virus alert

[Thanos]

salut

 

J'ai besoin d'un peu de temps pour interpréter les résultats des deux dernier rapports vieuxrusé.

Qu'en est il des alertes de Windows concernant les fichiers système? reçois tu encore des messages ? (Protection des fichiers windows)

[vieuxrusé]

Salut Thanos ces messages je les reçois à chaque démarrage mais si je ferme les fenêtres elles disparaissent.

C'est ch.... mais bon

Bonne AM.

[vieuxrusé]

J'ai mis en route ce matin antivir voilà le rapport je ne sais pas si ça te sera utile. Bon courage.

 

 

 

Avira AntiVir Personal

Report file date: dimanche 19 octobre 2008 09:58

 

Scanning for 1692263 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: XPSP2-0181848AE

 

Version information:

BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00

AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53

AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34

ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15

ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 18:57:45

ANTIVIR3.VDF : 7.0.7.58 315904 Bytes 17/10/2008 18:57:50

Engineversion : 8.2.0.5

AEVDF.DLL : 8.1.0.6 102772 Bytes 18/10/2008 18:58:59

AESCRIPT.DLL : 8.1.1.9 319867 Bytes 18/10/2008 18:58:57

AESCN.DLL : 8.1.1.3 123252 Bytes 18/10/2008 18:58:55

AERDL.DLL : 8.1.1.2 438644 Bytes 18/10/2008 18:58:44

AEPACK.DLL : 8.1.2.4 369014 Bytes 18/10/2008 18:58:42

AEOFFICE.DLL : 8.1.0.28 196987 Bytes 18/10/2008 18:58:40

AEHEUR.DLL : 8.1.0.59 1438071 Bytes 18/10/2008 18:58:38

AEHELP.DLL : 8.1.1.2 115062 Bytes 18/10/2008 18:58:32

AEGEN.DLL : 8.1.0.41 319861 Bytes 18/10/2008 18:58:31

AEEMU.DLL : 8.1.0.9 393588 Bytes 18/10/2008 18:58:29

AECORE.DLL : 8.1.2.6 172406 Bytes 18/10/2008 18:58:04

AEBB.DLL : 8.1.0.3 53618 Bytes 18/10/2008 18:57:52

AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 18/10/2008 18:57:51

AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: e:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: dimanche 19 octobre 2008 09:58

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'nbpro.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'robotaskbaricon.exe' - '1' Module(s) have been scanned

Scan process 'fwsrv.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'spamihilator.exe' - '1' Module(s) have been scanned

Scan process 'hpztsb07.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'oodag.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'NMSAccessU.exe' - '1' Module(s) have been scanned

Scan process 'NBService.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'a2service.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

33 processes with 33 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '51' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <Nouveau nom>

C:\System Volume Information\_restore{FC376516-F458-462F-A7DC-B438450729A3}\RP13\A0004927.exe

[DETECTION] Is the TR/Fake.RapidAV.2 Trojan

[NOTE] The file was moved to '492b0ef1.qua'!

Begin scan in 'E:\'

E:\pagefile.sys

[WARNING] The file could not be opened!

E:\Qoobox\Quarantine\C\x.vir

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49711b84.qua'!

E:\Qoobox\Quarantine\C\WINDOWS\system32\YUR4.exe.vir

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

E:\Qoobox\Quarantine\C\WINDOWS\system32\YUR5.exe.vir

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was deleted!

E:\Qoobox\Quarantine\E\Documents and Settings\All Users\Application Data\jwbwtsfi\tgpgjqrm.exe.vir

[DETECTION] Is the TR/Dldr.Obfuscated.dvc Trojan

[NOTE] The file was deleted!

E:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

 

 

End of the scan: dimanche 19 octobre 2008 14:12

Used time: 4:13:59 Hour(s)

 

The scan has been done completely.

 

8693 Scanning directories

363329 Files were scanned

5 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

3 files were deleted

0 files were repaired

2 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

363322 Files not concerned

3823 Archives were scanned

2 Warnings

5 Notes

[Thanos]

salut

 

Pour ce qui est du lancement automatique de la vérification des fichiers système à chaque redémarrage, j'ai l'impression que tu as utilisé la commande sfc /scanboot! est ce le cas?

On va rétablir ca en modifiant un paramètre dans la base de registre >>

 

Rend toi sur cette page afin de télécharger le fichier winlogon.reg sur ton Bureau => http://www.sendspace.com/file/jjsrwq

pour cela, clique sur le lien en bas de page > Download Link: winlogon.reg

Double-clique sur le fichier: au message qui s'affiche, clique sur OK pour faire fusionner le fichier avec le registre.

Elimine le fichier une fois l'opération effectuée.

 

Au prochain redémarrage, tu ne dois plus avoir de vérification.

 

Le rapport du scan Antivir ne montre rien de mauvais je te rassure: les détections concernent des fichiers confinés dans la quarantaine de ComboFix donc sans danger

[vieuxrusé]

:P Bien joué Thanos plus rien à signaler Encore merci.Il ne me reste plus qu'à m'habituer à jetico.

 

Félicitation à toute l'équipe tout de même.

 

Vieuxrusé

[Thanos]

De rien vieuxrusé Pour terminer il y a juste un élément qui me chifonne dans ton rapport Gmer (peut être rien) et pour lequel j'ai besoin d'infos. Je te poste ca dès que possible avec quelques conseils de sécurisation (Jetico est un bon choix au passage!)