Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

Infection/Controle à distance

keymonkey

Par keymonkey
dans Analyses et éradication malwares

 Partager

Messages recommandés

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Télécharge Malwarebytes' Anti-Malware (MBAM)

Si ça ne se télécharge pas, que tu es redirigé, ou que MBAM ne démarre pas, signale-le moi : c'est un symptôme.

Si tu l'as déjà, passe au point 2 directement (mise à jour).

 

  • Double clique sur le fichier téléchargé pour lancer le processus d'installation, puis démarre MBAM.
  • Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  • Sélectionne "Exécuter un examen rapide"
  • Clique sur "Rechercher"
  • L'analyse démarre.
  • A la fin de l'analyse (mais ce n'est pas fini), un message s'affiche :
    L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
    Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi. N'oublie pas la suite. :P
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
    Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

 

NB : Si MBAM te demande à redémarrer, fais-le.

Pour récupérer le rapport de MBAM si tu as redémarré un peu vite, démarre MBAM et va dans l'onglet log/rapports, tu pourras double cliquer dessus (ils sont datés) pour le poster.

keymonkey Member

keymonkey

Posté(e)
  • Auteur
Posté(e)

Merci Falkra,

 

Juste une petite précision, puis-je faire cela avec une clé USB comme recommandé par Basphet (plus haut), car j'ai coupé ma connexion internet.

 

Ex: Télécharger Malwarebytes' Anti-Malware (MBAM) sur une clé USB au bureau, puis exuter le processus ci-haut

sur ma machine à la maison, puis poster le rapport ensuite.

 

Je crains de reconnecter ma machine à la maison, car un tiers l'utilise.

 

Là je communique avec la machine au bureau.

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Basphet n'étant pas autorisé ici à intervenir, je te conseille de ne suivre que les instructions des gens de l'équipe sécurité.

 

Tu peux transférer l'installateur de MBAM via une clé USB, mais il faudra le mettre à jour, de toute façon.

 

 

Au pire, télécharge rules.ref depuis cet endroit (je te l'héberge, le dernier) :

http://senduit.com/a182f6

Et après avoir installé mbam place le fichier dans le dossier :

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

 

Ensuite démarre mbam et fais le scan, supprime (n'oublie pas les étapes en rouge dans les instructions), puis poste le rapport obtenu.

keymonkey Member

keymonkey

Posté(e)
  • Auteur
Posté(e)
Basphet n'étant pas autorisé ici à intervenir, je te conseille de ne suivre que les instructions des gens de l'équipe sécurité.

 

Tu peux transférer l'installateur de MBAM via une clé USB, mais il faudra le mettre à jour, de toute façon.

 

 

Au pire, télécharge rules.ref depuis cet endroit (je te l'héberge, le dernier) :

http://senduit.com/a182f6

Et après avoir installé mbam place le fichier dans le dossier :

C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware

 

Ensuite démarre mbam et fais le scan, supprime (n'oublie pas les étapes en rouge dans les instructions), puis poste le rapport obtenu.

 

 

Merci Falkra,

 

Je procède sitôt arrivé à la maison et je poste le rapport.

 

Merci encore

keymonkey Member

keymonkey

Posté(e)
  • Auteur
Posté(e)

Bonjour Falkra,

 

J'ai procédé comme mentionné plus haut.

 

Cependant, après avoir fait "Exécuter un examen rapide"

 

Une fenetre s'ouvre ''L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.''

 

Et là que je clique sur OK, ou que je ferme la fenetre, MBAM disparait (s'éteind), et je ne peux pas afficher les résultats ni supprimer la selection.

 

Voici ce que j'ai obtenu.

 

 

 

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

 

Version de la base de données: 3930

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

2010-04-14 19:05:59

mbam-log-2010-04-14 (19-05-59).txt

 

Type d'examen: Examen rapide

Elément(s) analysé(s): 12237

Temps écoulé: 4 minute(s), 24 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

 

 

ET

 

 

Malwarebytes' Anti-Malware 1.45

DB: 3988

 

IE: Internet Explorer 8.0.6001.18702

OS: Windows 5.1.2600 Service Pack 3

EX: C:\Program Files\Malwarebytes' Anti-Malware\mbam

DB: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref

 

U: USER

 

W: C:\WINDOWS

 

S: C:\WINDOWS\system32

 

RD: C:

 

PF: C:\Program Files

 

CF: C:\Program Files\Fichiers communs

 

DAS: C:\Documents and Settings

 

