Malware Ricsi-831 / win32 fakeRean / jifas

[sloy]

Bonjour ; mon antivirus Avast (sous seven 64bit) à detecté une menace : Ricsi-831 dans un fichier .vmem servant au fonctionnement d'une machine virtuelle Win xp Sp3 .

je refait l'analyse sur ce fichier et a chaque fois Avast indique une menace différente : win32-jifas ; puis win32 FakeRean .

 

Dans la machine virtuelle (VMware) : un windows Xp Sp3 , l analyse avec antivir puis mbam ne renvois aucunes menaces .

 

j' ai effectuer une analyse ComboFix sous ce Win Xp Sp3 (dans sa machine virtuelle) :

 

ComboFix 12-07-02.01 - lgkticu 02/07/2012 18:14:59.1.1 - x86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1551.1058 [GMT 2:00]

Lancé depuis: c:\documents and settings\lgkticu\Mes documents\Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

ADS - system32: deleted 12 bytes in 1 streams.

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\windows\iun6002.exe

c:\windows\system32\scvideo.dll

.

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-06-02 au 2012-07-02 ))))))))))))))))))))))))))))))))))))

.

.

2012-07-02 15:29 . 2012-07-02 15:29 -------- d-----w- c:\documents and settings\lgkticu\Application Data\SUPERAntiSpyware.com

2012-06-23 10:32 . 2012-06-23 10:32 9815752 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

2012-06-14 16:36 . 2012-06-14 16:36 -------- d-----w- C:\407878d9cf5dcde6a6

2012-06-13 23:37 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

2012-06-11 16:30 . 2012-06-11 16:31 -------- d-----w- c:\documents and settings\lgkticu\Application Data\Maxthon3

2012-06-11 16:30 . 2012-06-11 16:30 -------- d-----w- c:\program files\Maxthon3

2012-06-09 19:12 . 2012-06-17 16:56 85472 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2012-06-09 19:12 . 2012-06-01 15:36 770384 ----a-w- c:\program files\Mozilla Firefox\msvcr100.dll

2012-06-09 19:12 . 2012-06-01 15:36 421200 ----a-w- c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-04 16:11 . 2012-06-04 16:11 -------- d-----w- c:\program files\Fichiers communs\Java

2012-06-04 16:11 . 2012-05-09 10:21 476936 ----a-w- c:\windows\system32\npdeployJava1.dll

2012-06-04 16:11 . 2012-05-09 08:47 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-06-04 16:10 . 2012-06-26 16:57 -------- d-----w- c:\program files\Java

.

.

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-23 10:32 . 2012-04-18 15:35 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-06-23 10:32 . 2011-05-14 12:43 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-02 13:19 . 2009-08-06 17:24 16408 ----a-w- c:\windows\system32\wuapi.dll.mui

2012-06-02 13:19 . 2010-07-04 19:27 329240 ----a-w- c:\windows\system32\wucltui.dll

2012-06-02 13:19 . 2010-07-04 19:27 219160 ----a-w- c:\windows\system32\wuaucpl.cpl

2012-06-02 13:19 . 2010-07-04 19:27 210968 ----a-w- c:\windows\system32\wuweb.dll

2012-06-02 13:19 . 2010-07-04 19:27 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 13:19 . 2010-07-04 19:27 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-02 13:19 . 2009-08-06 17:24 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 13:19 . 2008-04-13 17:33 97304 ----a-w- c:\windows\system32\cdm.dll

2012-06-02 13:19 . 2009-08-06 17:24 19480 ----a-w- c:\windows\system32\wuaueng.dll.mui

2012-06-02 13:19 . 2009-08-06 17:24 16408 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

2012-06-02 13:19 . 2010-07-04 19:27 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 13:19 . 2010-07-04 19:27 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 13:19 . 2009-08-06 17:23 25112 ----a-w- c:\windows\system32\wucltui.dll.mui

