Inscrivez-vous gratuitement
pour pouvoir participer, suivre les réponses en temps réel, voter pour les messages, poser vos propres questions et recevoir la newsletter
Avast n'est pas une application win32 valide
Horreur, en voulant vérifier qu'Avast ne bloquait pas une installation VS2008, j'ai eu la désagréable surprise de voir Avast éteint () et de recevoir au lancement :
avast n'est pas une aplicaiton windows 32 valide
Il s'agit probablement d'un maleware, mais comment le virer puisque je ne peux plus lancer Avast (j'ai essayé plusieurs réinstallation prorpres, sans succés)
Merci
c'est peut-etre une infection Bagle.
On va le vérifier.
Tu vas télécharger Elibagla ( en bas de la page Descargar Elibagla )
http://www.zonavirus.com/datos/desca...5/elibagla.asp
Tu vas essayer de redemarrer en mode sans echec et lancer Elibagla.
Si tu n'y arrives pas, n'insiste pas. Et dans tous les cas, n'essaie pas de le forcer en passanr par Msconfig.
Dans ce cas, tu lanceras le logciel à partir de XP.
Peux-tu poster le rapport ?
Avant de poster sur le forum , faites une recherche
Ca a l'air, j'ai déjà télécharger Elibagla, qui a refusé de se lancer en mentionnant Bagle justementc'est peut-etre une infection Bagle.
On va le vérifier.
Tu vas télécharger Elibagla
J'essaye en mod sans échec
écran bleu au passage mode sans échec (je suis en virtualisation VMWare)
Souvent, le bagle neutralise Elibagla.
Tu le renommes en machin.exe pour tromper le virus.
Si tu arrives à passer l'outil mais sans résultat ( access denegado ), reessair plusieurs fois. Ca marche parfois.
Sinon, on passe à un autre outil.
Avant de poster sur le forum , faites une recherche
ttone a dit :
C'est ta machine virtuelle qui est infectée ?je suis en virtualisation VMWare
Avant de poster sur le forum , faites une recherche
Merci beaucoup,
non
Code : Sélectionner tout - Visualiser dans une fenêtre à part C'est ta machine virtuelle qui est infectée ?
c'est vraiment étrange, tous les antivirus et consors sont in-lancable.
J'ai pensé au "renommer", ... mais bon
Voici mon rapport :
detectado Gusano Bagle-->écran bleuWed Jun 25 23:01:41 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle
Wed Jun 25 23:02:22 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.
Wed Jun 25 23:48:33 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.
Wed Jun 25 23:53:32 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Reinicie para Completar la Limpieza.
Wed Jun 25 23:54:06 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Reinicie para Completar la Limpieza.
Wed Jun 25 23:54:12 2008
EliBagle v11.52 (c)2008 S.G.H. / Satinfo S.L. (Actualizado el 25 de Junio del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DEVELOPER\APPLICATION DATA\M\FLEC006.EXE --> Bagle.dldr Acceso Denegado.
Reinicie para Completar la Limpieza.
je reboote et j'essaie en renommant :
rapport :
Bon, a priori tu ne l'auras pas avec Elibagla.
On va passer à l'artillerie lourde. A manipuler avec précaution.
Tu vas télécharger ComBoFix.
On va le passer une première fois pour rechercher les infections.
Lance Combofix.exe et suis les invites.
Une fois le scan fini, un rapport va apparaitre.
Copie/colle ce rapport dans ta prochaine réponse.
Si tu ne le trouves pas, il est à C:\ComboFix.txt
Avant de poster sur le forum , faites une recherche
ComboFix n'est pas une application win32 valideMachin n'est pas une application win32 valide
Ils sont malins ces maleware, il faut renommer avant l'écriture disque (sur mac pour moi) :
--> écran bleu
-->
renomme le en combo-fix.exe.
