rapport HiJackThis + combofix

adrien84 · le 21 mai 2008

ok alors je pense que je posterai un rapport demain alors et vais te libérer de ta gentillesse alors !!

merci pour tout

Falkra · le 21 mai 2008

Ca ne marche qu'avec ComboFix, comme c'est un outil dangereux (si mal utilisé), on automatise aussi la désinstallation.

Impec.

Logiquement, si antivir s'est installé, et bien, tu es tranquille côté Bagle, il ne doit plus être là.

Le scan, c'est pour vérification en cas de résidus, mais il faut le faire.

adrien84 · le 21 mai 2008

ok ! et j'ai le droit a une periode d'essai de 30 j c'est ca?

Falkra · le 21 mai 2008

Non non, c'est Antivir Personal Editin Classic, il est gratuit, mais affiche une popup de pub (facile à fermer) quand on fait une mise à jour.

Pas de limitation dans le temps.

adrien84 · le 22 mai 2008

voila comme promis le rapport d'antivir !!

merci

Avira AntiVir Personal

Report file date: jeudi 22 mai 2008 00:27

Scanning for 1282124 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: DERAY-8CPPGNA1A

Version information:

BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00

AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:56

AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:37

LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:23

LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:40

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58

ANTIVIR2.VDF : 7.0.4.53 1848832 Bytes 17/05/2008 22:19:45

ANTIVIR3.VDF : 7.0.4.76 102400 Bytes 21/05/2008 22:19:46

Engineversion : 8.1.0.46

AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21

AESCRIPT.DLL : 8.1.0.33 266618 Bytes 21/05/2008 22:19:58

AESCN.DLL : 8.1.0.18 119156 Bytes 21/05/2008 22:19:57

AERDL.DLL : 8.1.0.20 418165 Bytes 21/05/2008 22:19:56

AEPACK.DLL : 8.1.1.5 364918 Bytes 21/05/2008 22:19:55

AEOFFICE.DLL : 8.1.0.18 192890 Bytes 21/05/2008 22:19:53

AEHEUR.DLL : 8.1.0.29 1253750 Bytes 21/05/2008 22:19:52

AEHELP.DLL : 8.1.0.14 115063 Bytes 21/05/2008 22:19:49

AEGEN.DLL : 8.1.0.21 303477 Bytes 21/05/2008 22:19:49

AEEMU.DLL : 8.1.0.6 430451 Bytes 21/05/2008 22:19:48

AECORE.DLL : 8.1.0.29 168311 Bytes 21/05/2008 22:19:47

AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:53

AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:50

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:47

AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:49

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:31

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:39

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:25

RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:11

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, E:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: jeudi 22 mai 2008 00:27

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'usnsvc.exe' - '1' Module(s) have been scanned

Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned

Scan process 'iexplore.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'TICIcon.exe' - '1' Module(s) have been scanned

Scan process 'hgcctl95.exe' - '1' Module(s) have been scanned

Scan process 'soffice.exe' - '1' Module(s) have been scanned

Scan process 'oonotesv65.exe' - '1' Module(s) have been scanned

Scan process 'IconMgr.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'OoPDFSettingsv6.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'InCD.exe' - '1' Module(s) have been scanned

Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned

Scan process '9wifi.exe' - '1' Module(s) have been scanned

Scan process 'winampa.exe' - '1' Module(s) have been scanned

Scan process 'smax4pnp.exe' - '1' Module(s) have been scanned

Scan process 'VTTrayp.exe' - '1' Module(s) have been scanned

Scan process 'VTTimer.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'UAService7.exe' - '1' Module(s) have been scanned

Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

43 processes with 43 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '41' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\deray\Mes documents\OFFICE One Zip\QooBox\Quarantine\catchme2008-05-17_ 02202.26.zip

[0] Archive type: ZIP

--> wintems.exe

[DETECTION] Is the Trojan horse TR/Bagle.Gen.B

--> mdelk.exe

[DETECTION] Is the Trojan horse TR/Bagle.Gen.B

--> hldrrr.exe

[DETECTION] Is the Trojan horse TR/Dldr.Bagle.NZ

--> mdelk.exe.1

[DETECTION] Is the Trojan horse TR/Dldr.Bagle.NZ

[NOTE] The file was moved to '48a90aa7.qua'!

C:\Documents and Settings\deray\Mes documents\OFFICE One Zip\QooBox\Quarantine\C\Documents and Settings\deray\Application Data\m\shared\101_Famous_Knock_Knock_Jokes_Screesaver_2.2_Key.zip.vir

[0] Archive type: ZIP

--> 101_Famous_Knock_Knock_Jokes_Screesaver_2.2_Key.exe