Virus protector - Page 2

RAPPORT aadmvrqas.exe

Fichier aadmvrqas.exe reçu le 2010.03.18 02:28:38 (UTC)
Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.50 2010.03.18 Trojan.Win32.SuspectCRC!IK
AhnLab-V3 5.0.0.2 2010.03.17 -
AntiVir 8.2.1.194 2010.03.17 TR/FakeMagic.A.5
Antiy-AVL 2.0.3.7 2010.03.17 -
Authentium 5.2.0.5 2010.03.18 -
Avast 4.8.1351.0 2010.03.17 -
Avast5 5.0.332.0 2010.03.17 -
AVG 9.0.0.787 2010.03.17 SHeur3.CTH
BitDefender 7.2 2010.03.18 -
CAT-QuickHeal 10.00 2010.03.17 -
ClamAV 0.96.0.0-git 2010.03.18 -
Comodo 4301 2010.03.18 -
DrWeb 5.0.1.12222 2010.03.18 Trojan.Fakealert.13764
eSafe 7.0.17.0 2010.03.17 -
eTrust-Vet 35.2.7371 2010.03.17 -
F-Prot 4.5.1.85 2010.03.17 -
F-Secure 9.0.15370.0 2010.03.18 -
Fortinet 4.0.14.0 2010.03.15 -
GData 19 2010.03.18 -
Ikarus T3.1.1.80.0 2010.03.18 Trojan.Win32.SuspectCRC
Jiangmin 13.0.900 2010.03.17 -
K7AntiVirus 7.10.1000 2010.03.17 -
Kaspersky 7.0.0.125 2010.03.17 -
McAfee 5923 2010.03.17 -
McAfee+Artemis 5923 2010.03.17 -
McAfee-GW-Edition 6.8.5 2010.03.17 Trojan.FakeMagic.A.5
Microsoft 1.5605 2010.03.17 Trojan:Win32/FakeMagic
NOD32 4953 2010.03.17 a variant of Win32/Kryptik.CYZ
Norman 6.04.08 2010.03.17 -
nProtect 2009.1.8.0 2010.03.17 -
Panda 10.0.2.2 2010.03.17 -
PCTools 7.0.3.5 2010.03.18 -
Prevx 3.0 2010.03.18 -
Rising 22.39.03.01 2010.03.18 -
Sophos 4.51.0 2010.03.18 -
Sunbelt 5945 2010.03.18 Trojan.Win32.Generic!SB.0
Symantec 20091.2.0.41 2010.03.18 Suspicious.Insight
TheHacker 6.5.2.0.236 2010.03.17 Trojan/Kryptik.cyz
TrendMicro 9.120.0.1004 2010.03.18 -
VBA32 3.12.12.2 2010.03.17 -
ViRobot 2010.3.17.2232 2010.03.17 -
VirusBuster 5.0.27.0 2010.03.17 -

Information additionnelle
File size: 1471488 bytes
MD5...: 2de28b05c1d8196f0aeca63de43a8667
SHA1..: 79609d65d3ce66d5cef2656f7856c7deee55fe09
SHA256: dc4ce80bfc64196b508f6a813fac8cec8052bcb12eee4a4af4c08016f1f3ec9e
ssdeep: 24576:Lx8bEsE+HMbLAPZ1wQftekVSHKksU2w9c/K7uxvkF9TIlien0qr:LmVLc0<BR>h1BFzAKXw9+xS9TIH7r<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x1000<BR>timedatestamp.....: 0x42316426 (Fri Mar 11 09:25:58 2005)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 5 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x155000 0x154600 8.00 48c3a670e88726301645809204ab1c5d<BR>.rdata 0x156000 0xc000 0xbc00 7.61 adb6b04c1859327dfd38853f33c181f3<BR>.data 0x162000 0xea000 0x2600 7.93 61266ef390ca5ba1c0b47493745682b7<BR>.idata 0x24c000 0x1000 0xa00 4.63 824e95152f6c5aa347e58aa700766f8f<BR>.rsrc 0x24d000 0x4000 0x3e00 4.38 e020776af0ebb38bf05387d846c21eec<BR><BR>( 6 imports ) <BR>> KERNEL32.dll: CloseHandle, CreateDirectoryA, EnumResourceNamesA, ExitProcess, GetCommandLineA, GetFileSize, GetModuleHandleA, GetStartupInfoA, HeapAlloc, LoadResource, MultiByteToWideChar, QueryPerformanceCounter, RemoveDirectoryA, RtlUnwind, SetLastError, SetUnhandledExceptionFilter, SleepEx, VirtualAlloc<BR>> user32.dll: EndPaint, EmptyClipboard, GetDlgItem, CharUpperBuffA, CharToOemBuffA, GetWindowTextA, MessageBoxA, SetFocus, SetMenuInfo, ShowCaret, DrawMenuBar<BR>> advapi32.dll: RegOpenKeyExA, RegLoadKeyA, RegEnumKeyA, RegCloseKey, RegQueryValueA<BR>> ole32.dll: OleInitialize, OleGetClipboard, OleUninitialize, CreateILockBytesOnHGlobal, CoUninitialize, CoRegisterClassObject, RegisterDragDrop, ReleaseStgMedium, StringFromGUID2, WriteClassStg, DoDragDrop, CLSIDFromString, CoCreateInstance, CoGetClassObject, CoInitialize<BR>> wininet.dll: InternetGetCookieA, InternetGetLastResponseInfoA, InternetQueryDataAvailable, InternetSetFilePointer, InternetSetOptionExA, InternetSetStatusCallbackA, InternetCrackUrlA, InternetConnectA, HttpSendRequestA, HttpQueryInfoA, HttpOpenRequestA, HttpAddRequestHeadersA, InternetCloseHandle<BR>> shell32.dll: SHGetFileInfoA, SHGetMalloc, SHGetPathFromIDListA, ShellExecuteA, ShellExecuteExW, SHGetDesktopFolder<BR><BR>( 0 exports ) <BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -
trid..: Generic Win/DOS Executable (49.9%)<BR>DOS Executable Generic (49.8%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:<BR>publisher....: Westwood Studios<BR>copyright....: Copyright (c) 2000 Westwood Studios<BR>product......: Command _ Conquer : Tiberian Sun<BR>description..: Main executable for Tiberian Sun<BR>original name: Sun.exe<BR>internal name: Sun<BR>file version.: 2.03<BR>comments.....: <BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>