Avant de poster sur le forum , faites une recherche
hello, alors bon WE du 14/07?
des nouvelles :
rapport Elibagla :
Code : Sélectionner tout - Visualiser dans une fenêtre à part
2
3
4
5
6
7
8
9
10
11
rapport ComboFix :
ComboFix 08-06-20.4 - developer 2008-06-29 19:47:52.1 - NTFSx86
Endroit: C:\Documents and Settings\developer\Bureau\1.exe
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\developer\Application Data\m
C:\Documents and Settings\henry\Application Data\m
C:\Documents and Settings\henry\Application Data\m\flec006.exe
C:\Documents and Settings\henry\Application Data\m\shared
C:\Documents and Settings\henry\Application Data\m\shared\1st_Screen_Lock_7.3_Key.zip
C:\Documents and Settings\henry\Application Data\m\shared\3D_Manatees_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\3D_Mona_Lisa_Dances_to_Bolero_1.0_[KeyGen].zip
C:\Documents and Settings\henry\Application Data\m\shared\70-528_Practice_Exam_Testing_Engine_Software_1.0_(KeyGen).zip
C:\Documents and Settings\henry\Application Data\m\shared\Aimersoft_MOV_Converter_1.0.20.zip
C:\Documents and Settings\henry\Application Data\m\shared\Alive!_Jigsaw_Producer_1.6_(Key+Serial).zip
C:\Documents and Settings\henry\Application Data\m\shared\Alvas.FileControls_3.0_(Key).zip
C:\Documents and Settings\henry\Application Data\m\shared\Alventis_1.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\AntiVirus_Tester_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\AnyMaxi_Text_Count_and_Invoicing_Software_4.zip
C:\Documents and Settings\henry\Application Data\m\shared\API_Monitor_1.1.1.70.zip
C:\Documents and Settings\henry\Application Data\m\shared\Aplus_DVD_to_Divx_Xvid_Ripper_4.38.zip
C:\Documents and Settings\henry\Application Data\m\shared\Audition_2000_4.3.zip
C:\Documents and Settings\henry\Application Data\m\shared\Avast.Pro.v4.7.869.German.Incl.Keymaker-CORE.zip
C:\Documents and Settings\henry\Application Data\m\shared\Basic_Electrical_Troubleshooting_2.50.zip
C:\Documents and Settings\henry\Application Data\m\shared\Battlefield_Vietnam_La_Tan_Village_map.zip
C:\Documents and Settings\henry\Application Data\m\shared\Blue_Theme_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\BlueHarvest_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Box_Editor_1.0_With_Crack.zip
C:\Documents and Settings\henry\Application Data\m\shared\Brainstorm_mp3_Catalog_0.5_alpha.zip
C:\Documents and Settings\henry\Application Data\m\shared\Calendar_Updates_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\CoderForm_3.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\CoffeeCup_Web_Video_Player_4.9.zip
C:\Documents and Settings\henry\Application Data\m\shared\Cool_Shutdown_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\CryptoHelp-bundle_6.08_(Crack).zip
C:\Documents and Settings\henry\Application Data\m\shared\CS_Emancipation_Calculator_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\CSUpload_Controls_Package_1.0_[Key+Serial].zip
C:\Documents and Settings\henry\Application Data\m\shared\Datatrieve_Online_Backup_System_1.3.zip
C:\Documents and Settings\henry\Application Data\m\shared\Deep_Thoughts_0.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\DirectParallel_Connection_Game_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Drag-N-Dropper_1.0_[With_Crack].zip
C:\Documents and Settings\henry\Application Data\m\shared\DVD_iPhone_Ripper_6.5.0.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\E-mail_Follow-Up_1.8_[With_Crack].zip
C:\Documents and Settings\henry\Application Data\m\shared\EasyMP3_2005_2.0.0.19.zip
C:\Documents and Settings\henry\Application Data\m\shared\Elite_Calculator_1.1_Build_1.1.0.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Elite_Utilities_9_Professional_9.2.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Elzed_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\EMMentor_Algebra_short_3.0_Crack.zip
