worm.win32

Je me demandais si quelqu'un pourrait m'aider avec ce virus. J'ai couru HijackThis et obtenu ce résultat:


Running processes:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ Lavasoft \ Ad-Aware \ aawservice.exe
C: \ WINDOWS \ system32 \ Ati2evxx. exe
C: \ Program Files \ DigitalPersona \ Bin \ DPWinLct.exe
C: \ WINDOWS \ system32 \ spoolsv.exe
C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder.exe
C: \ Program Files \ DigitalPersona \ Bin \ DpHost.exe
C: \ Program Files \ McAfee \ Common Framework \ FrameworkService.exe
C: \ Program Files \ McAfee \ VirusScan Enterprise \ Mcshield.exe
C: \ Program Files \ McAfee \ VirusScan Enterprise \ VsTskMgr. exe
C: \ Program Files \ Fichiers communs \ Microsoft Shared \ VS7DEBUG \ Mdm.exe
C: \ WINDOWS \ system32 \ pctspk.exe
C: \ WINDOWS \ system32 \ RioMSC.exe
C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxWatch10.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ DigitalPersona \ Bin \ DPFUSMgr.exe
C: \ WINDOWS \ Explorer.EXE
C: \ WINDOWS \ SOUNDMAN.EXE
C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe
C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched. exe
C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxWatchTray10.exe
C: \ Program Files \ Roxio \ CinePlayer \ DMXLauncher.exe
C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ MOM.exe
C: \ Program Files \ DigitalPersona \ Bin \ DPAgnt.exe
C: \ Program Files \ McAfee \ Common Framework \ UdaterUI.exe
C: \ Program Files \ HP \ HP Software Update \ HPWuSchd2.exe
C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxMediaDB10. exe
C: \ Program Files \ iTunes \ iTunesHelper.exe
C: \ Program Files \ McAfee \ Common Framework \ McTray.exe
C: \ WINDOWS \ system32 \ ctfmon.exe
C: \ Program Files \ Microsoft ActiveSync \ Wcescomm.exe
C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNotifier.exe
C: \ PROGRA ~ 1 \ MI3AA1 ~ 1 \ rapimgr.exe
C: \ Program Files \ HP \ Digital Imaging \ bin \ hpqtra08.exe
C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ CPSHelpRunner10. exe
C: \ Program Files \ Silicon Image \ SiISATARaid \ SATARaid.exe
C: \ Program Files \ iPod \ bin \ iPodService.exe
C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CCC.exe
C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis.exe
C: \ WINDOWS \ system32 \ Wuauclt.exe
C: \ Program Files \ Mozilla Firefox \ firefox. exe

