A voir également:
- Tr/fakeAV.DH.15104 trojan
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Trojan al11 ✓ - Forum Virus
- Aide pour un virus ✓ - Forum Virus
- Trojan b901 system32 win config 34 ✓ - Forum Virus
- Trojan impossible à supprimer! ✓ - Forum Virus
72 réponses
http://www.virustotal.com/fr/analisis/ae9f2a32d0065a0df5eb093889fc319c753765094e986bd5c7aee3945252ddde-1274115007
http://www.virustotal.com/fr/analisis/49b1fea9fa8794a88468718f4409d196822bb61e2e3dcbfe84c12df72739efd1-1274115709
http://www.virustotal.com/fr/analisis/23228b04123d4ac4ee62a8d818f087735aeb7de7f147bb5438663715fc030782-1274115630
http://www.virustotal.com/fr/analisis/23228b04123d4ac4ee62a8d818f087735aeb7de7f147bb5438663715fc030782-1274115630
Ok,
Téléchargez Gmer. (Przemyslaw Gmerek) sur votre bureau.
--> Dézippez-le dans un dossier dédié ou sur votre Bureau.
--> Déconnectez vous d'Internet puis fermez tous les programmes.
--> Double-cliquez sur Gmer.exe (ou clic droit > "Exécuter en tant qu'administrateur" pour Vista).
--> Cliquez sur l'onglet "Rootkit".
--> A droite, cochez seulement Files, Services & Registry.
--> Cliquez maintenant sur "Scan".
* sur ces lignes rouges:
o Services: Clique droit puis delete service
o Process: Clique droit puis kill process
o Adl, file: Clique droit puis delete files
--> Lorsque le scan est terminé, cliquez sur "Copy".
--> Ouvrez le Bloc-notes puis cliquez sur le Menu Édition / Coller.
--> Le rapport doit alors apparaitre.
=> Colle le dans ta prochaine réponse.
Téléchargez Gmer. (Przemyslaw Gmerek) sur votre bureau.
--> Dézippez-le dans un dossier dédié ou sur votre Bureau.
--> Déconnectez vous d'Internet puis fermez tous les programmes.
--> Double-cliquez sur Gmer.exe (ou clic droit > "Exécuter en tant qu'administrateur" pour Vista).
--> Cliquez sur l'onglet "Rootkit".
--> A droite, cochez seulement Files, Services & Registry.
--> Cliquez maintenant sur "Scan".
* sur ces lignes rouges:
o Services: Clique droit puis delete service
o Process: Clique droit puis kill process
o Adl, file: Clique droit puis delete files
--> Lorsque le scan est terminé, cliquez sur "Copy".
--> Ouvrez le Bloc-notes puis cliquez sur le Menu Édition / Coller.
--> Le rapport doit alors apparaitre.
=> Colle le dans ta prochaine réponse.
pas de lignes rouges nulle part par contre ...
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-18 14:24:21
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\uwayaaod.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7C 0x73 0x06 0x4D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1B 0x4C 0xC9 0xD6 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x8B 0xBB 0x19 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF8 0x4C 0x29 0x71 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0x6F 0xA5 0x9A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7C 0x73 0x06 0x4D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1B 0x4C 0xC9 0xD6 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x8B 0xBB 0x19 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF8 0x4C 0x29 0x71 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0x6F 0xA5 0x9A ...
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-18 14:24:21
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\uwayaaod.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7C 0x73 0x06 0x4D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1B 0x4C 0xC9 0xD6 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x8B 0xBB 0x19 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF8 0x4C 0x29 0x71 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0x6F 0xA5 0x9A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x7C 0x73 0x06 0x4D ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1B 0x4C 0xC9 0xD6 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA3 0x8B 0xBB 0x19 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF8 0x4C 0x29 0x71 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x8E 0x6F 0xA5 0x9A ...
