apres post antivir

hop · le 16 février 2006

Je vous joint également le log antivir. Y en avait un paquet...

Report file date: jeudi 16 février 2006 12:04

Jobname: 'ShlExt'

Scanning for 313939 virus strains and unwanted programs.

Licensed to: AntiVir PersonalEdition Classic

Serialnumber: 0000149996-WURGE-0001

Platform: Windows XP

Windowsversion: () [5.1.2600]

Username: Mathieu1

Computername: MATTHIEU

Versioninformations:

AVSCAN.EXE : 7.0.0.21 528424 13/02/2006 11:46:48

AVSCAN.DLL : 7.0.0.21 42536 13/02/2006 11:46:48

LUKE.DLL : 7.0.0.21 114728 13/02/2006 11:46:48

LUKERES.DLL : 7.0.0.21 27688 13/02/2006 11:46:48

ANTIVIR0.VDF : 6.32.0.60 4323840 06/12/2005 10:47:34

ANTIVIR1.VDF : 6.33.0.207 1160192 13/02/2006 11:46:49

ANTIVIR2.VDF : 6.33.0.234 97280 15/02/2006 11:36:34

ANTIVIR3.VDF : 6.33.0.238 14336 15/02/2006 11:36:34

AVEWIN32.DLL : 6.33.0.36 1163776 13/02/2006 11:46:49

AVPREF.DLL : 6.34.0.0 38440 18/01/2006 12:06:02

AVREP.DLL : 6.33.0.222 2379816 13/02/2006 11:46:49

AVPACK32.DLL : 6.33.0.6 331816 09/01/2006 09:03:38

AVREG.DLL : 6.31.0.90 27688 28/07/2005 10:06:36

NETNT.DLL : 6.32.0.0 6696 27/09/2005 07:56:50

NETNW.DLL : 6.32.0.0 9768 27/09/2005 07:56:50

Start of the scan: jeudi 16 février 2006 12:04

Start scanning boot sectors:

Boot sector 'C:'

[NOTE] No virus was found!

Starting the file scan:

C:\WINNT\system32\auditchk.exe

[DETECTION] Contains suspicious code HEURISTIC/Malware.Modified

[iNFO] The file was moved to '44585cd8.qua'!

C:\WINNT\system32\exploirer.exe

[DETECTION] Contains signature of the worm WORM/RBo.190464.2.1

[iNFO] The file was moved to '44645cf3.qua'!

C:\WINNT\system32\msdirectx.sys

[DETECTION] Contains signature of the SPR/FURootkit program

[iNFO] The file was moved to '44585cff.qua'!

C:\WINNT\system32\netddesrv.exe

[DETECTION] Contains a signature of the (dangerous) backdoor program BDS/CodBot.AT Backdoor server programs

[iNFO] The file was moved to '44685cfe.qua'!

C:\WINNT\system32\spoolsvc.exe

[DETECTION] Contains signature of the worm WORM/Rbot.82944.9

[WARNING] The file could not be deleted!

C:\WINNT\system32\svho0st98.exe

[DETECTION] Contains a signature of the (dangerous) backdoor program BDS/CodBot.AT Backdoor server programs

[WARNING] The file could not be deleted!

C:\WINNT\system32\TFTP1144

[DETECTION] Contains signature of the worm WORM/Rbot.82944.9

[iNFO] The file was moved to '44485d0a.qua'!

C:\WINNT\system32\TFTP2044

[DETECTION] Contains signature of the worm WORM/Rbot.82944.9

[iNFO] The file was moved to '44485d0c.qua'!

C:\WINNT\system32\TFTP3196

[DETECTION] Contains suspicious code HEURISTIC/Backdoor.Generic

[iNFO] The file was moved to '44485d0e.qua'!

C:\WINNT\system32\TFTP3348

[DETECTION] Contains suspicious code HEURISTIC/Backdoor.Generic

[iNFO] The file was moved to '44485d11.qua'!

C:\WINNT\system32\TFTP860

[DETECTION] Contains signature of the worm WORM/Rbot.82944.9

[iNFO] The file was moved to '44485d13.qua'!

C:\WINNT\system32\config\default