Virus downloader analyse Hijackthis

[Apoutsiak]

up

[Lien Rag]

 

Bonne année .

 

Point sur la situation stp

[Apoutsiak]

 

Bonne année .

 

Point sur la situation stp

 

 

 

enfin, mon sauveur

 

je t'ai mis un rapport antivirus en bas de la page 2

[Lien Rag]

Bonsoir

 

Pour finir fais ce scan en ligne stp

 

scan panda en ligne

 

préalablement , desactive antivirus actuel

[Apoutsiak]

J'ai refais un scan Avira

 

je le désinstalle et je fais un scan panda !

 

le rapport avira :

 

 

Premium Security Suite

Report file date: vendredi 11 janvier 2008 13:28

 

Scanning for 835736 virus strains and unwanted programs.

 

Licensed to: Demo Version

Serial number:

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: NOM-EB85C523610

 

Version information:

BUILD.DAT : 168 23343 Bytes 19/09/2007 13:52:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15

ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55

ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04

ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13

AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.32 2875432 Bytes 16/08/2007 13:13:12

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 13:23:26

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\avira premium security suite\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: vendredi 11 janvier 2008 13:29

 

The scan of running processes will be started

Scan process 'setup.exe' - '1' Module(s) have been scanned

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'prem_sec_winnt_en_hp(5).exe' - '1' Module(s) have been scanned

Scan process 'hphipm11.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'spfprc.exe' - '1' Module(s) have been scanned

Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned

Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'sfus.exe' - '1' Module(s) have been scanned

Scan process 'swdsvc.exe' - '1' Module(s) have been scanned

Scan process 'svcntaux.exe' - '1' Module(s) have been scanned

Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned

Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '0' Module(s) have been scanned

Scan process 'avesvc.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned

Scan process 'dslmon.exe' - '1' Module(s) have been scanned

Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'SFAgent.exe' - '1' Module(s) have been scanned

Scan process 'spftray.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'SDTrayApp.exe' - '1' Module(s) have been scanned

Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned

Scan process 'hphmon04.exe' - '1' Module(s) have been scanned

Scan process 'hpztsb05.exe' - '1' Module(s) have been scanned

Scan process 'vsnpstd.exe' - '1' Module(s) have been scanned

Scan process 'ALCWZRD.EXE' - '1' Module(s) have been scanned

Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned

Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned

Scan process 'KBD.exe' - '1' Module(s) have been scanned

Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

57 processes with 57 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '41' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <PRESARIO>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Compaq_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\ji1et0cs.default\Cache\F72E2089d01

[0] Archive type: CAB (Microsoft)

--> pskavs.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Bumble

[iNFO] The file was moved to '47b983ee.qua'!

C:\Program Files\Panda Security\TotalScan\pskavs.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[WARNING] An error has occurred and the file was not deleted. ErrorID: 16003

[WARNING] The file could not be deleted!

 

 

End of the scan: vendredi 11 janvier 2008 19:13

Used time: 5:45:06 min

 

The scan has been done completely.

 

8803 Scanning directories

436251 Files were scanned

2 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

436249 Files not concerned

8029 Archives were scanned

3 Warnings

0 Notes

[Apoutsiak]

J'ai fait un scan Panda, bizarement ça a diré seulement 3 minutes (au lieu d'une heure environ précisé sur le site) Je ne sais pas si ça a vraiment bien fonctionné.

 

Je mets quel antivirus ensuite pour protéger correctement mon PC ?

 

 

Le résultat est le suivant

 

Congratulations!

 

* No viruses, spyware, Trojans, or any other ACTIVE or LATENT threats have been detected on your PC.

 

* We have not detected any antivirus installed.

 

El texto que corresponda en cada momento

After completely scanning your PC, we have not detected any ACTIVE or LATENT malicious software.

[Lien Rag]

je ne suis pas bilingue mais mes notions d'anglais me permettent de comprendre que ton PC est parfaitement sain, et ce à le lecture du rapport Panda

[Apoutsiak]

je ne suis pas bilingue mais mes notions d'anglais me permettent de comprendre que ton PC est parfaitement sain, et ce à le lecture du rapport Panda

 

Mon inquietutde etait la suivante, le resultat m'est donnée en 5 secondes environ alors que le test est sensé durer 1 heure environ !

