infection avec des WORM's sous Windows millenium

minikisskool · le 7 octobre 2006

Bonsoir à tous,

j'ai besoin de votre aide pour l'infection du pc d'un copain :

après avoir fait une analyse en mode sans echec avec Antivir PE, j'ai quelques worm résidants dans le dossier caché "c:\_restore\temp" et je ne peux les éradiquer !!!!

Alors avant d'aller plus loin dans le nettoyage (hijackthis et consor), toute aide est la bienvenue.

Merci d'avance.

Voici les 2 rapports de scan fait avec Antivir PE :

AntiVir PersonalEdition Classic

Report file date: samedi 7 octobre 2006 20:26

Scanning for 522603 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-WURGE-0001

Platform: Windows Me

Windows version: (plain) [4.90.3000]

Username: unknown

Computer name: OEMCOMPUTER

Version information:

AVSCAN.EXE : 7.0.0.47 196648 21/08/2006 10:06:50

AVSCAN.DLL : 7.0.0.45 41000 07/09/2006 10:51:52

LUKE.DLL : 7.0.0.47 110632 07/09/2006 10:32:30

LUKERES.DLL : 7.0.0.47 9256 07/09/2006 10:51:52

ANTIVIR0.VDF : 6.35.0.1 7371264 31/05/2006 10:35:12

ANTIVIR1.VDF : 6.36.0.89 1745920 02/10/2006 18:16:18

ANTIVIR2.VDF : 6.36.0.90 2048 02/10/2006 18:16:18

ANTIVIR3.VDF : 6.36.0.96 62976 06/10/2006 18:16:18

AVEWIN32.DLL : 7.2.0.25 1860096 07/10/2006 18:16:18

AVPREF.DLL : 7.0.0.2 17960 24/07/2006 12:35:38

AVREP.DLL : 6.36.0.79 569384 07/10/2006 18:16:18

AVRPBASE.DLL : 7.0.0.0 1544232 30/03/2006 08:42:44

AVPACK32.DLL : 7.2.0.0 360488 21/07/2006 06:00:30

AVREG.DLL : 6.31.0.90 25128 28/07/2005 10:06:12

NETNW.DLL : 7.0.0.0 9768 24/07/2006 12:35:40

RCIMAGE.DLL : 7.0.0.74 1642536 01/08/2006 11:22:52

RCTEXT.DLL : 7.0.1.4 77864 07/10/2006 18:16:12

Configuration settings for the scan:

Jobname.......................: Local Hard Disks

Configuration file............: C:\PROGRAM FILES\ANTIVIR PERSONALEDITION CLASSIC\alldiscs.avp

Boot sectors..................: C

Scan memory...................: 1

Process scan..................: 1

Scan all files................: 1

Scan archives.................: 1

Recursion depth...............: 20

Smart extensions..............: 1

Skipped archive types.........: 1000,1001,1002,1003,1004,1005,

Macro heuristic...............: 1

File heuristic................: 3

Primary action................: 1

Secondary action..............: 0

Start of the scan: samedi 7 octobre 2006 20:26

The scan of running processes will be started

8 Processes were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( 33 files ).

Starting the file scan:

C:\_RESTORE\TEMP\A0286374.CPY

[DETECTION] Contains signature of the worm WORM/Netsky.D.3

[WARNING] The file could not be deleted!

C:\WINDOWS\WIN386.SWP

[WARNING] The file could not be opened!

C:\WINDOWS\Temporary Internet Files\CONTENT.IE5\GKMDQ5SQ\document_full.pif

[DETECTION] Contains signature of the worm WORM/Netsky.D.3

[iNFO] The file was deleted!

C:\WINDOWS\Temporary Internet Files\CONTENT.IE5\7QI1BLV5\Mail Delivery (failure [email protected]).dat

[DETECTION] Contains signature of the worm WORM/NetSky.P.Expl

[iNFO] The file was deleted!

C:\WINDOWS\Temporary Internet Files\CONTENT.IE5\31NCQWI9\ParisVoyeur[1].exe

[DETECTION] Contains signature of the dial-up program DIAL/45992.A

[iNFO] The file was deleted!

C:\WINDOWS\Temporary Internet Files\CONTENT.IE5\31NCQWI9\Mail Delivery (failure [email protected]).dat

[DETECTION] Contains signature of the worm WORM/NetSky.P.Expl

[iNFO] The file was deleted!

C:\WINDOWS\Temporary Internet Files\CONTENT.IE5\V5LHP5QF\.dat