Infection par trojan

[fabulous gian]

Concernant le PC, je trouve qu'il tourne mieux. Une chose est sure, toutes les manips que tu m'as demandé de faire ont très certainement nettoyé la machine. En effet, au moment de l'apparition du virus, j'avais souvent un message d'avertissement d'un possible ralentissement d'affichage d'une page internet à cause d'un script. En cliquant sur "non" sur la fenêtre qui s'ouvrait, une page de connection à un compte AOL apparaissait avec des champs à remplir.

Depuis les différentes manips, cela ne s'est plus reproduit.

 

Je pense tout de même qu'il doit rester un petit quelque chose, car même si IE ne plante plus aussi souvent, il lui arrive encore de crasher sans raison.

 

FG

[Gof]

Bonjour fabulous gian

 

Longue semaine, navré. Bon, le dernier rapport est concluant, les fichiers associés à l'infection ne sont plus présents, et nous avons nettoyé un petit reste dans le Registre. Pas de nouveaux soucis depuis ces 2 jours ? En l'état, je ne te pense plus infecter et je vais te faire désinstaller les outils utilisés (je vais attendre cependant ta réponse).

 

Je pense tout de même qu'il doit rester un petit quelque chose, car même si IE ne plante plus aussi souvent, il lui arrive encore de crasher sans raison.

Un plantage IE peut-être dû à beaucoup de choses qui ne sont pas forcément de l'ordre de l'infectieux. Peux tu constater sur quel type de sites cela arrive régulièrement ? Je pense aux plugins comme Flash par exemple.

[fabulous gian]

Gof,

 

Désolé de te répondre tardivement mais les nuits étant courtes, je dors beaucoup en journée! lol....

 

Je constate des ralentissements lorsque je vais sur le net et je me demande s'il ne rete pas un petit quelque chose quand même dans mon PC. Comment pourrait-on vérifier que le trojan a bien été supprimé?

 

D'avance merci (encore) pour ton aide.

FG

[Gof]

Bonjour fabulous gian,

 

Navré des délais également, j'ai moi aussi des très grosses journées en ce moment. Je souhaiterais que tu renouvelles un rapport MBAM, voir si la situation a évolué depuis nos derniers échanges. Hormis ces soucis de lenteurs, pas de symptômes apparents de gros soucis ?

 

Pour vérifier un élément, rends toi sur ce lien : Virus Total

• Clique sur Parcourir
  
• Rends toi jusque sur ce fichier :
  

• C:\Windows\System32\drivers\tcpip.sys[/b]
  

• Clique sur Envoyer le fichier et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché. Si VirusTotal dit que le fichier a déjà été analysé, clique sur le bouton Reanalyse le fichier maintenant.
  
• Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
  
• Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
  
• Une nouvelle fenêtre de ton navigateur va apparaître
  
• Clique alors sur cette image :
  
• Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
  
• Enfin colle le résultat dans ta prochaine réponse.
  Note : Peu importe le résultat, il est important de me communiquer le résultat de toute l'analyse.
  

 

Quel que soit le résultat, ce fichier est important pour ton système, pour l'instant on ne fait que regarder, on ne le touche pas et on le laisse en place.

[fabulous gian]

Hello Gof,

 

Merci de continuer à m'aider. J'attends tes instructions s'il y a de nouveau quelque chose à faire sur le pc.

 

Voici le rapport de MBAM :

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Version de la base de données: 4071

 

Windows 6.0.6001 Service Pack 1

Internet Explorer 8.0.6001.18904

 

06/05/2010 14:47:01

mbam-log-2010-05-06 (14-47-01).txt

 

Type d'examen: Examen rapide

Elément(s) analysé(s): 117734

Temps écoulé: 5 minute(s), 33 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

 

 

Voici le rapport de Virus Total :

 

Fichier tcpip.sys reçu le 2010.05.06 13:42:13 (UTC)Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.50 2010.05.06 -

AhnLab-V3 2010.05.05.00 2010.05.05 -

AntiVir 8.2.1.236 2010.05.06 -

Antiy-AVL 2.0.3.7 2010.05.06 -

Authentium 5.2.0.5 2010.05.06 -

Avast 4.8.1351.0 2010.05.06 -

Avast5 5.0.332.0 2010.05.06 -

AVG 9.0.0.787 2010.05.06 -

BitDefender 7.2 2010.05.06 -

CAT-QuickHeal 10.00 2010.05.04 -

ClamAV 0.96.0.3-git 2010.05.06 -

Comodo 4779 2010.05.06 -

DrWeb 5.0.2.03300 2010.05.06 -

eSafe 7.0.17.0 2010.05.05 -

eTrust-Vet 35.2.7471 2010.05.06 -

F-Prot 4.5.1.85 2010.05.06 -

F-Secure 9.0.15370.0 2010.05.06 -

Fortinet 4.0.14.0 2010.05.05 -

GData 21 2010.05.06 -

Ikarus T3.1.1.84.0 2010.05.06 -

Jiangmin 13.0.900 2010.05.06 -

Kaspersky 7.0.0.125 2010.05.06 -

McAfee 5.400.0.1158 2010.05.06 -

McAfee-GW-Edition 2010.1 2010.05.06 -

Microsoft 1.5703 2010.05.05 -

NOD32 5091 2010.05.06 -

Norman 6.04.12 2010.05.06 -

nProtect 2010-05-06.02 2010.05.06 -

Panda 10.0.2.7 2010.05.05 -

PCTools 7.0.3.5 2010.05.06 -

Prevx 3.0 2010.05.06 -

Rising 22.46.03.04 2010.05.06 -

Sophos 4.53.0 2010.05.06 -

Sunbelt 6267 2010.05.06 -

Symantec 20091.2.0.41 2010.05.06 -

TheHacker 6.5.2.0.277 2010.05.06 -

TrendMicro 9.120.0.1004 2010.05.06 -

TrendMicro-HouseCall 9.120.0.1004 2010.05.06 -

VBA32 3.12.12.4 2010.05.06 -

ViRobot 2010.5.6.2304 2010.05.06 -

VirusBuster 5.0.27.0 2010.05.05 -

 