---- EOF - GMER 1.0.15 ----
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
salut
-> Lance ZHPfix soit par le raccourci présent sur ton bureau ou via ZHPdiag ( dans ce cas clique sur le bouclier vert ) en faisant clic doirt -> Exécuter en tant qu'administrateur
-> Clique sur le H bleu ( "coller les lignes Helper" )
-> Copie ceci
O64 - Services: CurCS - (.not file.) - dbustrcm (dbustrcm) .(.Pas de propriétaire - Pas de description.) - LEGACY_DBUSTRCM
O69 - SBI: prefs.js [Propriétaire - 243gqwwv.default] user_pref("extensions.snipit.askTbInstalled", true);
-> Colle le dans ZHPfix
-> Clique sur [ OK ] puis sur [ TOUS ] et enfin sur [ NETTOYER ]
-> copie et colle le rapport de ZHPfix
========================
Fait un examen complet avec MBAM en oubliant pas de le mettre à jour. Puis poste le rapport.
++
-> Lance ZHPfix soit par le raccourci présent sur ton bureau ou via ZHPdiag ( dans ce cas clique sur le bouclier vert ) en faisant clic doirt -> Exécuter en tant qu'administrateur
-> Clique sur le H bleu ( "coller les lignes Helper" )
-> Copie ceci
O64 - Services: CurCS - (.not file.) - dbustrcm (dbustrcm) .(.Pas de propriétaire - Pas de description.) - LEGACY_DBUSTRCM
O69 - SBI: prefs.js [Propriétaire - 243gqwwv.default] user_pref("extensions.snipit.askTbInstalled", true);
-> Colle le dans ZHPfix
-> Clique sur [ OK ] puis sur [ TOUS ] et enfin sur [ NETTOYER ]
-> copie et colle le rapport de ZHPfix
========================
Fait un examen complet avec MBAM en oubliant pas de le mettre à jour. Puis poste le rapport.
++
ZHPFix v1.12.31 by Nicolas Coolman - Rapport de suppression du 18/05/2010 18:34:26
Fichier d'export Registre : C:\ZHPExportRegistry-18-05-2010-18-34-26.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr
Processus mémoire :
(Néant)
Module mémoire :
Clé du Registre :
O64 - Services: CurCS - (.not file.) - dbustrcm (dbustrcm) .(.Pas de propriétaire - Pas de description.) - LEGACY_DBUSTRCM => Clé supprimée avec succès
Valeur du Registre :
Elément de données du Registre :
Préférences navigateur :
Dossier :
Fichier :
Logiciel :
Script Registre :
Master Boot Record :
Autre :
http://www.cijoint.fr/cjlink.php?file=cj201005/cijPDs6nmq.txt => Format Non supporté
Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 1
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Master Boot Record : 0
Préférences navigateur : 0
Autre : 1
End of the scan
Fichier d'export Registre : C:\ZHPExportRegistry-18-05-2010-18-34-26.txt
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr
Processus mémoire :
(Néant)
Module mémoire :
Clé du Registre :
O64 - Services: CurCS - (.not file.) - dbustrcm (dbustrcm) .(.Pas de propriétaire - Pas de description.) - LEGACY_DBUSTRCM => Clé supprimée avec succès
Valeur du Registre :
Elément de données du Registre :
Préférences navigateur :
Dossier :
Fichier :
Logiciel :
Script Registre :
Master Boot Record :
Autre :
http://www.cijoint.fr/cjlink.php?file=cj201005/cijPDs6nmq.txt => Format Non supporté
Récapitulatif :
Processus mémoire : 0
Module mémoire : 0
Clé du Registre : 1
Valeur du Registre : 0
Elément de données du Registre : 0
Dossier : 0
Fichier : 0
Logiciel : 0
Master Boot Record : 0
Préférences navigateur : 0
Autre : 1
End of the scan
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4112
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
19/05/2010 11:06:18
mbam-log-2010-05-19 (11-06-18).txt
Type d'examen: Examen complet (C:\|E:\|)
Elément(s) analysé(s): 202578
Temps écoulé: 16 heure(s), 30 minute(s), 0 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
www.malwarebytes.org
Version de la base de données: 4112
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
19/05/2010 11:06:18
mbam-log-2010-05-19 (11-06-18).txt
Type d'examen: Examen complet (C:\|E:\|)
Elément(s) analysé(s): 202578
Temps écoulé: 16 heure(s), 30 minute(s), 0 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
(Aucun élément nuisible détecté)
j'ai de nouvelles alertes avira qui detecte des trojans encore mais plus le meme cette fois c'est TR/patched
Voici le dernier rapport Avira
Avira AntiVir Personal
Report file date: mercredi 19 mai 2010 12:02
Scanning for 2132879 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : KLIENT-E124487A
Version information:
BUILD.DAT : 9.0.0.422 21701 Bytes 09/03/2010 10:29:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 23/12/2009 16:42:03
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 09:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 19:18:11
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 19:18:13
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/01/2010 14:48:27
VBASE003.VDF : 7.10.3.75 996864 Bytes 26/01/2010 16:21:19
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05/03/2010 20:27:09
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/04/2010 06:28:48
VBASE006.VDF : 7.10.6.83 2048 Bytes 15/04/2010 06:28:48
VBASE007.VDF : 7.10.6.84 2048 Bytes 15/04/2010 06:28:48
VBASE008.VDF : 7.10.6.85 2048 Bytes 15/04/2010 06:28:49
VBASE009.VDF : 7.10.6.86 2048 Bytes 15/04/2010 06:28:49
VBASE010.VDF : 7.10.6.87 2048 Bytes 15/04/2010 06:28:49
VBASE011.VDF : 7.10.6.88 2048 Bytes 15/04/2010 06:28:49
VBASE012.VDF : 7.10.6.89 2048 Bytes 15/04/2010 06:28:49
VBASE013.VDF : 7.10.6.90 2048 Bytes 15/04/2010 06:28:49
VBASE014.VDF : 7.10.6.123 126464 Bytes 19/04/2010 06:20:54
VBASE015.VDF : 7.10.6.152 123392 Bytes 21/04/2010 06:21:10
VBASE016.VDF : 7.10.6.178 122880 Bytes 22/04/2010 13:01:43
VBASE017.VDF : 7.10.6.206 120320 Bytes 26/04/2010 15:53:31
VBASE018.VDF : 7.10.6.232 99328 Bytes 28/04/2010 15:53:34
VBASE019.VDF : 7.10.7.2 155648 Bytes 30/04/2010 15:53:38
VBASE020.VDF : 7.10.7.26 119808 Bytes 04/05/2010 15:53:48
VBASE021.VDF : 7.10.7.51 118272 Bytes 06/05/2010 15:53:39
VBASE022.VDF : 7.10.7.75 404992 Bytes 10/05/2010 15:54:00
VBASE023.VDF : 7.10.7.100 125440 Bytes 13/05/2010 19:22:08
VBASE024.VDF : 7.10.7.119 177664 Bytes 17/05/2010 19:22:13
VBASE025.VDF : 7.10.7.120 2048 Bytes 17/05/2010 19:22:13
VBASE026.VDF : 7.10.7.121 2048 Bytes 17/05/2010 19:22:13
VBASE027.VDF : 7.10.7.122 2048 Bytes 17/05/2010 19:22:13
VBASE028.VDF : 7.10.7.123 2048 Bytes 17/05/2010 19:22:13
VBASE029.VDF : 7.10.7.124 2048 Bytes 17/05/2010 19:22:13
VBASE030.VDF : 7.10.7.125 2048 Bytes 17/05/2010 19:22:13
VBASE031.VDF : 7.10.7.130 70656 Bytes 18/05/2010 19:22:13
Engineversion : 8.2.1.242