R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings, ProxyOverride = *. local
R3 - URLSearchHook: P2P Torrent Toolbar - (bc4be15d-6a34-4356-9e97-79e43da32b1d) - C: \ Program Files \ P2P_Torrent \ tbP2P1.dll
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Installs \ CPN \ yt.dll
O2 - BHO: & Yahoo! Toolbar Helper - (02478D38-C3F9-4efb-9B51-7695ECA05670) - C: \ Program Files \ Yahoo! \ Companion \ Installs \ CPN \ yt. dll
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files \ Fichiers communs \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - (22BF413B-C6D2-4d91-82A9-A0F997BA588C) - C: \ Program Files \ Skype \ Toolbars \ Internet Explorer \ SkypeIEPlugin.dll
O2 - BHO: CDNSCacheObj Object - (376892AE-1825-4E5F-9F85-23F9640051CC) - C: \ WINDOWS \ xmljacodec. dll (file missing)
O2 - BHO: Groove GFS Browser Helper - (72853161-30C5-4D22-B7F9-0BBC1D38A37E) - C: \ Program Files \ Microsoft Office \ Office12 \ GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll
O2 - BHO: scriptproxy - (7DB2D5A0-7241-4E79-B68D-6309F01C5231) - C: \ Program Files \ McAfee \ VirusScan Enterprise \ scriptcl. dll
O2 - BHO: Google Toolbar Helper - (AA58ED58-01DD-4d91-8333-CF10577473F7) - c: \ program files \ google \ googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files \ Google \ GoogleToolbarNotifier \ 3.1.807.1746 \ swg.dll
O2 - BHO: P2P Torrent Toolbar - (bc4be15d-6a34-4356-9e97-79e43da32b1d) - C: \ Program Files \ P2P_Torrent \ tbP2P1.dll
O2 - BHO: QXK Olive - (EB3401DA-3419-4303-9848-11F4BEDB689E) - C: \ WINDOWS \ dfmlxbpktfo. dll
O3 - Toolbar: & Google - (2318C2B1-4965-11D4-9B18-009027A5CD4F) - c: \ program files \ google \ googletoolbar2.dll
O3 - Toolbar: P2P Torrent Toolbar - (bc4be15d-6a34-4356-9e97-79e43da32b1d) - C: \ Program Files \ P2P_Torrent \ tbP2P1.dll
O3 - Toolbar: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - C: \ Program Files \ Yahoo! \ Companion \ Installs \ CPN \ yt.dll
O3 - Toolbar: peltodgx - (C01D990F-AB58-4AB5-B617-C2E4E7961434) - C: \ WINDOWS \ peltodgx.dll
O4 - HKLM \ .. \ Run: [sonorisateur] SOUNDMAN.EXE
O4 - HKLM \ .. \ Run: [GrooveMonitor] "C: \ Program Files \ Microsoft Office \ Office12 \ GrooveMonitor.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [StartCCC] "C: \ Program Files \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe"
O4 - HKLM \ .. \ Run: [RoxWatchTray] "C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxWatchTray10.exe"
O4 - HKLM \ .. \ Run: [DMXLauncher] "C: \ Program Files \ Roxio \ CinePlayer \ DMXLauncher.exe"
O4 - HKLM \ .. \ Run: [REMOTECONTROL] "C: \ Program Files \ CyberLink \ PowerDVD \ PDVDServ.exe"
O4 - HKLM \ .. \ Run: [DPAgnt] C: \ Program Files \ DigitalPersona \ Bin \ DPAgnt.exe
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [ShStatEXE] "C: \ Program Files \ McAfee \ VirusScan Enterprise \ SHSTAT. EXE "/ Standalone
O4 - HKLM \ .. \ Run: [McAfeeUpdaterUI] "C: \ Program Files \ McAfee \ Common Framework \ UdaterUI.exe" / StartedFromRunKey
O4 - HKLM \ .. \ Run: [HP Software Update] C: \ Program Files \ HP \ HP Software Update \ HPWuSchd2.exe
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files \ QuickTime \ qttask.exe"-atboottime
O4 - HKLM \ .. \ Run: [AppleSyncNotifier] C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleSyncNotifier.exe
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files \ iTunes \ iTunesHelper.exe"
O4 - HKCU \ .. \ Run: [ctfmon.exe] C: \ WINDOWS \ system32 \ ctfmon.exe
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files \ MSN Messenger \ msnmsgr.exe" / background
O4 - HKCU \ .. \ Run: [H / PC Connection Agent] "C: \ Program Files \ Microsoft ActiveSync \ Wcescomm.exe"
O4 - HKCU \ .. \ Run: [swg] C: \ Program Files \ Google \ GoogleToolbarNotifier \ GoogleToolbarNotifier.exe
O4 - HKCU \ .. \ Run: [] C: \ Documents and Settings \ Steven \ Application Data \ Adobe \ player.exe
O4 - HKCU \ .. \ Run: [A00F242D073.exe] C: \ DOCUME ~ 1 \ Steven \ LOCALS ~ 1 \ Temp \ _A00F242D073.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C: \ Program Files \ HP \ Digital Imaging \ bin \ hpqtra08.exe
O4 - Global Startup: SATARaid.lnk = C: \ Program Files \ Silicon Image \ SiISATARaid \ SATARaid. exe
O6 - HKCU \ Software \ Policies \ Microsoft \ Internet Explorer \ Restrictions présent
O7 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegedit = 1
O8 - Extra du menu contextuel: E & xporter vers Microsoft Excel -- res://C : \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv. dll
O9 - Extra "Outils" menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll
O9 - Extra button: Envoyer à OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra "Outils" menuitem: S & end à OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ ONBttnIE. dll
O9 - Extra button: Create Mobile Favorite - (2EAF5BB1-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ MI3AA1 ~ 1 \ INetRepl.dll
O9 - Extra button: (no name) - (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ MI3AA1 ~ 1 \ INetRepl.dll
O9 - Extra "Outils" menuitem: Create Mobile Favorite...- (2EAF5BB2-070F-11D3-9307-00C04FAE2D4F) - C: \ PROGRA ~ 1 \ MI3AA1 ~ 1 \ INetRepl. dll
O9 - Extra button: Skype - (77BF5300-1474-4EC7-9980-D32B190E9B07) - C: \ Program Files \ Skype \ Toolbars \ Internet Explorer \ SkypeIEPlugin.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ REFIEBAR.DLL
O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra "Outils" menuitem: @ xpsp3res. dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O9 - Extra "Outils" menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs. exe
O16 - DPF: (6E32070A-766D-4EE6-879C-DC1FA91D2FC3) (MUWebControl Class) -- http://www.update.microsoft.com/microso ... 1985880640
O16 - DPF: (6F15128C-E66A-490C-B848-5000B5ABEEAC) (HP Download Manager) -- https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cab
O16 - DPF: (86A88967-7A20-11D2-8EDA-00600818EDB1) (ParallelGraphics Cortona Control) -- http://www.parallelgraphics.com/l2/bin/cortvrml.cab
O16 - DPF: (A90A5822-F108-45AD-8482-9BC8B12DD539) (Crucial cpcScan) -- http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: (D27CDB6E-AE6D-11CF-96B8-444553540000) (Shockwave Flash Object) -- http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - (88FED34C-F0CA-4636-A375-3CB6248B04CD) - C: \ Program Files \ Microsoft Office \ Office12 \ GrooveSystemServices.dll
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ Common ~ 1 \ Skype \ SKYPE4 ~ 1.DLL
O20 - Winlogon Notify: DPWLN - C: \ WINDOWS \ system32 \ DPWLEvHd.dll
O20 - Winlogon Notify: __c00D4059 - C: \ WINDOWS \ system32 \ __c00D4059. dat
O21 - SSODL: onfwbsak - (0D29D567-3659-4F24-984C-4C27CCCD67BF) - (no file)
O21 - SSODL: rwlfsdmk - (6A9AE868-A50E-4458-8620-A3FB8FFDA0B1) - C: \ WINDOWS \ rwlfsdmk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C: \ Program Files \ Lavasoft \ Ad-Aware \ aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc - C: \ Program Files \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc -- C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C: \ WINDOWS \ system32 \ ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc - C: \ Program Files \ Bonjour \ mDNSResponder.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc - C: \ Program Files \ DigitalPersona \ Bin \ DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc - C: \ Program Files \ DigitalPersona \ Bin \ DpHost. exe
O23 - Service: Google Updater Service (gusvc) - Google - C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: LVSrvLauncher - Logitech Inc - C: \ Program Files \ Common Files \ LogiShrd \ SrvLnch \ SrvLnch.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc - C: \ Program Files \ McAfee \ Common Framework \ FrameworkService. exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc - C: \ Program Files \ McAfee \ VirusScan Enterprise \ Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc - C: \ Program Files \ McAfee \ VirusScan Enterprise \ VsTskMgr.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCTEL, Inc - C: \ WINDOWS \ system32 \ pctspk.exe
O23 - Service: pml Driver HPZ12 - HP - C: \ WINDOWS \ system32 \ HPZipm12. exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc - C: \ WINDOWS \ system32 \ RioMSC.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C: \ Program Files \ Roxio \ Digital Home 10 \ RoxioUPnPRenderer10.exe
O23 - Service: Roxio upnp Server 10 - Sonic Solutions - C: \ Program Files \ Roxio \ Digital Home 10 \ RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C: \ Program Files \ Common Files \ Roxio Shared \ 10. 0 \ SharedCOM \ RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C: \ Program Files \ Common Files \ Roxio Shared \ 10.0 \ SharedCOM \ RoxWatch10.exe
O23 - Service: SessionLauncher - Unknown owner - C: \ DOCUME ~ 1 \ Steven \ LOCALS ~ 1 \ Temp \ DX9 \ SessionLauncher. exe (file missing)