C:\Documents and Settings\henry\Application Data\m\shared\Employee_Task_Chaser_1.3_(Patch).zip
C:\Documents and Settings\henry\Application Data\m\shared\Encryption_Workshop_3.2_Build_60220.zip
C:\Documents and Settings\henry\Application Data\m\shared\Eurora_Maker_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Ewido.Anti-Spyware.V.4.0.0.172C.-.Registration.zip
C:\Documents and Settings\henry\Application Data\m\shared\Exposure_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Filtrd_RSS_1.0.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\FLVDownload_1.0_(KeyGen).zip
C:\Documents and Settings\henry\Application Data\m\shared\Food_File_1.0.5.zip
C:\Documents and Settings\henry\Application Data\m\shared\Genie_Online_Backup_1.0_[Key+Serial].zip
C:\Documents and Settings\henry\Application Data\m\shared\Gmail_Notifier_Firefox_Add-on_0.6.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Half-Life_2_E3_2004_official_trailer.zip
C:\Documents and Settings\henry\Application Data\m\shared\Hit_The_Monkeys_fir_Pocket_PC_1.3.zip
C:\Documents and Settings\henry\Application Data\m\shared\HyperOs_OneClick_S4.54.zip
C:\Documents and Settings\henry\Application Data\m\shared\ICQ_Away_Message_Generator_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\ImTOO_PSP_Video_Converter_3.1.38.0802b_[With_Crack].zip
C:\Documents and Settings\henry\Application Data\m\shared\iPod_EBook_Maker_-_Funetica_2.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Lector_2.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Look_RS232_4.3_Patch.zip
C:\Documents and Settings\henry\Application Data\m\shared\Mass_Downloader_3.3.691_SR1_(Key).zip
C:\Documents and Settings\henry\Application Data\m\shared\Mileage_1.01.zip
C:\Documents and Settings\henry\Application Data\m\shared\Misty_and_Dancing_Balls_1.0_[Key].zip
C:\Documents and Settings\henry\Application Data\m\shared\MsgAgent_0.37b.zip
C:\Documents and Settings\henry\Application Data\m\shared\MSN_Spy_Monitor_2007_6.6.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\MyJSQLView_Beta_2.72.zip
C:\Documents and Settings\henry\Application Data\m\shared\Orbitz_Search_Widget_1.zip
C:\Documents and Settings\henry\Application Data\m\shared\ORF_Enterprise_Edition_2.0.1_With_Crack.zip
C:\Documents and Settings\henry\Application Data\m\shared\OrgPlus_Professional_7_(Cracked).zip
C:\Documents and Settings\henry\Application Data\m\shared\Oud_Tutor_1.4.zip
C:\Documents and Settings\henry\Application Data\m\shared\PageLock_Website_Copy_Protection_5.0.0.0_(With_Crack).zip
C:\Documents and Settings\henry\Application Data\m\shared\PCTV4Me_2.1.3.zip
C:\Documents and Settings\henry\Application Data\m\shared\PDF-Forms_2_(Key).zip
C:\Documents and Settings\henry\Application Data\m\shared\PgmText_2.00.zip
C:\Documents and Settings\henry\Application Data\m\shared\PhysConst_1.3.zip
C:\Documents and Settings\henry\Application Data\m\shared\Planimeter_II_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Polar_Knowledge_Base_3.0.2.0_[Key+Serial].zip
C:\Documents and Settings\henry\Application Data\m\shared\PractiCount_Toolbar_Professional_for_MS_Office_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Prevx1.52(2)buono.sicuro.zip
C:\Documents and Settings\henry\Application Data\m\shared\PrintJobs_5.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Program_Manager_XP_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\PSS_Update_Check_Control_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Pulsradio_Widget_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Query-A-Recordset_1.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\Quick_start_launcher_1.0c.zip
C:\Documents and Settings\henry\Application Data\m\shared\RankRobot_1.0.5_(With_Crack).zip
C:\Documents and Settings\henry\Application Data\m\shared\Realworth_3.5.zip
C:\Documents and Settings\henry\Application Data\m\shared\Rebecca's_Colouring_Book_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Resource_Builder_2.6.2.0_KeyGen.zip