2012-05-31 13:22 . 2008-04-13 17:33 606208 ----a-w- c:\windows\system32\crypt32.dll

2012-05-16 15:06 . 2008-03-01 12:58 916992 ----a-w- c:\windows\system32\wininet.dll

2012-05-15 13:55 . 2008-04-13 16:58 1863296 ----a-w- c:\windows\system32\win32k.sys

2012-05-11 14:40 . 2008-05-09 21:29 43520 ------w- c:\windows\system32\licmgr10.dll

2012-05-11 14:40 . 2008-03-01 12:58 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-05-11 11:38 . 2008-05-09 21:28 385024 ------w- c:\windows\system32\html.iec

2012-05-09 10:21 . 2012-05-08 16:05 472840 ----a-w- c:\windows\system32\deployJava1.dll

2012-05-08 16:04 . 2012-05-08 16:04 34016 ----a-w- c:\windows\system32\drivers\tap0901.sys

2012-05-08 15:55 . 2012-04-18 19:35 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2012-05-08 15:55 . 2012-04-18 19:35 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys

2012-05-05 03:15 . 2008-04-13 19:07 2071168 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-05-05 03:15 . 2008-04-13 17:08 2194688 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-05-02 13:47 . 2010-07-04 19:26 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2012-04-04 13:56 . 2010-08-14 20:08 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-06-17 16:56 . 2012-06-09 19:12 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-05-09 . 33578A738C564B4F84D906EFD91025E5 . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2012-05-01 5786983]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PlusService"="c:\program files\Yuna Software\Messenger Plus!\PlusService.exe" [2012-02-27 801792]

"VMware Tools"="c:\program files\VMware\VMware Tools\VMwareTray.exe" [2011-11-13 58480]

"VMware User Process"="c:\program files\VMware\VMware Tools\vmtoolsd.exe" [2011-11-13 62576]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]

"SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TPSvc]

2011-01-13 14:08 484192 ----a-w- c:\windows\system32\TPSvc.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VMUpgradeAtShutdown]

2011-11-13 19:49 90224 ----a-w- c:\windows\system32\VMUpgradeAtShutdownWXP.dll

.

[HKLM\~\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^802.11g USB 2.0 adapter Setting.lnk]

path=c:\documents and settings\Administrateur\Menu Démarrer\Programmes\Démarrage\802.11g USB 2.0 adapter Setting.lnk

backup=c:\windows\pss\802.11g USB 2.0 adapter Setting.lnkStartup

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Documents and Settings\\Administrateur\\Mes documents\\Windows Live Messenger 8.5\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\emesene\\emesene.exe"=

"c:\\Program Files\\Look@LAN\\LookAtLan.exe"=

"c:\\Program Files\\Look@LAN\\LookAtHost.exe"=

"c:\\Documents and Settings\\Administrateur\\Local Settings\\Temp\\CProgram FilesOpera\\OperaUpgrader.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Maxthon3\\Bin\\Maxthon.exe"=

"c:\\Program Files\\Maxthon3\\Bin\\MxUp.exe"=

.

R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\drivers\vmci.sys [04/07/2010 21:34 98928]

R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [04/07/2010 23:19 17968]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [18/04/2012 21:35 36000]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [17/02/2010 20:25 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [10/05/2010 20:41 67656]

R1 vmhgfs;vmhgfs;c:\windows\system32\drivers\vmhgfs.sys [04/07/2010 21:34 144112]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [18/04/2012 21:35 86224]

R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [25/06/2010 19:07 35088]

R2 VMMEMCTL;Pilote de commande de mémoire;c:\program files\Fichiers communs\VMware\Drivers\memctl\vmmemctl.sys [13/11/2011 21:46 15088]

R2 VMTools;VMware Tools;c:\program files\VMware\VMware Tools\vmtoolsd.exe [13/11/2011 21:49 62576]