AEVDF.DLL : 8.1.2.0 106868 Bytes 24/04/2010 13:01:46
AESCRIPT.DLL : 8.1.3.29 1343866 Bytes 14/05/2010 19:22:12
AESCN.DLL : 8.1.6.1 127347 Bytes 14/05/2010 19:22:11
AESBX.DLL : 8.1.3.1 254324 Bytes 24/04/2010 13:01:46
AERDL.DLL : 8.1.4.6 541043 Bytes 16/04/2010 06:29:06
AEPACK.DLL : 8.2.1.1 426358 Bytes 19/03/2010 20:00:54
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 14/05/2010 19:22:10
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 05/05/2010 15:53:44
AEHELP.DLL : 8.1.11.3 242039 Bytes 02/04/2010 06:20:28
AEGEN.DLL : 8.1.3.9 377203 Bytes 14/05/2010 19:22:10
AEEMU.DLL : 8.1.2.0 393588 Bytes 24/04/2010 13:01:44
AECORE.DLL : 8.1.15.3 192886 Bytes 14/05/2010 19:22:09
AEBB.DLL : 8.1.1.0 53618 Bytes 24/04/2010 13:01:44
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 23/12/2009 16:42:03
AVREP.DLL : 8.0.0.7 159784 Bytes 17/02/2010 20:00:19
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 14:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 23/12/2009 16:42:03
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,
Start of the scan: mercredi 19 mai 2010 12:02
Starting search for hidden objects.
'63927' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'hpqgpc01.exe' - '1' Module(s) have been scanned
Scan process 'hpqbam08.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '56' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\sfvfs02.sys.vir
[DETECTION] Is the TR/Patched.Gen Trojan
C:\System Volume Information\_restore{DB006B39-8110-49B6-A12E-31261A17778B}\RP19\A0003247.sys
[DETECTION] Is the TR/Patched.Gen Trojan
Begin scan in 'E:\'
Beginning disinfection:
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\sfvfs02.sys.vir
[DETECTION] Is the TR/Patched.Gen Trojan
[NOTE] The file was moved to '4c69be27.qua'!
C:\System Volume Information\_restore{DB006B39-8110-49B6-A12E-31261A17778B}\RP19\A0003247.sys
[DETECTION] Is the TR/Patched.Gen Trojan
[NOTE] The file was moved to '4c23bdf1.qua'!
End of the scan: mercredi 19 mai 2010 12:30
Used time: 27:04 Minute(s)
The scan has been done completely.
10567 Scanned directories
314093 Files were scanned
2 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
2 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
314090 Files not concerned
2579 Archives were scanned
1 Warnings
3 Notes
63927 Objects were scanned with rootkit scan
0 Hidden objects were found
Avira AntiVir Personal
Report file date: mercredi 19 mai 2010 12:02
Scanning for 2132879 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : KLIENT-E124487A
Version information:
BUILD.DAT : 9.0.0.422 21701 Bytes 09/03/2010 10:29:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 23/12/2009 16:42:03
AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 09:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 09:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 19:18:11
VBASE001.VDF : 7.10.1.0 1372672 Bytes 19/11/2009 19:18:13
VBASE002.VDF : 7.10.3.1 3143680 Bytes 20/01/2010 14:48:27
VBASE003.VDF : 7.10.3.75 996864 Bytes 26/01/2010 16:21:19
VBASE004.VDF : 7.10.4.203 1579008 Bytes 05/03/2010 20:27:09
VBASE005.VDF : 7.10.6.82 2494464 Bytes 15/04/2010 06:28:48
VBASE006.VDF : 7.10.6.83 2048 Bytes 15/04/2010 06:28:48