D: C:\Documents and Settings\Administrateur\Bureau

D: C:\Documents and Settings\All Users\Bureau

D: C:\Documents and Settings\Default User\Bureau

D: C:\Documents and Settings\LocalService\Bureau

D: C:\Documents and Settings\NetworkService\Bureau

D: C:\Documents and Settings\USER\Bureau

D: C:\WINDOWS\system32\config\systemprofile\Bureau

 

SM: C:\Documents and Settings\Administrateur\Menu Démarrer

SM: C:\Documents and Settings\All Users\Menu Démarrer

SM: C:\Documents and Settings\Default User\Menu Démarrer

SM: C:\Documents and Settings\NetworkService\Menu Démarrer

SM: C:\Documents and Settings\USER\Menu Démarrer

SM: C:\WINDOWS\system32\config\systemprofile\Menu Démarrer

 

UR: C:\Documents and Settings\Administrateur

UR: C:\Documents and Settings\All Users

UR: C:\Documents and Settings\Default User

UR: C:\Documents and Settings\LocalService

UR: C:\Documents and Settings\NetworkService

UR: C:\Documents and Settings\USER

UR: C:\WINDOWS\system32\config\systemprofile

 

F: C:\Documents and Settings\Administrateur\Favoris

F: C:\Documents and Settings\All Users\Favoris

F: C:\Documents and Settings\Default User\Favoris

F: C:\Documents and Settings\LocalService\Favoris

F: C:\Documents and Settings\NetworkService\Favoris

F: C:\Documents and Settings\USER\Favoris

F: C:\WINDOWS\system32\config\systemprofile\Favoris

 

AD: C:\Documents and Settings\All Users\Application Data

AD: C:\Documents and Settings\USER\Application Data

AD: C:\Documents and Settings\Administrateur\Application Data

AD: C:\Documents and Settings\Default User\Application Data

AD: C:\Documents and Settings\LocalService\Application Data

AD: C:\Documents and Settings\NetworkService\Application Data

AD: C:\WINDOWS\system32\config\systemprofile\Application Data

 

QL: C:\Documents and Settings\USER\Application Data\Microsoft\Internet Explorer\Quick Launch

 

TF: C:\Documents and Settings\Administrateur\Local Settings\Temp

TF: C:\Documents and Settings\Default User\Local Settings\Temp

TF: C:\Documents and Settings\LocalService\Local Settings\Temp

TF: C:\Documents and Settings\NetworkService\Local Settings\Temp

TF: C:\Documents and Settings\USER\Local Settings\Temp

TF: C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp

TF: C:\WINDOWS\Temp

 

P: C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes

P: C:\Documents and Settings\All Users\Menu Démarrer\Programmes

P: C:\Documents and Settings\Default User\Menu Démarrer\Programmes

P: C:\Documents and Settings\NetworkService\Menu Démarrer\Programmes

P: C:\Documents and Settings\USER\Menu Démarrer\Programmes

P: C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes

 

S: C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage

S: C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage

S: C:\Documents and Settings\Default User\Menu Démarrer\Programmes\Démarrage

S: C:\Documents and Settings\USER\Menu Démarrer\Programmes\Démarrage

S: C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage

 

D: C:\Documents and Settings\Administrateur\Mes documents

D: C:\Documents and Settings\All Users\Documents

D: C:\Documents and Settings\Default User\Mes documents

D: C:\Documents and Settings\NetworkService\Mes documents

D: C:\Documents and Settings\USER\Mes documents

D: C:\WINDOWS\system32\config\systemprofile\Mes documents

 

 

MBAM me dit cependant que j'ai 30 infections je crois,

 

 

Merci pour une réponse

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Redémarre, et réessaie, il ne devrait pas faire ça, ça peut être un plantage ponctuel, à confirmer.

keymonkey Member

keymonkey

Posté(e)
  • Auteur
Posté(e)
Redémarre, et réessaie, il ne devrait pas faire ça, ça peut être un plantage ponctuel, à confirmer.