Rapport aiXDKcoJh.dll

Fichier aiXDKcoJh.dll reçu le 2010.03.18 02:33:52 (UTC)
Antivirus Version Dernière mise à jour Résultat

a-squared 4.5.0.50 2010.03.18 Trojan.Win32.SuspectCRC!IK
AhnLab-V3 5.0.0.2 2010.03.18 -
AntiVir 8.2.1.194 2010.03.17 TR/FakeMagic.A.5
Antiy-AVL 2.0.3.7 2010.03.17 -
Authentium 5.2.0.5 2010.03.18 -
Avast 4.8.1351.0 2010.03.17 Win32:Trojan-gen
Avast5 5.0.332.0 2010.03.17 Win32:Trojan-gen
AVG 9.0.0.787 2010.03.17 SHeur3.CTH
BitDefender 7.2 2010.03.18 -
CAT-QuickHeal 10.00 2010.03.17 -
ClamAV 0.96.0.0-git 2010.03.18 -
Comodo 4301 2010.03.18 -
DrWeb 5.0.1.12222 2010.03.18 Trojan.Fakealert.13764
eSafe 7.0.17.0 2010.03.17 -
eTrust-Vet 35.2.7371 2010.03.17 -
F-Prot 4.5.1.85 2010.03.17 -
F-Secure 9.0.15370.0 2010.03.18 -
Fortinet 4.0.14.0 2010.03.15 -
GData 19 2010.03.18 Win32:Trojan-gen
Ikarus T3.1.1.80.0 2010.03.18 Trojan.Win32.SuspectCRC
Jiangmin 13.0.900 2010.03.17 -
K7AntiVirus 7.10.1000 2010.03.17 -
Kaspersky 7.0.0.125 2010.03.17 -
McAfee 5923 2010.03.17 -
McAfee+Artemis 5923 2010.03.17 -
McAfee-GW-Edition 6.8.5 2010.03.17 Trojan.FakeMagic.A.5
Microsoft 1.5605 2010.03.17 Trojan:Win32/FakeMagic
NOD32 4953 2010.03.17 a variant of Win32/Kryptik.CYZ
Norman 6.04.08 2010.03.17 -
nProtect 2009.1.8.0 2010.03.17 -
Panda 10.0.2.2 2010.03.17 -
PCTools 7.0.3.5 2010.03.18 -
Prevx 3.0 2010.03.18 -
Rising 22.39.03.01 2010.03.18 -
Sophos 4.51.0 2010.03.18 -
Sunbelt 5945 2010.03.18 Trojan.Win32.Generic!SB.0
Symantec 20091.2.0.41 2010.03.18 Suspicious.Insight
TheHacker 6.5.2.0.236 2010.03.17 Trojan/Kryptik.cyz
TrendMicro 9.120.0.1004 2010.03.18 -
VBA32 3.12.12.2 2010.03.17 -
ViRobot 2010.3.17.2232 2010.03.17 -
VirusBuster 5.0.27.0 2010.03.17 -