--
Fin de fichier - 13,318 octets

Maintenant, j'ai besoin de savoir ce que je sens que je besoin d'aller et de réparer. Toute aide serait grandement appréciée.

Si vous n'utilisez pas de bit torrent, supprimer les 2 entrées.

R3 - URLSearchHook: P2P Torrent Toolbar - (bc4be15d-6a34-4356-9e97-79e43da32b1d) - C: \ Program Files \ P2P_Torrent \ tbP2P1.dll

O3 - Toolbar: P2P Torrent Toolbar - (bc4be15d-6a34-4356-9e97-79e43da32b1d) - C: \ Program Files \ P2P_Torrent \ tbP2P1.dll

Les deux suivants devraient être supprimés.

O3 - Toolbar: peltodgx - (C01D990F-AB58-4AB5-B617-C2E4E7961434) - C: \ WINDOWS \ peltodgx.dll

O4 - HKCU \ .. \ Run: [A00F242D073. exe] C: \ DOCUME ~ 1 \ Steven \ LOCALS ~ 1 \ Temp \ _A00F242D073.exe

Si vous ne pouvez pas ouvrir le Registre, supprimez l'entrée suivante.

O7 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System, DisableRegedit = 1


Supprimer les 3 dernières entrées.

O20 - Winlogon Notify: __c00D4059 - C: \ WINDOWS \ system32 \ __c00D4059. dat

O21 - SSODL: onfwbsak - (0D29D567-3659-4F24-984C-4C27CCCD67BF) - (no file)

O21 - SSODL: rwlfsdmk - (6A9AE868-A50E-4458-8620-A3FB8FFDA0B1) - C: \ WINDOWS \ rwlfsdmk.dll