Information additionnelle

File size: 898952 bytes

MD5...: 2eae4500984c2f8dacfb977060300a15

SHA1..: 7847451edc4470b52213fba751851d36f217c19e

SHA256: 43e27ad4d6900e68e8b166547dbd64a909bf7d3b0edc780eeb7a8f81a075e225

ssdeep: 24576:Yzr3Op8rp653zO52pBawrYxEOBUfwuEwrFjONEmMh/K+fhG:A56AUfWNWf<BR>A<BR>

PEiD..: -

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0xdd1b9<BR>timedatestamp.....: 0x4b7d2a0b (Thu Feb 18 11:52:43 2010)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 9 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0xba84e 0xbaa00 6.56 233e4b70cf57f6a290d3f75e19454932<BR>.rdata 0xbc000 0xaa24 0xac00 5.87 7aa4ef9cd347310c069f7a540cf51e49<BR>.data 0xc7000 0x128fc 0x8200 0.74 58c9af9939179e0a0e281d1c6ff98519<BR>PAGE 0xda000 0x998 0xa00 6.22 72e8de8ee369d01cd6ef014ff57838cf<BR>.edata 0xdb000 0x49 0x200 0.85 51cedc911a69ff94117d6e997538f023<BR>PAGECONS 0xdc000 0x78 0x200 1.24 afcacc4c0f6d2ba7078b4f913fc3757c<BR>INIT 0xdd000 0x3e4a 0x4000 5.86 6af8e1e77533e538f9dbae0ac270390b<BR>.rsrc 0xe1000 0x3e0 0x400 3.35 555db99a4a29b28c0ca58e986a751e21<BR>.reloc 0xe2000 0x6dd8 0x6e00 6.80 657a5131fb53234c2137edc33d8fe1f7<BR><BR>( 8 imports ) <BR>> ntoskrnl.exe: RtlIpv4AddressToStringExW, MmUnlockPages, MmUserProbeAddress, PsGetCurrentProcessId, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, KeLeaveCriticalRegion, ExReleaseResourceLite, ExDeleteResourceLite, ExInitializeResourceLite, RtlUnwind, RtlAnsiCharToUnicodeChar, MmProbeAndLockPages, RtlInitializeBitMap, RtlSetBit, RtlSetBits, ExInitializeLookasideListEx, ExDeleteLookasideListEx, KeBugCheckEx, DbgPrint, RtlSubAuthoritySid, ObOpenObjectByPointer, ZwQueryInformationToken, ExGetPreviousMode, ExUuidCreate, ExAllocatePoolWithQuotaTag, KeBugCheck, KeDelayExecutionThread, KeTickCount, IoGetCurrentProcess, KeInitializeMutex, SeSetAuditParameter, SeReportSecurityEventWithSubCategory, DbgBreakPoint, MmSizeOfMdl, MmUnmapLockedPages, ObLogSecurityDescriptor, SeCaptureSubjectContextEx, SeLockSubjectContext, IoGetFileObjectGenericMapping, SeAccessCheck, SeUnlockSubjectContext, SeReleaseSubjectContext, RtlCreateSecurityDescriptor, SeExports, RtlLengthSid, RtlCreateAcl, RtlAddAccessAllowedAceEx, RtlSetDaclSecurityDescriptor, ExInterlockedFlushSList, KeInitializeSemaphore, ExAllocatePoolWithTagPriority, RtlIpv6AddressToStringExW, RtlVerifyVersionInfo, KeInitializeTimerEx, ExGetCurrentProcessorCounts, KeSetTimerEx, KeQueryActiveProcessors, KeQueryInterruptTime, KeFlushQueuedDpcs, KeCancelTimer, KeInitializeDpc, KeSetTargetProcessorDpc, KeSetImportanceDpc, KeWaitForMultipleObjects, KeInsertQueueDpc, IoAllocateWorkItem, IoQueueWorkItem, IoFreeWorkItem, MmBuildMdlForNonPagedPool, RtlInitializeGenericTableAvl, RtlGetVersion, KeQuerySystemTime, RtlLookupElementGenericTableFullAvl, ObDereferenceSecurityDescriptor, IoAllocateErrorLogEntry, IoWriteErrorLogEntry, ExNotifyCallback, KeQueryMaximumProcessorCount, KeIsExecutingDpc, PsGetProcessSessionId, InterlockedPushEntrySList, InterlockedPopEntrySList, KefAcquireSpinLockAtDpcLevel, IoAllocateMdl, IoBuildPartialMdl, KefReleaseSpinLockFromDpcLevel, IoFreeMdl, PsGetProcessId, MmMapLockedPagesSpecifyCache, ZwQuerySystemInformation, KeTestSpinLock, KeAcquireInStackQueuedSpinLockAtDpcLevel, KeReleaseInStackQueuedSpinLockFromDpcLevel, ObReferenceSecurityDescriptor, KeReleaseSemaphore, ExCreateCallback, IoBuildDeviceIoControlRequest, IoGetDeviceObjectPointer, ObfReferenceObject, PsGetCurrentProcess, PsIsSystemThread, PsGetThreadProcess, KeGetCurrentThread, KeInitializeEvent, KeSetEvent, RtlEnumerateGenericTableLikeADirectory, RtlTimeToTimeFields, ExDeleteNPagedLookasideList, ExInitializeNPagedLookasideList, RtlLengthRequiredSid, RtlInitializeSid, RtlAddAccessAllowedAce, ObSetSecurityObjectByPointer, RtlValidSid, RtlCopySid, IoCreateDevice, IoDeleteDevice, KeReadStateEvent, KeWaitForSingleObject, KeQueryActiveProcessorCount, KeReleaseMutex, ObfDereferenceObject, ZwOpenEvent, ObReferenceObjectByHandle, ZwClose, IofCompleteRequest, IofCallDriver, IoWMIRegistrationControl, RtlCompareMemory, RtlInitUnicodeString, MmGetSystemRoutineAddress, ZwEnumerateKey, RtlQueryRegistryValues, RtlIpv4StringToAddressW, RtlSubAuthorityCountSid, RtlIntegerToUnicodeString, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, ZwQueryValueKey, RtlUnicodeStringToInteger, ZwOpenKey, RtlCompareUnicodeString, PsSetCreateProcessNotifyRoutineEx, SeLocateProcessImageName, ZwCreateFile, RtlDowncaseUnicodeString, ZwOpenProcess, KeStackAttachProcess, ZwDuplicateToken, KeUnstackDetachProcess, IoDeleteSymbolicLink, IoCreateSymbolicLink, KeQueryTimeIncrement, PsReferenceImpersonationToken, PsDereferencePrimaryToken, PsReferencePrimaryToken, PsDereferenceImpersonationToken, ObCloseHandle, VerSetConditionMask, RtlFindSetBits, RtlAreBitsClear, RtlFindClearBits, RtlClearBits, ExAcquireResourceSharedLite, RtlClearBit, RtlClearAllBits, SeOpenObjectAuditAlarmForNonObObject, RtlTestBit, RtlEqualSid, RtlIpv6StringToAddressW, memset, memcpy, ExAllocatePoolWithTag, IoWMIWriteEvent, SeQueryInformationToken, ExFreePoolWithTag<BR>> NETIO.SYS: FsbAllocateAtDpcLevel, RtlInitializeTimerWheelEntry, NetioShutdownWorkQueue, RtlComputeToeplitzHash, RtlLookupEntryHashTable, RtlGetNextEntryHashTable, RtlInsertEntryHashTable, RtlRemoveEntryHashTable, RtlCleanupTimerWheelEntry, RtlEndEnumerationHashTable, RtlEnumerateEntryHashTable, RtlInitEnumerationHashTable, RtlReturnTimerWheelEntry, RtlGetNextExpiredTimerWheelEntry, RtlDeleteElementGenericTableBasicAvl, NetioInitializeWorkQueue, RtlInsertElementGenericTableBasicAvl, FsbAllocate, NetioAdvanceToLocationInNetBuffer, RtlCopyMdlToMdlIndirect, RtlUpdateCurrentTimerWheelTick, RtlEndTimerWheelEnumeration, RtlEnumerateNextTimerWheelEntry, RtlInitializeTimerWheelEnumeration, RtlCleanupTimerWheel, RtlDeleteHashTable, RtlCreateHashTable, RtlInitializeTimerWheel, RtlContractHashTable, RtlExpandHashTable, NetioFreeOpaquePerProcessorContext, NetioAllocateOpaquePerProcessorContext, TlDefaultRequestQueryDispatchEndpoint, TlDefaultRequestMessage, TlDefaultRequestQueryDispatch, RtlEndWeakEnumerationHashTable, RtlWeaklyEnumerateEntryHashTable, RtlInitWeakEnumerationHashTable, NsiFreeTable, NsiAllocateAndGetTable, NsiSetAllParameters, RtlCopyMdlToBuffer, NetioFreeNetBufferAndNetBufferList, NetioAllocateAndReferenceNetBufferAndNetBufferList, RtlCopyBufferToMdl, NmrWaitForClientDeregisterComplete, NmrDeregisterClient, NmrClientDetachProviderComplete, NmrClientAttachProvider, NmrRegisterClient, NmrProviderDetachClientComplete, NmrRegisterProvider, NmrWaitForProviderDeregisterComplete, NmrDeregisterProvider, NetioRetreatNetBufferList, NetioAllocateAndReferenceCopyNetBufferListEx, NetioCompleteCopyNetBufferListChain, NetioFreeCopyNetBufferList, NetioInitializeNetBufferListContext, TlDefaultRequestCancel, TlDefaultRequestConnect, TlDefaultRequestListen, NetioReferenceNetBufferList, TlDefaultRequestIoControl, NetioDereferenceNetBufferListChain, NetioAllocateNetBufferMdlAndData, NetioAllocateAndReferenceNetBufferListNetBufferMdlAndData, NetioDereferenceNetBufferList, NetioFreeNetBuffer, NetioExtendNetBuffer, NetioFreeNetBufferList, FsbFree, RtlIndicateTimerWheelEntryTimerStart, NetioFreeMdl, NetioFreeNetBufferListNetBufferMdlAndDataPool, NetioAllocateNetBufferMdlAndDataPool, NetioAllocateNetBufferListNetBufferMdlAndDataPool, NetioFreeNetBufferMdlAndDataPool, RtlCleanupToeplitzHash, RtlInitializeToeplitzHash, WfpStartStreamShim, NetioAllocateMdl, NetioInsertWorkQueue, WfpStreamInspectRemoteDisconnect, WfpStreamInspectReceive, WfpStreamInspectDisconnect, WfpStreamInspectSend, WfpStreamEndpointCleanupBegin, NetioInitializeNetBufferListAndFirstNetBufferContext, NsiEnumerateObjectsAllParameters, NsiReferenceDefaultObjectSecurity, NsiDeregisterChangeNotification, NsiRegisterChangeNotification, NetioCompleteNetBufferListChain, RtlCopyMdlToMdl, NetioAllocateAndReferenceFragmentNetBufferList, SetWfpDeviceObject, IoctlKfdBatchUpdate, IoctlKfdDeleteIndex, IoctlKfdAddIndex, IoctlKfdAddCache, IoctlKfdResetState, IoctlKfdQueryLayerStatistics, IoctlKfdAbortTransaction, IoctlKfdCommitTransaction, IoctlKfdDeleteCache, KfdIsActiveCallout, HfCreateFactory, HfDestroyFactory, NsiSetObjectSecurity, NetioAllocateNetBuffer, NetioAllocateAndReferenceNetBufferList, PtGetNumNodes, PtCreateTable, PtDestroyTable, PtDeleteEntry, PtInsertEntry, PtGetExactMatch, PtEnumOverTable, PtGetLongestMatch, PtGetNextShorterMatch, RtlCompute37Hash, PtGetKey, PtSetData, PtGetData, NsiSetParameter, NetioCompleteNetBufferAndNetBufferListChain, NetioQueryNetBufferListTrafficClass, NetioAllocateAndReferenceVacantNetBufferList, NetioAllocateAndReferenceCloneNetBufferListEx, NetioExpandNetBuffer, NetioUpdateNetBufferListContext, NetioAllocateAndReferenceCloneNetBufferList, NetioFreeCloneNetBufferList, NsiGetParameter, KfdCheckAcceptBypass, KfdCheckAndCacheAcceptBypass, KfdCheckConnectBypass, KfdCheckAndCacheConnectBypass, KfdGetLayerActionFromEnumTemplate, KfdEnumLayer, KfdGetNextFilter, KfdDerefFilterContext, KfdFreeEnumHandle, WfpScavangeLeastRecentlyUsedList, KfdAleInitializeFlowTable, WfpSetBucketsToEmptyLru, WfpExpireEntryLru, WfpInsertEntryLru, WfpDeleteEntryLru, WfpStreamIsFilterPresent, KfdToggleFilterActivation, NsiGetAllParameters, WfpInitializeLeastRecentlyUsedList, KfdAleNotifyFlowDeletion, FwppStreamDeleteDpcQueue, WfpUninitializeLeastRecentlyUsedList, KfdAleUninitializeFlowHandles, KfdAleInitializeFlowHandles, KfdGetOffloadEpoch, KfdIsLsoOffloadPossibleV6, KfdIsLsoOffloadPossibleV4, KfdIsV6InTransportFastEmpty, KfdIsV4InTransportFastEmpty, KfdIsV6OutTransportFastEmpty, KfdIsV4OutTransportFastEmpty, WfpRefreshEntryLru, NetioAdvanceNetBufferList, KfdCheckClassifyNeededAndUpdateEpoch, KfdAleAcquireFlowHandleForFlow, KfdClassify, KfdAleReleaseFlowHandleForFlow, KfdGetLayerCacheEpoch, KfdIsLayerEmpty, FwppStreamInject, FwppStreamContinue, FwppCopyStreamDataToBuffer, FwppAdvanceStreamDataPastOffset, FwppTruncateStreamDataAfterOffset, NetioUnRegisterProcessorAddCallback, NetioUnInitializeNetBufferListLibrary, NetioInitializeNetBufferListLibrary, NetioRegisterProcessorAddCallback, RtlInvokeStartRoutines, RtlInvokeStopRoutines, FsbDestroyPool, WfpStopStreamShim, FsbCreatePool, NsiGetParameterEx<BR>> NDIS.SYS: NdisDeregisterProtocolDriver, NdisRegisterProtocolDriver, NdisInitiateOffload, NdisInitializeTimer, NdisAcquireReadWriteLock, NdisGetSessionToCompartmentMappingEpochAndZero, NdisTerminateOffload, NdisUpdateOffload, NdisInvalidateOffload, NdisQueryOffloadState, NdisOidRequest, NdisDirectOidRequest, NdisCompleteNetPnPEvent, NdisCloseAdapterEx, NdisOpenAdapterEx, NdisSetTimer, NdisInitializeReadWriteLock, NdisCancelTimer, NdisCancelSendNetBufferLists, NdisSendNetBufferLists, NdisReleaseReadWriteLock, NdisReturnNetBufferLists, NdisOffloadTcpSend, NdisOffloadTcpReceive, NdisOffloadTcpReceiveReturn, NdisOffloadTcpDisconnect, NdisSetOptionalHandlers, NdisOffloadTcpForward, NdisGetDataBuffer, NetDmaRegisterClient, NetDmaDeregisterClient, NetDmaFreeChannel, NetDmaAllocateChannel, NdisGetProcessorInformation, NdisFreeNetBufferList, NetDmaNullTransfer, NetDmaIsDmaCopyComplete, NdisGetThreadObjectCompartmentId, NdisGetSessionCompartmentId, NdisAdjustNetBufferCurrentMdl, NdisAdvanceNetBufferDataStart, NdisRetreatNetBufferDataStart<BR>> FLTMGR.SYS: FltGetFileNameInformationUnsafe, FltReleaseFileNameInformation<BR>> fwpkclnt.sys: FwpsCalloutUnregisterByKey0, FwpmBfeStateSubscribeChangesWithoutDevice0, FwpmBfeStateUnsubscribeChanges0, FwpsClassifyOptionSet0, FwpmEngineClose0, FwpmEngineOpen0, FwpmSecureSocketDeleteByKeyAsync0, FwpmSecureSocketAddAsync0, FwpmEventProviderIsNetEventTypeEnabled0, FwpsRequestEndpointDeleteNotification0, FwppDispatchDevCtl0, IPsecDriverExpire, IPsecDriverInitiateAcquire, FwpmEventProviderFireNetEvent0, FwpsTcpIpDispatchTableClear0, FwpmEventProviderDestroy0, FwpmEventProviderCreate0, FwpsTcpIpDispatchTableSet0, FwpsCalloutRegisterWithoutDevice0<BR>> HAL.dll: KeGetCurrentIrql, KfReleaseSpinLock, KfLowerIrql, KfAcquireSpinLock, KeAcquireInStackQueuedSpinLock, KeReleaseInStackQueuedSpinLock, KeRaiseIrqlToDpcLevel, ExReleaseFastMutex, ExAcquireFastMutex, KfRaiseIrql, KeQueryPerformanceCounter<BR>> ksecdd.sys: BCryptDestroyHash, BCryptDecrypt, BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptGetProperty, BCryptGenRandom, BCryptHashData, BCryptEncrypt, BCryptGenerateSymmetricKey, BCryptDestroyKey, BCryptFinishHash, BCryptCreateHash<BR>> msrpc.sys: NdrMesTypeDecode2, MesHandleFree, I_RpcExceptionFilter, MesDecodeBufferHandleCreate<BR><BR>( 1 exports ) <BR>EQoSTestHook<BR>

