Infection virtumonde + virtumonde generic + MS Windows security center

Bonjour,

J'ai 3 infections. J'ai lancé Spybot. Il m'a sorti 3 problèmes:
- Virtumonde
- Virtumonde.generic
- MS windows security center disabled.

J'ai lancé combofix, vundofix, clean (malekal morte) et Hijackthis.

Je poste les rapports.

Pouvez vous m'aider SVP?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19, on 2009-01-04
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\winsys2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
c:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\ComboFix\catchme.cfexe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Friniace\Bureau\Antivirus\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5345 bytes


VundoFix V6.5.0

Checking Java version...

Java version is 1.4.2.5
Old versions of java are exploitable and should be removed.

Scan started at 15:06:25 04/01/2009

Listing files found while scanning....

No infected files were found.


Beginning removal...


Combofix:

2006-12-15 03:57      200704    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\WinSys.exe.vir

2007-10-11 20:19      1671391    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\fmssfrance5.WMV.vir

2007-10-11 20:31      32501    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\Document CNAV2.pdf.vir

2007-10-11 20:31      40266    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\Document CNAV0001.pdf.vir

2007-10-11 20:43      37641    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\OPALE-OPTION-3-GARANTIES-ET-COTISATIONS-2007.pdf.vir

2007-10-11 20:43      66973    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\TERMS-OF-BUSINESS-FRENCH.pdf.vir

2007-10-11 21:50      35809    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\OPALE-OPTION-2-GARANTIES-ET-COTISATIONS-2007.pdf.vir

2007-10-11 21:51      117683    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\INITIAL-DISCLOSURE-DOCUMENT-FRENCH.pdf.vir

2007-10-11 21:51      142842    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\RESUME-DE-LA-POLICE-OPALE.pdf.vir

2007-10-11 21:51      37573    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\OPALE-OPTION-1-GARANTIES-ET-COTISATIONS-2007.pdf.vir

2007-10-21 18:26      91683    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Friniace\MESDOC~1\SCURIT~1\CG-OPALE-3-OPTIONS-2006.pdf.vir

 
 
Structure du dossier

Le num‚ro de s‚rie du volume est EC15-A9AF

C:\QOOBOX

\---Quarantine

    +---C

    |   +---DOCUME~1

    |   |   \---Friniace

    |   |       \---MESDOC~1

    |   |           \---SCURIT~1

    |   |                   CG-OPALE-3-OPTIONS-2006.pdf.vir

    |   |                   Document CNAV0001.pdf.vir

    |   |                   Document CNAV2.pdf.vir

    |   |                   fmssfrance5.WMV.vir

    |   |                   INITIAL-DISCLOSURE-DOCUMENT-FRENCH.pdf.vir

    |   |                   OPALE-OPTION-1-GARANTIES-ET-COTISATIONS-2007.pdf.vir

    |   |                   OPALE-OPTION-2-GARANTIES-ET-COTISATIONS-2007.pdf.vir

    |   |                   OPALE-OPTION-3-GARANTIES-ET-COTISATIONS-2007.pdf.vir

    |   |                   RESUME-DE-LA-POLICE-OPALE.pdf.vir

    |   |                   TERMS-OF-BUSINESS-FRENCH.pdf.vir

    |   |                   

    |   \---WINDOWS

    |       \---system32

    |               WinSys.exe.vir

    |               

    \---Registry_backups

Rapport clean (malekal morte):

2009-01-04 a 15:20:06.01

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !