Infection TR/Agent.69632.0

[Dart87]

Bonjour à tous

Antivir détecte TR/Agent.69632.0 ainsi que de nombreux "warning" sans pouvoir y remédier..

 

Voici le raport: (je vais envoyer également le raport hijackthis!)

 

 

 

Avira AntiVir Personal

Report file date: lundi 20 avril 2009 08:24

 

Scanning for 1356201 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: ROBERT

 

Version information:

BUILD.DAT : 8.2.0.347 16934 Bytes 16/03/2009 14:45:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 16/02/2009 07:47:14

AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 08:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 13:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 08:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 07:47:14

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 07:47:14

ANTIVIR2.VDF : 7.1.3.63 1588224 Bytes 16/04/2009 18:25:45

ANTIVIR3.VDF : 7.1.3.73 25088 Bytes 18/04/2009 09:55:53

Engineversion : 8.2.0.148

AEVDF.DLL : 8.1.1.0 106868 Bytes 16/02/2009 07:47:15

AESCRIPT.DLL : 8.1.1.75 373113 Bytes 15/04/2009 18:24:31

AESCN.DLL : 8.1.1.10 127348 Bytes 03/04/2009 21:35:18

AERDL.DLL : 8.1.1.3 438645 Bytes 16/02/2009 07:47:15

AEPACK.DLL : 8.1.3.14 397685 Bytes 18/04/2009 09:17:54

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 27/02/2009 10:42:41

AEHEUR.DLL : 8.1.0.119 1724791 Bytes 18/04/2009 09:17:53

AEHELP.DLL : 8.1.2.2 119158 Bytes 27/02/2009 10:42:41

AEGEN.DLL : 8.1.1.36 340341 Bytes 18/04/2009 09:17:52

AEEMU.DLL : 8.1.0.9 393588 Bytes 16/02/2009 07:47:15

AECORE.DLL : 8.1.6.9 176500 Bytes 15/04/2009 18:24:24

AEBB.DLL : 8.1.0.3 53618 Bytes 16/02/2009 07:47:15

AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 09:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 10:28:01

AVREP.DLL : 8.0.0.3 155905 Bytes 19/04/2009 09:55:53

AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 12:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 09:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 13:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 18:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 13:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 13:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 14:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 14:34:37

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:, E:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: lundi 20 avril 2009 08:24

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'bittorrent.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'StarWindService.exe' - '1' Module(s) have been scanned

Scan process 'PnkBstrB.exe' - '1' Module(s) have been scanned

Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'DVMExportService.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'RocketDock.exe' - '1' Module(s) have been scanned

Scan process 'cfp.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'cmdagent.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

31 processes with 31 modules were scanned

 

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

 

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '46' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\Documents and Settings\Dart\Local Settings\Temp\EAD1.exe

[0] Archive type: NSIS

--> 0

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Dart\Local Settings\Temp\EAD2.exe

[0] Archive type: NSIS

--> unknown17

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Dart\Local Settings\Temp\EAD3.exe

[0] Archive type: NSIS

--> i

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\Documents and Settings\Dart\Local Settings\Temp\EAD6B.exe

[0] Archive type: NSIS

--> unknown13

[WARNING] No further files can be extracted from this archive. The archive will be closed

C:\WINDOWS\system32\drivers\sptd.sys

[WARNING] The file could not be opened!

Begin scan in 'D:\' <installations>

Begin scan in 'E:\' <documents>

E:\Documents and Settings\Dart87\Mes documents\logiciels\Lire jeux crackés\Alcohol.120.v1.9.5.3105-BetaMaster.rar

[0] Archive type: RAR

--> Alcohol.120.v1.9.5.3105-BetaMaster\Patch.exe

[DETECTION] Is the TR/Agent.69632.O Trojan

[WARNING] The file was ignored!

E:\Documents and Settings\Dart87\Mes documents\Ma musique\fonky family\la fonfy family\FF (Fonky Family) Live au dome de Marseille (full CD1+CD2) + video (Art de rue) By White cat.ace

[0] Archive type: ACE

--> FF(Fonky Family)__Live au dome de Marseille (full) + video (Art de rue)\Fonky Family__Live au dome de Marseille__CD2\05-Faut qu'on s'accroche.mp3

[WARNING] No further files can be extracted from this archive. The archive will be closed

 

 

End of the scan: lundi 20 avril 2009 09:06

Used time: 42:39 Minute(s)

 

The scan has been done completely.

 

5998 Scanning directories

580453 Files were scanned

1 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

0 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

580450 Files not concerned

4441 Archives were scanned

8 Warnings

0 Notes

 

Merci pour votre aide

 

Voici le raport hijackthis pour ma machine:

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:18:59, on 20/04/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

D:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\RTHDCPL.EXE

D:\Program Files\Comodo\COMODO Internet Security\cfp.exe

C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\ASUS.SYS\config\DVMExportService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\WINDOWS\system32\svchost.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\BitTorrent\bittorrent.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - :C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (file missing)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - :C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

O4 - HKLM\..\Run: [NvCplDaemon] :RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] :nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] :RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] :ALCMTR.EXE

O4 - HKLM\..\Run: [COMODO Internet Security] "D:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h

O4 - HKLM\..\Run: [sSBkgdUpdate] :"C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] :"D:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [steam] :"C:\WINDOWS\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe"

O4 - HKCU\..\Run: [bitTorrent DNA] :"C:\Program Files\DNA\btdna.exe"

O4 - HKCU\..\Run: [PC Suite Tray] :"D:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: ~Disabled

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - AppInit_DLLs:

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - D:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe

O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

 

--

End of file - 5205 bytes

[Falkra]

Bonjour,

 

des cracks et des trucs pompés, on le dit toujours mais c'est bourré de saletés.

 

Poubelle ça :

E:\Documents and Settings\Dart87\Mes documents\logiciels\Lire jeux crackés\Alcohol.120.v1.9.5.3105-BetaMaster.rar

 

Côté programmes, on dirait une machine dédiée au téléchargement p2p exclusivement. Pas étonnent qu'on ramasse des copains en route.

En plus, elle n'est pas à jour et très vulnérable. Os pompé, probablement.

 

Tu peux être sûr que tes dossiers cracks contiennent d'autres infections.

Antivir fait bien son boulot, mais peut en laisser passer, comme n'importe quel antivirus.

Ton rapport ne motnre pas d'infection en soi, mais potentiellement des tas de choses.

 

On va faire un gros nettoyage (attention, peut être relativement long).

 

Télécharge Malwarebytes' Anti-Malware (MBAM)

 

• Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  
• Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  
• Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  
• Sélectionne "Exécuter un examen complet"
  
• Clique sur "Rechercher"
  
• L'analyse démarre.
  
• A la fin de l'analyse (mais ce n'est pas fini), un message s'affiche :

  L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

  Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi. N'oublie pas la suite.
  
• Ferme tes navigateurs.
  
• Si des malwares ont été détectés, clique sur Afficher les résultats.
  Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  
• MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.
  

 

NB : Si MBAM te demande à redémarrer, fais-le.