Drop.Delf.czz [RESOLU]

plm26 · le 27 décembre 2007

Tout à l'air OK. Juste un petit probleme de demarrage. Il m'arrive souvent d'avoir un message d'erreur d'execution de SBCSSvc.exe.

Cela correspond à CounterSpy. Si je continue sans redémarrer, j'obtiens des erreurs de Scan Service.

Merci pour ton aide.

Thanos · le 27 décembre 2007

salut

Poste moi le rapport stp, pour voir si les fichiers ont bien eté éliminés.

Désactive puis réactive la restauration système comme ceci car il y a pas mal de points infectés! => aide visuelle

Clique sur Démarrer.
Clique avec le bouton droit sur l'icône Poste de travail, puis cliquez sur Propriétés.

Clique sur l'onglet «Restauration du système».

Sélectionne «Désactiver la Restauration du système» ou «Désactiver la Restauration du système sur tous les lecteurs»

Clique sur "Appliquer".

Comme le dit le message, ceci supprimera tous les points de restauration existants. Pour faire cela, clique sur Oui.

Clique sur OK.Redémarre ton PC. Fais l'opération inverse, et réactive la restauration:un nouveau point sera automatiquement créé.

Après ca, on va utiliser OtmoveIt une dernière fois pour éliminer les outils de désinfection (inutiles car plus à jour, et ils risquent de faire réagir ton antivirus!)

Modifié le 27 décembre 2007 par charles ingals

plm26 · le 28 décembre 2007

Salut,

J'ai 2 rapports (mode sans echec et mode normal). Les voici :

AntiVir PersonalEdition Classic

Report file date: vendredi 28 décembre 2007 09:00

Scanning for 993955 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: Philippe

Computer name: PORTABLE-ASUS

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:30

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:52

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:48

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:22

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 07:47:00

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 07:47:00

ANTIVIR2.VDF : 7.0.1.157 286720 Bytes 26/12/2007 07:47:00

ANTIVIR3.VDF : 7.0.1.165 20992 Bytes 28/12/2007 07:47:00

AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 28/12/2007 07:47:00

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:18

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.2 360488 Bytes 28/12/2007 07:47:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:08

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:34

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:20

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:14

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:38

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:22

Configuration settings for the scan:

Jobname..........................: Manual Selection

Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: vendredi 28 décembre 2007 09:00

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'TSVNCache.exe' - '1' Module(s) have been scanned

Scan process 'Explorer.EXE' - '1' Module(s) have been scanned

Scan process 'SBCSSvc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

13 processes with 13 modules were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( '47' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

C:\Program Files\Panda Security\TotalScan\pskavs.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[iNFO] The file was moved to '47dfc280.qua'!

C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] The file was moved to '47e2c2e4.qua'!

C:\System Volume Information\_restore{5E11CCDA-BFB6-4D47-BA35-61D7CE3448BC}\RP26\A0003622.dll

[DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738

[iNFO] The file was moved to '47a4c3e8.qua'!

C:\System Volume Information\_restore{5E11CCDA-BFB6-4D47-BA35-61D7CE3448BC}\RP26\A0003623.dll

[DETECTION] Is the Trojan horse TR/Agent.bux.1

[iNFO] The file was moved to '4623f901.qua'!

Begin scan in 'D:\'

End of the scan: vendredi 28 décembre 2007 13:18

Used time: 4:17:39 min

The scan has been done completely.

44856 Scanning directories

1310895 Files were scanned

4 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

4 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

1310891 Files not concerned

13203 Archives were scanned

2 Warnings

11 Notes

AntiVir PersonalEdition Classic

Report file date: vendredi 28 décembre 2007 13:29

Scanning for 993955 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: PORTABLE-ASUS

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:30

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:52

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:48

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:22

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 07:47:00

ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 07:47:00

ANTIVIR2.VDF : 7.0.1.157 286720 Bytes 26/12/2007 07:47:00

ANTIVIR3.VDF : 7.0.1.165 20992 Bytes 28/12/2007 07:47:00

AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 28/12/2007 07:47:00

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:18

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.2 360488 Bytes 28/12/2007 07:47:00

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:08

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:34

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:20

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:14

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:38

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:22

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: vendredi 28 décembre 2007 13:29

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'CAP2SWK.EXE' - '1' Module(s) have been scanned

Scan process 'CAP2RSK.EXE' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned

Scan process 'KPF4GUI.EXE' - '1' Module(s) have been scanned

Scan process 'ALG.EXE' - '1' Module(s) have been scanned

Scan process 'wwSecure.exe' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'KPF4SS.EXE' - '1' Module(s) have been scanned

Scan process 'SBCSSvc.exe' - '1' Module(s) have been scanned

Scan process 'RegSrvc.exe' - '1' Module(s) have been scanned

Scan process 'NOD32KRN.EXE' - '1' Module(s) have been scanned

Scan process 'MDM.EXE' - '1' Module(s) have been scanned

Scan process 'EvtEng.exe' - '1' Module(s) have been scanned

Scan process 'CachemanXP.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'LOGONUI.EXE' - '1' Module(s) have been scanned

Scan process 'S24EvMon.exe' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned

Scan process 'LSASS.EXE' - '1' Module(s) have been scanned

Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned

Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned

Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned

Scan process 'SMSS.EXE' - '1' Module(s) have been scanned

33 processes with 33 modules were scanned

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

Starting to scan the registry.