C:\Documents and Settings\henry\Application Data\m\shared\RICOlmer_2.5.zip
C:\Documents and Settings\henry\Application Data\m\shared\Salvo_demo.zip
C:\Documents and Settings\henry\Application Data\m\shared\ScriptCleaner_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Secure_Folder_Hider_1.zip
C:\Documents and Settings\henry\Application Data\m\shared\SecureBlackbox_(.NET)_5.1_[Key+Serial].zip
C:\Documents and Settings\henry\Application Data\m\shared\Shockwave_Player_10.1.3.018.zip
C:\Documents and Settings\henry\Application Data\m\shared\Simple_Server_Monitor_2.0.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Smart_Pc_Keylogger_3.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\SmartFox_1.8.zip
C:\Documents and Settings\henry\Application Data\m\shared\Soft_Sea_Drop-Down_Menu_1.0_KeyGen.zip
C:\Documents and Settings\henry\Application Data\m\shared\Songbird_0.2.5_Developer_Preview.zip
C:\Documents and Settings\henry\Application Data\m\shared\SpellBound_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Spyware_Doctor_5.0.5.259.zip
C:\Documents and Settings\henry\Application Data\m\shared\StarSkin_2.5.2.5_[Key].zip
C:\Documents and Settings\henry\Application Data\m\shared\StrongDisk_Pro_3.6_build_508_[Cracked].zip
C:\Documents and Settings\henry\Application Data\m\shared\Sun_3D_Screensaver_1.1_(KeyGen).zip
C:\Documents and Settings\henry\Application Data\m\shared\System_Mechanic_7.1.10.7.zip
C:\Documents and Settings\henry\Application Data\m\shared\System_Spex_2007_1.0.0.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\Systemscripter_6.1.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\Taggin'_MP3_1.4.zip
C:\Documents and Settings\henry\Application Data\m\shared\Talking_Translator_Pro_1.7.zip
C:\Documents and Settings\henry\Application Data\m\shared\TessEm7000_1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\The_Art_of_Money_Getting_1.0_(Key).zip
C:\Documents and Settings\henry\Application Data\m\shared\The_Complete_Guide_to_Internet_Marketing_1.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\TheOne_Health_Checker_Pro_1.5.zip
C:\Documents and Settings\henry\Application Data\m\shared\TimeSync_2.3.0.zip
C:\Documents and Settings\henry\Application Data\m\shared\TrendCatch_AI_5.4.zip
C:\Documents and Settings\henry\Application Data\m\shared\TrustWatch_Search_for_Firefox_0.2.4.zip
C:\Documents and Settings\henry\Application Data\m\shared\TVPX_1031_Depreciation_Solution_3.0_[Serial].zip
C:\Documents and Settings\henry\Application Data\m\shared\Ultra-LightPrompter_1.3.2.44_[Patch].zip
C:\Documents and Settings\henry\Application Data\m\shared\URI_Crypter_3.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\Vevo!_CatalogMaker_1.2.zip
C:\Documents and Settings\henry\Application Data\m\shared\VisualStat_5.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\W8Soft_Ad-Spy_Remover_1.6_[Cracked].zip
C:\Documents and Settings\henry\Application Data\m\shared\Warcraft_III_-_Mathias_Chapter_19_map.zip
C:\Documents and Settings\henry\Application Data\m\shared\WinSettings_Pro_2.zip
C:\Documents and Settings\henry\Application Data\m\shared\WinSwitch_1.4.zip
C:\Documents and Settings\henry\Application Data\m\shared\WireTap_Pro_1.1.1.zip
C:\Documents and Settings\henry\Application Data\m\shared\wodAppUpdate_1.2.1.0_(Key).zip
C:\Documents and Settings\henry\Application Data\m\shared\Wondershare_Photo_Collage_Studio_1.4.5.zip
C:\Documents and Settings\henry\Application Data\m\shared\Xilisoft_DivX_to_DVD_Converter_3.0.26.0323_Patch.zip
C:\Documents and Settings\henry\Application Data\m\shared\Xml2PDF_3.0.18_[Patch].zip
C:\Documents and Settings\henry\Application Data\m\shared\ZipCodeNow_1.1_KeyGen.zip
C:\Documents and Settings\henry\Application Data\m\shared\ZooCubeZQ_1.zip
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\mdelk.exe
C:\WINDOWS\system32\lsprst7.dll
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\ssprs.dll
.