R2 VMware Physical Disk Helper Service;Service d'aide du disque physique VMware;c:\program files\VMware\VMware Tools\vmacthlp.exe [13/11/2011 21:44 432752]

R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\drivers\vcsvad.sys [10/12/2011 18:30 17792]

R3 vmx_svga;vmx_svga;c:\windows\system32\drivers\vmx_svga.sys [04/07/2010 21:34 102256]

R3 vmxnet;VMware Ethernet Adapter Driver;c:\windows\system32\drivers\vmxnet.sys [04/07/2010 21:34 30000]

S1 vmdebug;VMware Replay Debugging Helper;\??\c:\windows\system32\Drivers\vmdebug.sys --> c:\windows\system32\Drivers\vmdebug.sys [?]

S1 vmrawdsk;Aide du disque physique VMware Vista;\??\c:\program files\VMware\VMware Tools\vmrawdsk.sys --> c:\program files\VMware\VMware Tools\vmrawdsk.sys [?]

S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/03/2012 16:14 136176]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [18/04/2012 17:35 250056]

S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/03/2012 16:14 136176]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [28/04/2012 17:20 113120]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [06/04/2009 14:19 23064]

S3 TPAutoConnSvc;TP AutoConnect Service;c:\program files\VMware\VMware Tools\TPAutoConnSvc.exe [02/08/2010 16:42 263496]

S3 TPVCGateway;TP VC Gateway Service;c:\program files\VMware\VMware Tools\TPVCGateway.exe [07/10/2010 13:19 394104]

S3 vmmouse;VMware Pointing Device;c:\windows\system32\drivers\vmmouse.sys [04/07/2010 21:34 11440]

.

Contenu du dossier 'Tâches planifiées'

.

2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 10:32]

.

2012-07-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1060284298-1767777339-682003330-500Core.job

- c:\documents and settings\Administrateur\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-03-29 19:34]

.

2012-07-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1060284298-1767777339-682003330-500UA.job

- c:\documents and settings\Administrateur\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2012-03-29 19:34]

.

2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-11 14:14]

.

2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-11 14:14]

.

.

------- Examen supplémentaire -------

.

uInternet Settings,ProxyOverride = localhost; 127.0.0.1; <local>

LSP: %SystemRoot%\system32\vsocklib.dll

TCP: Interfaces\{8893C352-9052-4237-A2AA-6362A73D571C}: NameServer = 192.168.189.2

TCP: Interfaces\{D6669880-60E3-41AF-8662-D04B7950A422}: NameServer = 212.27.40.241,212.27.40.242

FF - ProfilePath - c:\documents and settings\lgkticu\Application Data\Mozilla\Firefox\Profiles\ty0mdozw.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: network.proxy.socks - 127.0.0.1

FF - prefs.js: network.proxy.socks_port - 9050

FF - prefs.js: network.proxy.type - 1

.

- - - - ORPHELINS SUPPRIMES - - - -

.

HKU-Default-RunOnce-tscuninstall - c:\windows\system32\tscupgrd.exe

MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe

AddRemove-Look@LAN_1.0 - c:\windows\iun6002.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-07-02 18:21

Windows 5.1.2600 Service Pack 3 NTFS

.

Recherche de processus cachés ...

.

Recherche d'éléments en démarrage automatique cachés ...

.

Recherche de fichiers cachés ...

.

Scan terminé avec succès

Fichiers cachés: 0

.

**************************************************************************

.

--------------------- DLLs chargées dans les processus actifs ---------------------

.

- - - - - - - > 'winlogon.exe'(912)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\System32\vmhgfs.dll

.

Heure de fin: 2012-07-02 18:29:11

ComboFix-quarantined-files.txt 2012-07-02 16:29

.

Avant-CF: 799 494 144 octets libres

Après-CF: 1 128 738 816 octets libres

.

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

.

- - End Of File - - 621BE89045769E477B5729F1513F5399