The registry was scanned ( '38' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\'

D:\System Volume Information\_restore{5E11CCDA-BFB6-4D47-BA35-61D7CE3448BC}\RP3\A0000518.exe

[DETECTION] Contains detection pattern of the dropper DR/FraudTool.WinZix.A.22

[iNFO] The file was moved to '47a52500.qua'!

D:\System Volume Information\_restore{5E11CCDA-BFB6-4D47-BA35-61D7CE3448BC}\RP3\A0000519.dll

[DETECTION] Is the Trojan horse TR/Drop.Delf.czz

[iNFO] The file was moved to '46256c39.qua'!

End of the scan: vendredi 28 décembre 2007 18:00

Used time: 4:31:20 min

The scan has been canceled!

44612 Scanning directories

1199291 Files were scanned

2 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

2 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

1199289 Files not concerned

11478 Archives were scanned

2 Warnings

5 Notes

Thanos · le 28 décembre 2007

salut

Ok voilà l'alerte concernant TR/Drop.Delf.czz >

D:\System Volume Information\_restore{5E11CCDA-BFB6-4D47-BA35-61D7CE3448BC}\RP3\A0000519.dll
[DETECTION] Is the Trojan horse TR/Drop.Delf.czz

[iNFO] The file was moved to '46256c39.qua'!

Il s'agit d'un point de restauration infecté qu'Antivir a mis en quarantaine.

Est ce que tu as bien désactivé puis réactivé la restauration système comme je te disait ?

Peux tu poster le rapport de OtMoveIt ? >

dans C:\_OTMoveIt\MovedFiles\ > Le nom du rapport est la date de sa création.

Modifié le 28 décembre 2007 par charles ingals

plm26 · le 28 décembre 2007

Désolé, je n'avais pas vu qu'un outil avait réactivé la restauration.

Si tu veux le dernier rapport de OTMoveIt, le voici :

D:\telecharge\outils\HideToolz.zip moved successfully.

D:\telecharge\outils\Power.Video.Converter.v1.5.18.WinALL.Keygen.Only-BRD.rar moved successfully.

D:\telecharge\outils\antivundo\VirtumundoBeGone.exe moved successfully.

D:\telecharge\outils\nero\Extract\Toolbar.exe moved successfully.

D:\telecharge\outils\lopremover.zip moved successfully.

C:\WINDOWS\Tasks\B519BA2991AE2C31.job moved successfully.

C:\WINDOWS\system32\ybadd.ini2 moved successfully.

C:\WINDOWS\system32\ybadd.bak2 moved successfully.

C:\Documents and Settings\Philippe\file1.zip moved successfully.

LoadLibrary failed for C:\WINDOWS\system32\EA540F0556.dll

C:\WINDOWS\system32\EA540F0556.dll NOT unregistered.

C:\WINDOWS\system32\EA540F0556.dll moved successfully.

C:\WINDOWS\msdownld.tmp moved successfully.

File/Folder not found.

Created on 12/27/2007 09:47:03

Modifié le 28 décembre 2007 par plm26

Thanos · le 29 décembre 2007

salut

Il m'arrive souvent d'avoir un message d'erreur d'execution de SBCSSvc.exe.

Si l'erreur persiste il faudra peut être réinstaller CounterSpy.

Ok à présent afin d'éliminer les programmes téléchargés, fais ceci >

Elimine ComboFix.exe qui se trouve dans D:\telecharge\outils\antivundo et OtMoveIt.exe

Elimine aussi le dossier > C:\Qoobox et C:\_OTMoveIt

Désolé, je n'avais pas vu qu'un outil avait réactivé la restauration.

Non aucun outil n'a réactivé la restauration : je voulais juste savoir si tu avais bien, comme je te l'ai indiqué ci-dessus, désactivé puis réactivé la restauration afin de purger les points infectés ? Si ce n'est pas fait, fais le!

Reçois tu encore des alertes ?

plm26 · le 29 décembre 2007

C'est bon, aprés reinstallation de COunterSPy je n'ai plus d'alertes. Merci pour le boulot.

Connexion

Pas encore inscrit ?

Drop.Delf.czz [RESOLU]

Messages recommandés

plm26

Thanos

plm26

Thanos

plm26

Thanos

plm26

Rejoindre la conversation

En ligne récemment 0 membre est en ligne

Zebulon

Outils en ligne

Naviguer