---- Previous Run -------
.
C:\WINDOWS\system32\drivers\downld
C:\WINDOWS\system32\drivers\downld\488312.exe
C:\WINDOWS\system32\drivers\downld\587843.exe
C:\WINDOWS\system32\drivers\downld\595656.exe
C:\WINDOWS\system32\drivers\downld\596875.exe
C:\WINDOWS\system32\drivers\downld\598906.exe
C:\WINDOWS\system32\drivers\downld\604250.exe
C:\WINDOWS\system32\drivers\downld\611265.exe
C:\WINDOWS\system32\drivers\downld\614546.exe
C:\WINDOWS\system32\drivers\downld\622218.exe
C:\WINDOWS\system32\drivers\downld\645343.exe
C:\WINDOWS\system32\drivers\downld\675453.exe
C:\WINDOWS\system32\drivers\downld\679531.exe
C:\WINDOWS\system32\drivers\downld\83515.exe
C:\WINDOWS\system32\drivers\downld\847296.exe
C:\WINDOWS\system32\drivers\downld\858828.exe
C:\WINDOWS\system32\drivers\downld\86015.exe
C:\WINDOWS\system32\drivers\downld\872484.exe
C:\WINDOWS\system32\drivers\downld\873656.exe
C:\WINDOWS\system32\drivers\downld\881484.exe
C:\WINDOWS\system32\drivers\downld\891812.exe
C:\WINDOWS\system32\drivers\downld\896843.exe
C:\WINDOWS\system32\drivers\downld\898750.exe
C:\WINDOWS\system32\drivers\downld\92562.exe
C:\WINDOWS\system32\drivers\downld\96609.exe
C:\WINDOWS\system32\drivers\downld\992562.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SROSA
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-28 to 2008-06-29 ))))))))))))))))))))))))))))))))))))
.
2008-06-29 19:59 . 2004-08-19 18:09 290,816 --a--c--- C:\WINDOWS\system32\dllcache\OLD12.tmp
2008-06-29 19:59 . 2004-08-19 17:56 281,600 --a--c--- C:\WINDOWS\system32\dllcache\OLD20.tmp
2008-06-29 19:59 . 2003-03-24 15:52 188,480 --a--c--- C:\WINDOWS\system32\dllcache\OLD24.tmp
2008-06-29 19:59 . 2002-09-06 21:59 96,768 --a--c--- C:\WINDOWS\system32\dllcache\OLD1D.tmp
2008-06-29 19:59 . 2004-08-19 17:58 77,824 --a--c--- C:\WINDOWS\system32\dllcache\OLD27.tmp
2008-06-29 19:59 . 2004-08-19 18:09 47,104 --a--c--- C:\WINDOWS\system32\dllcache\OLD2A.tmp
2008-06-29 19:59 . 2004-08-19 18:09 43,520 --a--c--- C:\WINDOWS\system32\dllcache\OLDF.tmp
2008-06-29 19:59 . 2003-03-24 15:52 20,540 --a--c--- C:\WINDOWS\system32\dllcache\OLD16.tmp
2008-06-29 19:59 . 2003-03-24 15:52 16,439 --a--c--- C:\WINDOWS\system32\dllcache\OLD1A.tmp
2008-06-29 19:58 . 2008-06-29 19:58 <REP> d-------- C:\WINDOWS\system32\drivers\downld
2008-06-29 19:58 . 2008-06-29 19:59 <REP> d-------- C:\WINDOWS\LastGood
2008-06-29 19:58 . 2003-03-24 15:52 20,540 --a--c--- C:\WINDOWS\system32\dllcache\OLD8.tmp
2008-06-29 19:58 . 2003-03-24 15:52 16,439 --a--c--- C:\WINDOWS\system32\dllcache\OLDC.tmp
2008-06-26 00:40 . 2008-06-29 19:46 <REP> d-------- C:\Muestras
2008-06-25 23:01 . 2008-06-25 23:01 <REP> d-------- C:\Program Files\Trend Micro
2008-06-25 22:44 . 2008-06-25 23:02 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-25 22:44 . 2008-06-25 22:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-25 21:51 . 2008-06-25 21:51 1,160 --a------ C:\WINDOWS\mozver.dat
2008-06-24 21:54 . 2008-06-24 23:06 <REP> d-------- C:\LibSndFile
2008-06-11 15:21 . 2008-06-11 15:21 <REP> d-------- C:\FMOD