Information additionnelle
File size: 1471488 bytes
MD5...: 2551f1e47e06584eec0b28e3598dc02f
SHA1..: 9fbf72c45ee941a0f3ca6325553193d41790aa43
SHA256: 2a04255b600b394bfbc82afd01935344244348e5be414b5570a6a981d2d2aacf
ssdeep: 24576:rx8bEsE+HMbLAPZ1wQftekVSHKksU2w9c/K7uxvkF9TIlien0qr:rmVLc0<BR>h1BFzAKXw9+xS9TIH7r<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x1000<BR>timedatestamp.....: 0x42316426 (Fri Mar 11 09:25:58 2005)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 5 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x155000 0x154600 8.00 48c3a670e88726301645809204ab1c5d<BR>.rdata 0x156000 0xc000 0xbc00 7.61 adb6b04c1859327dfd38853f33c181f3<BR>.data 0x162000 0xea000 0x2600 7.93 61266ef390ca5ba1c0b47493745682b7<BR>.idata 0x24c000 0x1000 0xa00 4.63 824e95152f6c5aa347e58aa700766f8f<BR>.rsrc 0x24d000 0x4000 0x3e00 4.38 e020776af0ebb38bf05387d846c21eec<BR><BR>( 6 imports ) <BR>> KERNEL32.dll: CloseHandle, CreateDirectoryA, EnumResourceNamesA, ExitProcess, GetCommandLineA, GetFileSize, GetModuleHandleA, GetStartupInfoA, HeapAlloc, LoadResource, MultiByteToWideChar, QueryPerformanceCounter, RemoveDirectoryA, RtlUnwind, SetLastError, SetUnhandledExceptionFilter, SleepEx, VirtualAlloc<BR>> user32.dll: EndPaint, EmptyClipboard, GetDlgItem, CharUpperBuffA, CharToOemBuffA, GetWindowTextA, MessageBoxA, SetFocus, SetMenuInfo, ShowCaret, DrawMenuBar<BR>> advapi32.dll: RegOpenKeyExA, RegLoadKeyA, RegEnumKeyA, RegCloseKey, RegQueryValueA<BR>> ole32.dll: OleInitialize, OleGetClipboard, OleUninitialize, CreateILockBytesOnHGlobal, CoUninitialize, CoRegisterClassObject, RegisterDragDrop, ReleaseStgMedium, StringFromGUID2, WriteClassStg, DoDragDrop, CLSIDFromString, CoCreateInstance, CoGetClassObject, CoInitialize<BR>> wininet.dll: InternetGetCookieA, InternetGetLastResponseInfoA, InternetQueryDataAvailable, InternetSetFilePointer, InternetSetOptionExA, InternetSetStatusCallbackA, InternetCrackUrlA, InternetConnectA, HttpSendRequestA, HttpQueryInfoA, HttpOpenRequestA, HttpAddRequestHeadersA, InternetCloseHandle<BR>> shell32.dll: SHGetFileInfoA, SHGetMalloc, SHGetPathFromIDListA, ShellExecuteA, ShellExecuteExW, SHGetDesktopFolder<BR><BR>( 0 exports ) <BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -sigcheck:<BR>publisher....: Westwood Studios<BR>copyright....: Copyright (c) 2000 Westwood Studios<BR>product......: Command _ Conquer : Tiberian Sun<BR>description..: Main executable for Tiberian Sun<BR>original name: Sun.exe<BR>internal name: Sun<BR>file version.: 2.03<BR>comments.....: <BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
trid..: Generic Win/DOS Executable (49.9%)<BR>DOS Executable Generic (49.8%)<BR>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

ok

je demande une validation de script de suppression de ces deux fichiers infectés et je te poste ca

Alors?
Des news?

Sinon,quel antivirus prendre?

oups...avec la nouvelle version CCM, je t'ai un peu zappé
désolé

donc

/!\ ATTENTION /!\ Le script qui suit a été écrit spécialement pour Marvolo, il n'est pas transposable sur un autre ordinateur !

crées un sur ton bureau un nouveau fichier bloc note que tu nommeras CFScrip.txt
Copies y ce texte dedans et enregistres le

KillAll::

File::
C:\Windows\system32\aiXDKcoJh.dll
C:\Windows\system32\aadmvrqas.exe

* Désactive tes logiciels de protection
* Fais un glisser/déposer de ce fichier CFScript.txt sur le fichier Combofix.exe (comme le lien suivant)
http://apu.mabul.org/up/apu/2008/09/06/img-2258535my8h.gif

* Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt


Je cherche beaucoup...et maintenant je trouve !
(sourire)

ok

la suppression s'est bien passée

le pc va t il toujour bien ?

relances RSIT et postes le rapport log stp que l'on finalise ton affaire