 

 

Ça marche voici le rapport:

 

 

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

 

Version de la base de données: 3988

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

2010-04-15 20:52:46

mbam-log-2010-04-15 (20-52-46).txt

 

Type d'examen: Examen rapide

Elément(s) analysé(s): 120036

Temps écoulé: 11 minute(s), 47 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 1

Clé(s) du Registre infectée(s): 11

Valeur(s) du Registre infectée(s): 15

Elément(s) de données du Registre infecté(s): 8

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 28

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\AntiWPA.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pragmaymdbwqwmby (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe (Trojan.Chifrax) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PRAGMAd.sys (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\itype (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intellipoint (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quicktime task (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\davclnt.exe (Rogue.DigitalProtection) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewrgetuj (Worm.Prolaco.M) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\WINDOWS\PRAGMAymdbwqwmby (Trojan.DNSChanger) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Program Files\Microsoft IntelliType Pro\itype.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\QT Lite\qttask.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\notepad.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAnexuwpbdgi.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMApkmhwrrjkn.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAskmdypaobr.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\hhdxs.sys (Rootkit.Agent) -> Delete on reboot.

C:\Documents and Settings\USER\Local Settings\Temp\davclnt .exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\geurge .exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\wmpscfgs.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\ctv3708 .exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\PRAGMAymdbwqwmby\PRAGMAd.sys (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\setup.exe (Trojan.Chifrax) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAibomqlvyjh.dat (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\PRAGMA7003.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Favoris\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\AntiWPA.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

C:\WINDOWS\Temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\iexplarer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\iexplarer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Adobe\acrotray .exe (Trojan.Dropper) -> Quarantined and deleted successfully.

keymonkey Member

keymonkey

Posté(e)
  • Auteur
Posté(e)
Ça marche voici le rapport:

 

 

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

 

Version de la base de données: 3988

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

2010-04-15 20:52:46

mbam-log-2010-04-15 (20-52-46).txt

 

Type d'examen: Examen rapide

Elément(s) analysé(s): 120036

Temps écoulé: 11 minute(s), 47 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 1

Clé(s) du Registre infectée(s): 11

Valeur(s) du Registre infectée(s): 15

Elément(s) de données du Registre infecté(s): 8

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 28

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

C:\WINDOWS\system32\AntiWPA.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

 

Clé(s) du Registre infectée(s):

HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pragmaymdbwqwmby (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe (Trojan.Chifrax) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PRAGMAd.sys (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Paladin Antivirus (Rogue.PaladinAntivirus) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

 

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\itype (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\intellipoint (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\quicktime task (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a9ba40a1-74f1-52bd-f431-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\davclnt.exe (Rogue.DigitalProtection) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hf8wefhuaihf8ewfydiujhfdsfdf (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewrgetuj (Worm.Prolaco.M) -> Quarantined and deleted successfully.

 

Elément(s) de données du Registre infecté(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\USER\Local Settings\Application Data\ave.exe" /START "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\.exe\(default) (Hijacked.exeFile) -> Bad: (secfile) Good: (exefile) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

 

Dossier(s) infecté(s):

C:\WINDOWS\PRAGMAymdbwqwmby (Trojan.DNSChanger) -> Quarantined and deleted successfully.

 

Fichier(s) infecté(s):

C:\Program Files\Microsoft IntelliType Pro\itype.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\QT Lite\qttask.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\notepad.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Program Files\Internet Explorer\js.mui (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAnexuwpbdgi.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMApkmhwrrjkn.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAskmdypaobr.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\hhdxs.sys (Rootkit.Agent) -> Delete on reboot.

C:\Documents and Settings\USER\Local Settings\Temp\davclnt .exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\geurge .exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\wmpscfgs.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\ctv3708 .exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\PRAGMAymdbwqwmby\PRAGMAd.sys (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\setup.exe (Trojan.Chifrax) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\PRAGMAibomqlvyjh.dat (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\PRAGMA7003.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Favoris\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\AntiWPA.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

C:\WINDOWS\Temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\USER\Local Settings\Temp\iexplarer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\iexplarer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Adobe\acrotray .exe (Trojan.Dropper) -> Quarantined and deleted successfully.

 

 

Bonjour Falkra,

 

Il semble que le problème soit résolu,

je me suis reconnecté suite à l"analyse et la suppression de MBAM,

et la machine fonctionne, je ne vois plus de traces internet qui ne m'appartiennent pas

dans mon historique, les programmes s'ouvrent normalement, ce qui n'était pas

le cas.

 

Mais je ne suis pas un spécialiste.....

Falkra Devil Member !

Falkra

Posté(e)
Posté(e)

Ta machine est surtout crackée :

C:\WINDOWS\system32\AntiWPA.dll (Trojan.I.Stole.Windows) -> Delete on reboot.

 

Et nous allons donc effectivement nous en tenir là.

Invité
Ce sujet ne peut plus recevoir de nouvelles réponses.
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...