RDS...: NSRL Reference Data Set<BR>-

pdfid.: -

trid..: Win64 Executable Generic (87.2%)<BR>Win32 Executable Generic (8.6%)<BR>Generic Win/DOS Executable (2.0%)<BR>DOS Executable Generic (2.0%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

sigcheck:<BR>publisher....: Microsoft Corporation<BR>copyright....: © Microsoft Corporation. All rights reserved.<BR>product......: Microsoft_ Windows_ Operating System<BR>description..: TCP/IP Driver<BR>original name: tcpip.sys<BR>internal name: tcpip.sys<BR>file version.: 6.0.6001.18427 (vistasp1_gdr.100218-0019)<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>

 

Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.50 2010.05.06 -

AhnLab-V3 2010.05.05.00 2010.05.05 -

AntiVir 8.2.1.236 2010.05.06 -

Antiy-AVL 2.0.3.7 2010.05.06 -

Authentium 5.2.0.5 2010.05.06 -

Avast 4.8.1351.0 2010.05.06 -

Avast5 5.0.332.0 2010.05.06 -

AVG 9.0.0.787 2010.05.06 -

BitDefender 7.2 2010.05.06 -

CAT-QuickHeal 10.00 2010.05.04 -

ClamAV 0.96.0.3-git 2010.05.06 -

Comodo 4779 2010.05.06 -

DrWeb 5.0.2.03300 2010.05.06 -

eSafe 7.0.17.0 2010.05.05 -

eTrust-Vet 35.2.7471 2010.05.06 -

F-Prot 4.5.1.85 2010.05.06 -

F-Secure 9.0.15370.0 2010.05.06 -

Fortinet 4.0.14.0 2010.05.05 -

GData 21 2010.05.06 -

Ikarus T3.1.1.84.0 2010.05.06 -

Jiangmin 13.0.900 2010.05.06 -

Kaspersky 7.0.0.125 2010.05.06 -

McAfee 5.400.0.1158 2010.05.06 -

McAfee-GW-Edition 2010.1 2010.05.06 -

Microsoft 1.5703 2010.05.05 -

NOD32 5091 2010.05.06 -

Norman 6.04.12 2010.05.06 -

nProtect 2010-05-06.02 2010.05.06 -

Panda 10.0.2.7 2010.05.05 -

PCTools 7.0.3.5 2010.05.06 -

Prevx 3.0 2010.05.06 -

Rising 22.46.03.04 2010.05.06 -

Sophos 4.53.0 2010.05.06 -

Sunbelt 6267 2010.05.06 -

Symantec 20091.2.0.41 2010.05.06 -

TheHacker 6.5.2.0.277 2010.05.06 -

TrendMicro 9.120.0.1004 2010.05.06 -

TrendMicro-HouseCall 9.120.0.1004 2010.05.06 -

VBA32 3.12.12.4 2010.05.06 -

ViRobot 2010.5.6.2304 2010.05.06 -

VirusBuster 5.0.27.0 2010.05.05 -

 

Information additionnelle

File size: 898952 bytes

MD5...: 2eae4500984c2f8dacfb977060300a15

SHA1..: 7847451edc4470b52213fba751851d36f217c19e

SHA256: 43e27ad4d6900e68e8b166547dbd64a909bf7d3b0edc780eeb7a8f81a075e225

ssdeep: 24576:Yzr3Op8rp653zO52pBawrYxEOBUfwuEwrFjONEmMh/K+fhG:A56AUfWNWf<BR>A<BR>