2008-06-11 12:47 . 2008-06-05 05:02 339,968 --a------ C:\WINDOWS\system32\libfmodex.dll
2008-06-10 23:54 . 2008-06-23 00:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-10 23:54 . 2008-06-10 23:54 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-10 21:24 . 2008-06-10 21:24 <REP> d-------- C:\Documents and Settings\developer\Application Data\Apple Computer
2008-06-10 20:10 . 2008-06-05 05:02 339,968 --a------ C:\WINDOWS\system32\fmodex.dll
2008-06-10 20:10 . 2006-08-31 21:35 325,120 --a------ C:\WINDOWS\system32\libsndfile.dll
2008-06-10 13:49 . 2008-06-10 13:49 <REP> d-------- C:\Program Files\Inno Setup 5
2008-06-10 00:17 . 2008-06-25 22:34 <REP> d-------- C:\Documents and Settings\developer\Application Data\VMware
2008-06-09 23:56 . 2008-06-24 21:14 <REP> d-------- C:\Documents and Settings\developer\Application Data\Dev-Cpp
2008-06-09 23:55 . 2008-06-24 21:12 0 --a------ C:\WINDOWS\MSYS.INI
2008-06-09 23:38 . 2008-06-24 21:54 <REP> d-------- C:\Qt
2008-06-09 23:36 . 2008-06-09 23:36 <REP> d-------- C:\Program Files\MagicISO
2008-06-09 23:31 . 2008-06-11 14:46 <REP> d-------- C:\Program Files\FMOD
2008-06-09 23:22 . 2008-06-24 21:14 <REP> d-------- C:\Dev-Cpp
2008-06-09 23:18 . 2008-06-09 23:18 <REP> d-------- C:\Documents and Settings\developer\Application Data\VMNTOOLBAR
2008-06-09 23:15 . 2007-09-07 21:48 <REP> d--h----- C:\Documents and Settings\developer\Voisinage r‚seau
2008-06-09 23:15 . 2007-09-07 21:48 <REP> d--h----- C:\Documents and Settings\developer\Voisinage d'impression
2008-06-09 23:15 . 2007-09-07 19:57 <REP> d--h----- C:\Documents and Settings\developer\ModŠles
2008-06-09 23:15 . 2008-06-10 13:59 <REP> dr------- C:\Documents and Settings\developer\Mes documents
2008-06-09 23:15 . 2007-09-07 21:48 <REP> dr------- C:\Documents and Settings\developer\Menu D‚marrer
2008-06-09 23:15 . 2008-06-09 23:15 <REP> dr------- C:\Documents and Settings\developer\Favoris
2008-06-09 23:15 . 2008-06-29 19:42 <REP> d-------- C:\Documents and Settings\developer\Bureau
2008-06-09 23:15 . 2008-06-25 19:18 <REP> d-------- C:\Documents and Settings\developer
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 20:33 --------- d-----w C:\Documents and Settings\LocalService\Application Data\VMware
2008-06-25 13:29 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2008-06-23 20:39 --------- d-----w C:\Program Files\FriendBlasterPro
2008-06-22 22:10 --------- d-----w C:\Documents and Settings\henry\Application Data\VMware
2008-06-11 10:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-07 21:34 --------- d-----w C:\Documents and Settings\henry\Application Data\vmntoolbar
2008-05-29 17:26 --------- d-----w C:\Documents and Settings\henry\Application Data\dvdcss
2007-09-07 18:05 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-09-07 18:12 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
2007-09-07 18:12 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012007090720070908\index.dat
2007-09-07 18:05 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 18:09 15360]
