).
:mozilla.36:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup (quarantined).
:mozilla.18:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.19:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.20:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup (quarantined).
:mozilla.72:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup (quarantined).
:mozilla.32:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.33:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.34:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.35:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned with backup (quarantined).
:mozilla.50:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup (quarantined).
C:\Documents and Settings\Shirley\Cookies\shirley@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup (quarantined).
:mozilla.27:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).
:mozilla.28:C:\Documents and Settings\Shirley\Application Data\Mozilla\Firefox\Profiles\h6rgq0w6.default\cookies.txt -> TrackingCookie.Weborama : Cleaned with backup (quarantined).

::Report end

Et bizarre voici ce que m écrit quand j ai fait la recherche pour un trojan

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\blind577@hotmail.com\DFSR\Staging\CS{65990F38-5D67-BA07-629B-301AF6B57F0F}\01\20-{65990F38-5D67-BA07-629B-301AF6B57F0F}-v1-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v20-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\blind577@hotmail.com\DFSR\Staging\CS{65990F38-5D67-BA07-629B-301AF6B57F0F}\21\22-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v21-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v22-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\blind577@hotmail.com\DFSR\Staging\CS{65990F38-5D67-BA07-629B-301AF6B57F0F}\21\23-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v21-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v23-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\nathmrm361521@hotmail.com\DFSR\Staging\CS{874EC328-E9F2-4263-A10E-BC817772C827}\01\10-{874EC328-E9F2-4263-A10E-BC817772C827}-v1-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v10-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\yannickpatry@hotmail.com\DFSR\Staging\CS{10BC00CF-198E-B04D-6C20-BF323A534A74}\01\11-{10BC00CF-198E-B04D-6C20-BF323A534A74}-v1-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v11-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\yannickpatry@hotmail.com\DFSR\Staging\CS{10BC00CF-198E-B04D-6C20-BF323A534A74}\12\16-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v12-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v16-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\yannickpatry@hotmail.com\DFSR\Staging\CS{10BC00CF-198E-B04D-6C20-BF323A534A74}\14\17-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v14-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v17-Downloaded.frx (WARNING: not scanned, path to long)
C:\Documents and Settings\Shirley\Local Settings\Application Data\Microsoft\Messenger\marienick20@hotmail.com\SharingMetadata\yannickpatry@hotmail.com\DFSR\Staging\CS{10BC00CF-198E-B04D-6C20-BF323A534A74}\15\18-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v15-{C2208EAE-5BB8-44BC-B679-AE97256BAFBD}-v18-Downloaded.frx (WARNING: not scanned, path to long)
C:\System Volume Information: (not scanned)
Trojan.Vundo has not been found on your computer.

Pour ce qui es de msnfix il détecte un virus mais le virus ne veut simplement par partir. J'avais déjà msnfix je l ai fais 3 fois a chaque fois nettoyé le tout et le virus et encore la ...la fois suivant


###Le rapport .....HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 20:46:00, on 2008-01-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Shirley\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {71E47C57-3306-481C-BBFD-1E2B4DC659AA} - C:\WINDOWS\system32\wvwxu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wi [...] 7798134368
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://titemawie22.spaces.live.com [...] nPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Fichiers communs\Acronis\Schedule2\schedul2.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Bonsoir

flobesst, c'est très sympa de ta part de vouloir l'aider.
je préfére reprendre ce topic car c'est ce qu'on appelle une "belle infection".

bagle: il le dit dans son titre:

on le retrouve ici:
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe

ce virus se trouve en général dans les cracks.

Vu que le windows me semble lui aussi cracké, (au moins le WGA), ça confirme les choses.


boboyz

fais ceci stp:
SVP merci d'envoyer le fichier C:\DOCUME~1\Shirley\Bureau\Upload_Me.zip sur http://upload.changelog.fr

+++++++++
~Télécharge Elibagla sur cette page :
http://www.zonavirus.com/datos/des [...] ibagla.asp

Tu trouveras le programme à télécharger tout en bas de la page :,
clique sur escargar Elibagla 10.14

Enregistre ce fichier sur le bureau
Va sur ton bureau et double-clic sur Elibagla.exe
La case "eliminar ficheros automaticamente" doit être cochée
Clique sur"explorar" et laisse-le travailler
~Poste le rapport final qui sera dans c:\infosat.txt

pas encore...

Désactive ton antivirus et tout autre type de protection.
Télécharge ComboFix de sUBs :
ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur ComboFix, Il va te poser une question, réponds en appuyant sur la touche1 puis attends que combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé. Poste le rapport.

ajoute un nouveau rapport Hijackthis.

tu peux me mp quand tu as besoin