PEiD..: -

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0xdd1b9<BR>timedatestamp.....: 0x4b7d2a0b (Thu Feb 18 11:52:43 2010)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 9 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0xba84e 0xbaa00 6.56 233e4b70cf57f6a290d3f75e19454932<BR>.rdata 0xbc000 0xaa24 0xac00 5.87 7aa4ef9cd347310c069f7a540cf51e49<BR>.data 0xc7000 0x128fc 0x8200 0.74 58c9af9939179e0a0e281d1c6ff98519<BR>PAGE 0xda000 0x998 0xa00 6.22 72e8de8ee369d01cd6ef014ff57838cf<BR>.edata 0xdb000 0x49 0x200 0.85 51cedc911a69ff94117d6e997538f023<BR>PAGECONS 0xdc000 0x78 0x200 1.24 afcacc4c0f6d2ba7078b4f913fc3757c<BR>INIT 0xdd000 0x3e4a 0x4000 5.86 6af8e1e77533e538f9dbae0ac270390b<BR>.rsrc 0xe1000 0x3e0 0x400 3.35 555db99a4a29b28c0ca58e986a751e21<BR>.reloc 0xe2000 0x6dd8 0x6e00 6.80 657a5131fb53234c2137edc33d8fe1f7<BR><BR>( 8 imports ) <BR>> ntoskrnl.exe: RtlIpv4AddressToStringExW, MmUnlockPages, MmUserProbeAddress, PsGetCurrentProcessId, ExAcquireResourceExclusiveLite, KeEnterCriticalRegion, KeLeaveCriticalRegion, ExReleaseResourceLite, ExDeleteResourceLite, ExInitializeResourceLite, RtlUnwind, RtlAnsiCharToUnicodeChar, MmProbeAndLockPages, RtlInitializeBitMap, RtlSetBit, RtlSetBits, ExInitializeLookasideListEx, ExDeleteLookasideListEx, KeBugCheckEx, DbgPrint, RtlSubAuthoritySid, ObOpenObjectByPointer, ZwQueryInformationToken, ExGetPreviousMode, ExUuidCreate, ExAllocatePoolWithQuotaTag, KeBugCheck, KeDelayExecutionThread, KeTickCount, IoGetCurrentProcess, KeInitializeMutex, SeSetAuditParameter, SeReportSecurityEventWithSubCategory, DbgBreakPoint, MmSizeOfMdl, MmUnmapLockedPages, ObLogSecurityDescriptor, SeCaptureSubjectContextEx, SeLockSubjectContext, IoGetFileObjectGenericMapping, SeAccessCheck, SeUnlockSubjectContext, SeReleaseSubjectContext, RtlCreateSecurityDescriptor, SeExports, RtlLengthSid, RtlCreateAcl, RtlAddAccessAllowedAceEx, RtlSetDaclSecurityDescriptor, ExInterlockedFlushSList, KeInitializeSemaphore, ExAllocatePoolWithTagPriority, RtlIpv6AddressToStringExW, RtlVerifyVersionInfo, KeInitializeTimerEx, ExGetCurrentProcessorCounts, KeSetTimerEx, KeQueryActiveProcessors, KeQueryInterruptTime, KeFlushQueuedDpcs, KeCancelTimer, KeInitializeDpc, KeSetTargetProcessorDpc, KeSetImportanceDpc, KeWaitForMultipleObjects, KeInsertQueueDpc, IoAllocateWorkItem, IoQueueWorkItem, IoFreeWorkItem, MmBuildMdlForNonPagedPool, RtlInitializeGenericTableAvl, RtlGetVersion, KeQuerySystemTime, RtlLookupElementGenericTableFullAvl, ObDereferenceSecurityDescriptor, IoAllocateErrorLogEntry, IoWriteErrorLogEntry, ExNotifyCallback, KeQueryMaximumProcessorCount, KeIsExecutingDpc, PsGetProcessSessionId, InterlockedPushEntrySList, InterlockedPopEntrySList, KefAcquireSpinLockAtDpcLevel, IoAllocateMdl, IoBuildPartialMdl, KefReleaseSpinLockFromDpcLevel, IoFreeMdl, PsGetProcessId, MmMapLockedPagesSpecifyCache, ZwQuerySystemInformation, KeTestSpinLock, KeAcquireInStackQueuedSpinLockAtDpcLevel, KeReleaseInStackQueuedSpinLockFromDpcLevel, ObReferenceSecurityDescriptor, KeReleaseSemaphore, ExCreateCallback, IoBuildDeviceIoControlRequest, IoGetDeviceObjectPointer, ObfReferenceObject, PsGetCurrentProcess, PsIsSystemThread, PsGetThreadProcess, KeGetCurrentThread, KeInitializeEvent, KeSetEvent, RtlEnumerateGenericTableLikeADirectory, RtlTimeToTimeFields, ExDeleteNPagedLookasideList, ExInitializeNPagedLookasideList, RtlLengthRequiredSid, RtlInitializeSid, RtlAddAccessAllowedAce, ObSetSecurityObjectByPointer, RtlValidSid, RtlCopySid, IoCreateDevice, IoDeleteDevice, KeReadStateEvent, KeWaitForSingleObject, KeQueryActiveProcessorCount, KeReleaseMutex, ObfDereferenceObject, ZwOpenEvent, ObReferenceObjectByHandle, ZwClose, IofCompleteRequest, IofCallDriver, IoWMIRegistrationControl, RtlCompareMemory, RtlInitUnicodeString, MmGetSystemRoutineAddress, ZwEnumerateKey, RtlQueryRegistryValues, RtlIpv4StringToAddressW, RtlSubAuthorityCountSid, RtlIntegerToUnicodeString, RtlConvertSidToUnicodeString, RtlFreeUnicodeString, ZwQueryValueKey, RtlUnicodeStringToInteger, ZwOpenKey, RtlCompareUnicodeString, PsSetCreateProcessNotifyRoutineEx, SeLocateProcessImageName, ZwCreateFile, RtlDowncaseUnicodeString, ZwOpenProcess, KeStackAttachProcess, ZwDuplicateToken, KeUnstackDetachProcess, IoDeleteSymbolicLink, IoCreateSymbolicLink, KeQueryTimeIncrement, PsReferenceImpersonationToken, PsDereferencePrimaryToken, PsReferencePrimaryToken, PsDereferenceImpersonationToken, ObCloseHandle, VerSetConditionMask, RtlFindSetBits, RtlAreBitsClear, RtlFindClearBits, RtlClearBits, ExAcquireResourceSharedLite, RtlClearBit, RtlClearAllBits, SeOpenObjectAuditAlarmForNonObObject, RtlTestBit, RtlEqualSid, RtlIpv6StringToAddressW, memset, memcpy, ExAllocatePoolWithTag, IoWMIWriteEvent, SeQueryInformationToken, ExFreePoolWithTag<BR>> NETIO.SYS: FsbAllocateAtDpcLevel, RtlInitializeTimerWheelEntry, NetioShutdownWorkQueue, RtlComputeToeplitzHash, RtlLookupEntryHashTable, RtlGetNextEntryHashTable, RtlInsertEntryHashTable, RtlRemoveEntryHashTable, RtlCleanupTimerWheelEntry, RtlEndEnumerationHashTable, RtlEnumerateEntryHashTable, RtlInitEnumerationHashTable, RtlReturnTimerWheelEntry, RtlGetNextExpiredTimerWheelEntry, RtlDeleteElementGenericTableBasicAvl, NetioInitializeWorkQueue, RtlInsertElementGenericTableBasicAvl, FsbAllocate, NetioAdvanceToLocationInNetBuffer, RtlCopyMdlToMdlIndirect, RtlUpdateCurrentTimerWheelTick, RtlEndTimerWheelEnumeration, RtlEnumerateNextTimerWheelEntry, RtlInitializeTimerWheelEnumeration, RtlCleanupTimerWheel, RtlDeleteHashTable, RtlCreateHashTable, RtlInitializeTimerWheel, RtlContractHashTable, RtlExpandHashTable, NetioFreeOpaquePerProcessorContext, NetioAllocateOpaquePerProcessorContext, TlDefaultRequestQueryDispatchEndpoint, TlDefaultRequestMessage, TlDefaultRequestQueryDispatch, RtlEndWeakEnumerationHashTable, RtlWeaklyEnumerateEntryHashTable, RtlInitWeakEnumerationHashTable, NsiFreeTable, NsiAllocateAndGetTable, NsiSetAllParameters, RtlCopyMdlToBuffer, NetioFreeNetBufferAndNetBufferList, NetioAllocateAndReferenceNetBufferAndNetBufferList, RtlCopyBufferToMdl, NmrWaitForClientDeregisterComplete, NmrDeregisterClient, NmrClientDetachProviderComplete, NmrClientAttachProvider, NmrRegisterClient, NmrProviderDetachClientComplete, NmrRegisterProvider, NmrWaitForProviderDeregisterComplete, NmrDeregisterProvider, NetioRetreatNetBufferList, NetioAllocateAndReferenceCopyNetBufferListEx, NetioCompleteCopyNetBufferListChain, NetioFreeCopyNetBufferList, NetioInitializeNetBufferListContext, TlDefaultRequestCancel, TlDefaultRequestConnect, TlDefaultRequestListen, NetioReferenceNetBufferList, TlDefaultRequestIoControl, NetioDereferenceNetBufferListChain, NetioAllocateNetBufferMdlAndData, NetioAllocateAndReferenceNetBufferListNetBufferMdlAndData, NetioDereferenceNetBufferList, NetioFreeNetBuffer, NetioExtendNetBuffer, NetioFreeNetBufferList, FsbFree, RtlIndicateTimerWheelEntryTimerStart, NetioFreeMdl, NetioFreeNetBufferListNetBufferMdlAndDataPool, NetioAllocateNetBufferMdlAndDataPool, NetioAllocateNetBufferListNetBufferMdlAndDataPool, NetioFreeNetBufferMdlAndDataPool, RtlCleanupToeplitzHash, RtlInitializeToeplitzHash, WfpStartStreamShim, NetioAllocateMdl, NetioInsertWorkQueue, WfpStreamInspectRemoteDisconnect, WfpStreamInspectReceive, WfpStreamInspectDisconnect, WfpStreamInspectSend, WfpStreamEndpointCleanupBegin, NetioInitializeNetBufferListAndFirstNetBufferContext, NsiEnumerateObjectsAllParameters, NsiReferenceDefaultObjectSecurity, NsiDeregisterChangeNotification, NsiRegisterChangeNotification, NetioCompleteNetBufferListChain, RtlCopyMdlToMdl, NetioAllocateAndReferenceFragmentNetBufferList, SetWfpDeviceObject, IoctlKfdBatchUpdate, IoctlKfdDeleteIndex, IoctlKfdAddIndex, IoctlKfdAddCache, IoctlKfdResetState, IoctlKfdQueryLayerStatistics, IoctlKfdAbortTransaction, IoctlKfdCommitTransaction, IoctlKfdDeleteCache, KfdIsActiveCallout, HfCreateFactory, HfDestroyFactory, NsiSetObjectSecurity, NetioAllocateNetBuffer, NetioAllocateAndReferenceNetBufferList, PtGetNumNodes, PtCreateTable, PtDestroyTable, PtDeleteEntry, PtInsertEntry, PtGetExactMatch, PtEnumOverTable, PtGetLongestMatch, PtGetNextShorterMatch, RtlCompute37Hash, PtGetKey, PtSetData, PtGetData, NsiSetParameter, NetioCompleteNetBufferAndNetBufferListChain, NetioQueryNetBufferListTrafficClass, NetioAllocateAndReferenceVacantNetBufferList, NetioAllocateAndReferenceCloneNetBufferListEx, NetioExpandNetBuffer, NetioUpdateNetBufferListContext, NetioAllocateAndReferenceCloneNetBufferList, NetioFreeCloneNetBufferList, NsiGetParameter, KfdCheckAcceptBypass, KfdCheckAndCacheAcceptBypass, KfdCheckConnectBypass, KfdCheckAndCacheConnectBypass, KfdGetLayerActionFromEnumTemplate, KfdEnumLayer, KfdGetNextFilter, KfdDerefFilterContext, KfdFreeEnumHandle, WfpScavangeLeastRecentlyUsedList, KfdAleInitializeFlowTable, WfpSetBucketsToEmptyLru, WfpExpireEntryLru, WfpInsertEntryLru, WfpDeleteEntryLru, WfpStreamIsFilterPresent, KfdToggleFilterActivation, NsiGetAllParameters, WfpInitializeLeastRecentlyUsedList, KfdAleNotifyFlowDeletion, FwppStreamDeleteDpcQueue, WfpUninitializeLeastRecentlyUsedList, KfdAleUninitializeFlowHandles, KfdAleInitializeFlowHandles, KfdGetOffloadEpoch, KfdIsLsoOffloadPossibleV6, KfdIsLsoOffloadPossibleV4, KfdIsV6InTransportFastEmpty, KfdIsV4InTransportFastEmpty, KfdIsV6OutTransportFastEmpty, KfdIsV4OutTransportFastEmpty, WfpRefreshEntryLru, NetioAdvanceNetBufferList, KfdCheckClassifyNeededAndUpdateEpoch, KfdAleAcquireFlowHandleForFlow, KfdClassify, KfdAleReleaseFlowHandleForFlow, KfdGetLayerCacheEpoch, KfdIsLayerEmpty, FwppStreamInject, FwppStreamContinue, FwppCopyStreamDataToBuffer, FwppAdvanceStreamDataPastOffset, FwppTruncateStreamDataAfterOffset, NetioUnRegisterProcessorAddCallback, NetioUnInitializeNetBufferListLibrary, NetioInitializeNetBufferListLibrary, NetioRegisterProcessorAddCallback, RtlInvokeStartRoutines, RtlInvokeStopRoutines, FsbDestroyPool, WfpStopStreamShim, FsbCreatePool, NsiGetParameterEx<BR>> NDIS.SYS: NdisDeregisterProtocolDriver, NdisRegisterProtocolDriver, NdisInitiateOffload, NdisInitializeTimer, NdisAcquireReadWriteLock, NdisGetSessionToCompartmentMappingEpochAndZero, NdisTerminateOffload, NdisUpdateOffload, NdisInvalidateOffload, NdisQueryOffloadState, NdisOidRequest, NdisDirectOidRequest, NdisCompleteNetPnPEvent, NdisCloseAdapterEx, NdisOpenAdapterEx, NdisSetTimer, NdisInitializeReadWriteLock, NdisCancelTimer, NdisCancelSendNetBufferLists, NdisSendNetBufferLists, NdisReleaseReadWriteLock, NdisReturnNetBufferLists, NdisOffloadTcpSend, NdisOffloadTcpReceive, NdisOffloadTcpReceiveReturn, NdisOffloadTcpDisconnect, NdisSetOptionalHandlers, NdisOffloadTcpForward, NdisGetDataBuffer, NetDmaRegisterClient, NetDmaDeregisterClient, NetDmaFreeChannel, NetDmaAllocateChannel, NdisGetProcessorInformation, NdisFreeNetBufferList, NetDmaNullTransfer, NetDmaIsDmaCopyComplete, NdisGetThreadObjectCompartmentId, NdisGetSessionCompartmentId, NdisAdjustNetBufferCurrentMdl, NdisAdvanceNetBufferDataStart, NdisRetreatNetBufferDataStart<BR>> FLTMGR.SYS: FltGetFileNameInformationUnsafe, FltReleaseFileNameInformation<BR>> fwpkclnt.sys: FwpsCalloutUnregisterByKey0, FwpmBfeStateSubscribeChangesWithoutDevice0, FwpmBfeStateUnsubscribeChanges0, FwpsClassifyOptionSet0, FwpmEngineClose0, FwpmEngineOpen0, FwpmSecureSocketDeleteByKeyAsync0, FwpmSecureSocketAddAsync0, FwpmEventProviderIsNetEventTypeEnabled0, FwpsRequestEndpointDeleteNotification0, FwppDispatchDevCtl0, IPsecDriverExpire, IPsecDriverInitiateAcquire, FwpmEventProviderFireNetEvent0, FwpsTcpIpDispatchTableClear0, FwpmEventProviderDestroy0, FwpmEventProviderCreate0, FwpsTcpIpDispatchTableSet0, FwpsCalloutRegisterWithoutDevice0<BR>> HAL.dll: KeGetCurrentIrql, KfReleaseSpinLock, KfLowerIrql, KfAcquireSpinLock, KeAcquireInStackQueuedSpinLock, KeReleaseInStackQueuedSpinLock, KeRaiseIrqlToDpcLevel, ExReleaseFastMutex, ExAcquireFastMutex, KfRaiseIrql, KeQueryPerformanceCounter<BR>> ksecdd.sys: BCryptDestroyHash, BCryptDecrypt, BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptGetProperty, BCryptGenRandom, BCryptHashData, BCryptEncrypt, BCryptGenerateSymmetricKey, BCryptDestroyKey, BCryptFinishHash, BCryptCreateHash<BR>> msrpc.sys: NdrMesTypeDecode2, MesHandleFree, I_RpcExceptionFilter, MesDecodeBufferHandleCreate<BR><BR>( 1 exports ) <BR>EQoSTestHook<BR>