"TransBar"="C:\WINDOWS\system32\TransBar.exe" [2006-09-15 20:47 69120]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-06-25 22:44 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-07-31 13:59 8433664]
"nwiz"="nwiz.exe" [2007-07-31 13:59 1626112 C:\WINDOWS\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl,,BluetoothAuthenticationAgent" []
"IRW"="C:\WINDOWS\system32\IRW.exe" [2007-07-31 13:57 147456]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-07-31 13:59 81920]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-31 13:59 16380416 C:\WINDOWS\RTHDCPL.exe]
"Apple_KbdMgr"="C:\Program Files\Boot Camp\KbdMgr.exe" [2007-07-31 14:04 398640]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"VMware Tools"="C:\Program Files\VMware\VMware Tools\VMwareTray.exe" [2007-10-14 23:39 96816]
"VMware User Process"="C:\Program Files\VMware\VMware Tools\VMwareUser.exe" [2007-10-14 23:39 367152]
"LVCOMSX"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe" [2007-03-06 17:51 252704]
"SSBkgdUpdate"="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 14:16 185896]
"OpwareSE4"="C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 13:45 75304]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-23 00:24 620152]
"Adobe_ID0EYTHM"="C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 17:40 1884160]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSimpleStartMenu"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 0 (0x0)
"MaxRecentDocs"= 15 (0xf)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll
"Midi1"= myokent.dll
"Midi2"= rddv1036.dll
"midi3"= evolusbn.dll
"midi4"= rddv1036.dll
"wave8"= rddv1035.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wd.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95e44ea2-7262-11dc-b579-001d4f86af88}]
\Shell\AutoRun\command - F:\nideiect.com
\Shell\explore\Command - F:\nideiect.com
\Shell\open\Command - F:\nideiect.com
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-04-17 15:33:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-29 19:59:06
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\VMware\VMware Tools\vmacthlp.exe
C:\WINDOWS\system32\AppleOSSMgr.exe
C:\WINDOWS\system32\AppleTimeSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\M-Audio Uno\UnoInst.exe
C:\Program Files\VMware\VMware Tools\VMwareService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-29 20:23:07 - machine was rebooted [developer]
ComboFix-quarantined-files.txt 2008-06-29 18:21:58
Pre-Run: 20,753,973,248 octets libres
Post-Run: 20,024,856,576 octets libres
331 --- E O F --- 2008-05-28 06:42:23
Bonjour, ttone
Le script en pièce jointe est à enregistrer sur le bureau et à glisser/déposer sur combofix.exe.
Salut
Avant de poster sur le forum , faites une recherche
Vous avez un bloqueur de publicités installé.
Le Club Developpez.com n'affiche que des publicités IT, discrètes et non intrusives.
Afin que nous puissions continuer à vous fournir gratuitement du contenu de qualité, merci de nous soutenir en désactivant votre bloqueur de publicités sur Developpez.com.
Répondre avec citation
Partager