(je ne suis pas parfaitement bilingue non plus ;-S

[Apoutsiak]

J'installe quoi comme antivirus pour finir ? (en français si possible... )

[Apoutsiak]

je ne suis pas bilingue mais mes notions d'anglais me permettent de comprendre que ton PC est parfaitement sain, et ce à le lecture du rapport Panda

 

 

J'ai réinstallé AVira

 

il trouve encore des virus le vilain

 

est ce normal

 

que dois je faire pour les enlever

 

voici le rapport :

 

 

 

 

 

AntiVir PersonalEdition Classic

Report file date: lundi 14 janvier 2008 09:19

 

Scanning for 1029987 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: NOM-EB85C523610

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 07:28:52

ANTIVIR2.VDF : 7.0.1.205 620544 Bytes 08/01/2008 07:28:52

ANTIVIR3.VDF : 7.0.1.229 187904 Bytes 14/01/2008 07:28:52

AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 14/01/2008 07:28:53

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.2 360488 Bytes 14/01/2008 07:28:53

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: lundi 14 janvier 2008 09:19

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned

Scan process 'dslmon.exe' - '1' Module(s) have been scanned

Scan process 'msmsgs.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'SFAgent.exe' - '1' Module(s) have been scanned

Scan process 'spfprc.exe' - '1' Module(s) have been scanned

Scan process 'spftray.exe' - '1' Module(s) have been scanned

Scan process 'avgas.exe' - '1' Module(s) have been scanned

Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned

Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned

Scan process 'hphmon04.exe' - '1' Module(s) have been scanned

Scan process 'hpztsb05.exe' - '1' Module(s) have been scanned

Scan process 'vsnpstd.exe' - '1' Module(s) have been scanned

Scan process 'ALCWZRD.EXE' - '1' Module(s) have been scanned

Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned

Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned

Scan process 'KBD.exe' - '1' Module(s) have been scanned

Scan process 'AGRSMMSG.exe' - '1' Module(s) have been scanned

Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'MsPMSPSv.exe' - '1' Module(s) have been scanned

Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'sfus.exe' - '1' Module(s) have been scanned

Scan process 'SDTrayApp.exe' - '1' Module(s) have been scanned

Scan process 'swdsvc.exe' - '1' Module(s) have been scanned

Scan process 'svcntaux.exe' - '1' Module(s) have been scanned

Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned

Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned

Scan process 'guard.exe' - '0' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

52 processes with 52 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '41' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <PRESARIO>

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Compaq_Propriétaire\Bureau\internet\SmitfraudFix.exe

[DETECTION] Contains detection pattern of the dropper DR/BHO.agh.1

[iNFO] The file was moved to '47f41e7a.qua'!

C:\Documents and Settings\Compaq_Propriétaire\Bureau\internet\SmitfraudFix\IEDFix.exe

[DETECTION] Is the Trojan horse TR/BHO.agh

[iNFO] The file was moved to '47cf1e7f.qua'!

C:\Documents and Settings\Compaq_Propriétaire\Bureau\SDFix\backups\backups.zip

[0] Archive type: ZIP

--> backups/binret.exe

[DETECTION] Is the Trojan horse TR/Dldr.Zlob.Gen

[iNFO] The file was moved to '47ee213f.qua'!

C:\Documents and Settings\Compaq_Propriétaire\Bureau\SmitfraudFix\IEDFix.exe

[DETECTION] Is the Trojan horse TR/BHO.agh

[iNFO] The file was moved to '47cf2126.qua'!

C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] The file was moved to '47f92b70.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP1\A0001048.exe

[DETECTION] Is the Trojan horse TR/Dldr.Zlob.Gen

[iNFO] The file was moved to '47bb2c5d.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP1\A0001056.exe

[DETECTION] Is the Trojan horse TR/Dldr.Zlob.Gen

[iNFO] The file was moved to '47bb2c5f.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP23\A0003713.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[iNFO] The file was moved to '47bb2c94.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP27\A0003794.exe

[DETECTION] Contains detection pattern of the dropper DR/BHO.agh.1

[iNFO] The file was moved to '47bb2c9b.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP27\A0003795.exe

[DETECTION] Is the Trojan horse TR/BHO.agh

[iNFO] The file was moved to '47bb2c9d.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP27\A0003798.exe

[DETECTION] Is the Trojan horse TR/BHO.agh

[iNFO] The file was moved to '47bb2c9f.qua'!

C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP27\A0003799.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] The file was moved to '47bb2ca1.qua'!

C:\WINDOWS\system32\IEDFix.exe

[DETECTION] Is the Trojan horse TR/BHO.agh

[iNFO] The file was moved to '47cf2f1c.qua'!

C:\_OTMoveIt\MovedFiles\WINDOWS\leosrv.dll

[DETECTION] Is the Trojan horse TR/Zlob.DCC

[iNFO] The file was moved to '47fa2faa.qua'!

Begin scan in 'D:\' <PRESARIO_RP>

 

 

End of the scan: lundi 14 janvier 2008 10:53

Used time: 1:33:56 min

 

The scan has been done completely.

 

9328 Scanning directories

492830 Files were scanned

14 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

14 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

492816 Files not concerned

14131 Archives were scanned

2 Warnings

0 Notes