RDS...: NSRL Reference Data Set<BR>-

pdfid.: -

trid..: Win64 Executable Generic (87.2%)<BR>Win32 Executable Generic (8.6%)<BR>Generic Win/DOS Executable (2.0%)<BR>DOS Executable Generic (2.0%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

sigcheck:<BR>publisher....: Microsoft Corporation<BR>copyright....: © Microsoft Corporation. All rights reserved.<BR>product......: Microsoft_ Windows_ Operating System<BR>description..: TCP/IP Driver<BR>original name: tcpip.sys<BR>internal name: tcpip.sys<BR>file version.: 6.0.6001.18427 (vistasp1_gdr.100218-0019)<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>

[Gof]

Bonjour fabulous gian

 

Je crois qu'on a fait le tour en fait à présent. Je te fais désinstaller les outils utilisés :

 

Rends toi dans ton Menu Démarrer > Exécuter et tape (ou copie-colle) la commande suivante : combofix /uninstall puis valide.

 

Supprime les éléments suivants de ton Bureau si encore présents :

• Combofix.exe
  rsit.exe
  mbam-setup.exe
  OTM.exe
  RootRepeal.zip
  Load_tdsskiller.exe
  flor.bat
  CFScript.txt
  Le fichier obtenu (avec un nom aléatoire) pour Gmer
  

 

Rends toi dans ton Panneau de configuration > Programmes et fonctionnalités et désinstalle les éléments suivants :

• Adobe Reader 9.1 - Français
  Java™ 6 Update 18-
  VLC media player 1.0.1
  

Il s'agit de versions obsolètes, pouvant introduire des risques pour ton système. Rends toi sur le lien suivant pour télécharger et installer une version Adobe Reader à jour, ou consulte cette page pour une alternative gratuite de logiciels libres. Télécharge la dernière version JAVA sur ce lien, et la dernière version du Flashplayer ici. Tu peux consulter ce tuto de Malekal Morte pour t'aider. T trouveras le dernière version VLC ici.

 

Supprime les répertoires et fichiers suivants si présents :

• c:\rsit
  C:\_OTM
  c:\Qoobox
  c:\Combofix
  c:\RootRepeal
  c:\Tdsskiller
  

 

Je t'ai fait télécharger MBAM, je te suggère de le conserver. Dans sa version gratuite, il n'y pas de résidents, mais tu peux continuer à le mettre à jour ponctuellement, et l'utiliser en analyse de contrôle. Sinon, il te suffit de le désinstaller normalement, via le Panneau de configuration > Programmes et fonctionnalités.

 

Reviens m'indiquer si tout s'est bien passé