Tr/crypt.xpack.gen

Bonjour.

Je me permets de poster ici pour demander si une âme charitable pourrait me donner quelques conseils pour enlever ce virus des deux fichiers qu'Antivir me trouve à chaque démarrage...

J'ai parcouru quelques solutions écrites sur ce forum mais rien à faire... et de plus, je ne suis pas un expert du tout dans l'interprétation des reports...

Si quelqu'un voulait bien me tendre une perche, je lui en serait reconnaissant.

J'ai utilisé Hijackthis et SDFix pour commencer. Voici les rapports que j'ai obtenu.

Hijackthis:

[quote]Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:33:05, on 20/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\sched.exe
D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\UTILITAIRES\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\explorer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Nichols\Mes documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ig?hl=fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [FLMLABTECMOUSE] C:\Program Files\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\UTILITAIRES\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v3] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] "D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM6b218229] Rundll32.exe "C:\WINDOWS\system32\kpxaophr.dll",s
O4 - HKLM\..\Run: [6812b1b5] rundll32.exe "C:\WINDOWS\system32\ekunxqdv.dll",b
O4 - HKCU\..\Run: [PeerGuardian] D:\UTILITAIRES\PeerGuardian\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - E:\Titan Poker\casino.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Party Poker\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Party Poker\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/...
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\UTILITAIRES\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
End of file - 6929 bytes
SDFix:

[quote]MSNFix 1.717

C:\Documents and Settings\Nichols\Bureau\VIRUS\MSNFix\MSNFix
Fix exécuté le 20/05/2008 - 19:26:30,00 By Nichols
mode normal

************************ Recherche les fichiers présents

... C:\WINDOWS\system32\mcrh.tmp
... C:\??????.exe
... C:\WINDOWS\cookies.ini
... C:\WINDOWS\system32\mcrh.tmp

************************ Recherche les dossiers présents

Aucun dossier trouvé

************************ Suppression des fichiers

.. OK ... C:\WINDOWS\system32\mcrh.tmp
/!\ ... C:\??????.exe
.. OK ... C:\WINDOWS\cookies.ini
.. OK ... C:\WINDOWS\system32\mcrh.tmp

************************ Nettoyage du registre

Les fichiers encore présents seront supprimés au prochain redémarrage

************************ Suppression des fichiers

.. OK ... C:\??????.exe

************************ Fichiers suspects
Aucun Fichier trouvé

Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 20052008_20110481.zip

************************ HKLM\...\Winlogon\Userinit

Userinit = C:\WINDOWS\system32\userinit.exe,

Important :

------------------------------------------------------------------------
Auteur : !aur3n7 Contact:
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------
J'ai également désactivé la restauration système.

De plus (et je pense ça lié, non?), quelques fenêtres (type spam sur nouvelle fenêtre) apparaissent pendant mon utilisation d'Explorer et un message Visual C++ m'informe de l'incapacité de l'utiliser...


Quelqu'un peut-il me venir en aide, je vous prie?

Merci par avance!

Edit: J'avais oublié de noter le catchme également. Le voici:

[quote]catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-05-20 20:24:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="D:\UTILITAIRES téléchargés\Daemon Tools\"
"h0"=dword:00000000
"khjeh"=hex:23,6c,3e,5c,83,02,5f,50,7d,f0,2f,07,14,20,bc,29,eb,fd,7d,82,89,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,90,48,9e,ed,51,5e,37,f3,18,14,ed,c0,44,4d,f4,e0,c6,..
"khjeh"=hex:0e,8e,5a,28,92,14,5b,32,44,91,f1,1e,ba,5a,6a,e7,17,72,6c,3d,78,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:64,62,03,00,a0,c7,2b,00,e1,a1,41,00,f8,ff,ff,ff,48,c2,2b,00,d8,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:7c,e1,52,9c,b0,a8,31,da,8b,a6,88,33,62,02,b1,c1,26,36,bc,38,da,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:e7,f7,77,61,8b,41,54,d6,f1,11,37,da,bd,35,ac,50,4e,1a,e6,6e,ce,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:0017ae33
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:03360220
"s2"=dword:513dfa33
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="D:\UTILITAIRES\Daemon Tools\Daemon Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:b0,88,3f,0d,f7,66,6f,b8,fd,45,71,3d,c2,5b,7f,93,d5,4f,5d,ba,2d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,30,c1,35,23,1b,68,c7,06,e8,df,d8,dc,a4,86,4b,1d,a6,..
"hdf12"=hex:96,da,c0,d9,e5,1c,5c,d0,38,74,64,50,9c,e3,58,07,70,ca,5f,40,49,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,b9,5e,c2,ac,f1,04,86,dd,72,4c,c0,ff,a0,6b,ee,a9,22,d6,c6,e6,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"hdf12"=hex:6f,df,b8,01,d1,9d,32,33,4d,96,eb,4b,08,77,61,93,17,fd,0a,e4,86,..
"a0"=hex:20,01,00,00,5d,7d,7e,20,ba,3f,d1,8b,65,27,26,5b,4a,1a,d6,2e,a0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:4f,33,bf,93,98,86,c9,a6,c9,00,64,09,fb,94,63,fe,0f,07,c9,96,38,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:8f,29,da,b3,f0,92,dd,f1,51,e3,ea,4b,92,5e,d5,09,f2,8e,bb,a4,fb,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1c,b5,ed,64,a6,74,a0,20,5f,c9,2f,68,90,93,3b,e4,b1,29,fd,9b,d5,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{771A15FE-33E0-4F5C-80C1-505A10DD4433}]
"LeaseObtainedTime"=dword:4833173b
"T1"=dword:48331759
"T2"=dword:4833176f
"LeaseTerminatesTime"=dword:48331777
"DhcpRetryTime"=dword:0000001e
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{771A15FE-33E0-4F5C-80C1-505A10DD4433}\Parameters\Tcpip]
"LeaseObtainedTime"=dword:4833173b
"T1"=dword:48331759
"T2"=dword:4833176f
"LeaseTerminatesTime"=dword:48331777
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="D:\UTILITAIRES\Daemon Tools\Daemon Tools Pro\"
"h0"=dword:00000001
"hdf12"=hex:b0,88,3f,0d,f7,66,6f,b8,fd,45,71,3d,c2,5b,7f,93,d5,4f,5d,ba,2d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,30,c1,35,23,1b,68,c7,06,e8,df,d8,dc,a4,86,4b,1d,a6,..
"hdf12"=hex:96,da,c0,d9,e5,1c,5c,d0,38,74,64,50,9c,e3,58,07,70,ca,5f,40,49,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:ba,b9,5e,c2,ac,f1,04,86,dd,72,4c,c0,ff,a0,6b,ee,a9,22,d6,c6,e6,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"hdf12"=hex:6f,df,b8,01,d1,9d,32,33,4d,96,eb,4b,08,77,61,93,17,fd,0a,e4,86,..
"a0"=hex:20,01,00,00,5d,7d,7e,20,ba,3f,d1,8b,65,27,26,5b,4a,1a,d6,2e,a0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:4f,33,bf,93,98,86,c9,a6,c9,00,64,09,fb,94,63,fe,0f,07,c9,96,38,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:8f,29,da,b3,f0,92,dd,f1,51,e3,ea,4b,92,5e,d5,09,f2,8e,bb,a4,fb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:1c,b5,ed,64,a6,74,a0,20,5f,c9,2f,68,90,93,3b,e4,b1,29,fd,9b,d5,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0



Merci encore si vous pouvez m'aider.

Configuration: Windows XP
Internet Explorer 7.0