VBASE007.VDF : 7.10.6.84 2048 Bytes 15/04/2010 06:28:48
VBASE008.VDF : 7.10.6.85 2048 Bytes 15/04/2010 06:28:49
VBASE009.VDF : 7.10.6.86 2048 Bytes 15/04/2010 06:28:49
VBASE010.VDF : 7.10.6.87 2048 Bytes 15/04/2010 06:28:49
VBASE011.VDF : 7.10.6.88 2048 Bytes 15/04/2010 06:28:49
VBASE012.VDF : 7.10.6.89 2048 Bytes 15/04/2010 06:28:49
VBASE013.VDF : 7.10.6.90 2048 Bytes 15/04/2010 06:28:49
VBASE014.VDF : 7.10.6.123 126464 Bytes 19/04/2010 06:20:54
VBASE015.VDF : 7.10.6.152 123392 Bytes 21/04/2010 06:21:10
VBASE016.VDF : 7.10.6.178 122880 Bytes 22/04/2010 13:01:43
VBASE017.VDF : 7.10.6.206 120320 Bytes 26/04/2010 15:53:31
VBASE018.VDF : 7.10.6.232 99328 Bytes 28/04/2010 15:53:34
VBASE019.VDF : 7.10.7.2 155648 Bytes 30/04/2010 15:53:38
VBASE020.VDF : 7.10.7.26 119808 Bytes 04/05/2010 15:53:48
VBASE021.VDF : 7.10.7.51 118272 Bytes 06/05/2010 15:53:39
VBASE022.VDF : 7.10.7.75 404992 Bytes 10/05/2010 15:54:00
VBASE023.VDF : 7.10.7.100 125440 Bytes 13/05/2010 19:22:08
VBASE024.VDF : 7.10.7.119 177664 Bytes 17/05/2010 19:22:13
VBASE025.VDF : 7.10.7.120 2048 Bytes 17/05/2010 19:22:13
VBASE026.VDF : 7.10.7.121 2048 Bytes 17/05/2010 19:22:13
VBASE027.VDF : 7.10.7.122 2048 Bytes 17/05/2010 19:22:13
VBASE028.VDF : 7.10.7.123 2048 Bytes 17/05/2010 19:22:13
VBASE029.VDF : 7.10.7.124 2048 Bytes 17/05/2010 19:22:13
VBASE030.VDF : 7.10.7.125 2048 Bytes 17/05/2010 19:22:13
VBASE031.VDF : 7.10.7.130 70656 Bytes 18/05/2010 19:22:13
Engineversion : 8.2.1.242
AEVDF.DLL : 8.1.2.0 106868 Bytes 24/04/2010 13:01:46
AESCRIPT.DLL : 8.1.3.29 1343866 Bytes 14/05/2010 19:22:12
AESCN.DLL : 8.1.6.1 127347 Bytes 14/05/2010 19:22:11
AESBX.DLL : 8.1.3.1 254324 Bytes 24/04/2010 13:01:46
AERDL.DLL : 8.1.4.6 541043 Bytes 16/04/2010 06:29:06
AEPACK.DLL : 8.2.1.1 426358 Bytes 19/03/2010 20:00:54
AEOFFICE.DLL : 8.1.1.0 201081 Bytes 14/05/2010 19:22:10
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 05/05/2010 15:53:44
AEHELP.DLL : 8.1.11.3 242039 Bytes 02/04/2010 06:20:28
AEGEN.DLL : 8.1.3.9 377203 Bytes 14/05/2010 19:22:10
AEEMU.DLL : 8.1.2.0 393588 Bytes 24/04/2010 13:01:44
AECORE.DLL : 8.1.15.3 192886 Bytes 14/05/2010 19:22:09
AEBB.DLL : 8.1.1.0 53618 Bytes 24/04/2010 13:01:44
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 23/12/2009 16:42:03
AVREP.DLL : 8.0.0.7 159784 Bytes 17/02/2010 20:00:19
AVREG.DLL : 9.0.0.0 36609 Bytes 05/12/2008 09:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 05/12/2008 09:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 14:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 23/12/2009 16:42:03
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, E:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,
Start of the scan: mercredi 19 mai 2010 12:02
Starting search for hidden objects.
'63927' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'hpqgpc01.exe' - '1' Module(s) have been scanned
Scan process 'hpqbam08.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'ISUSPM.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'mdm.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '56' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\sfvfs02.sys.vir
[DETECTION] Is the TR/Patched.Gen Trojan
C:\System Volume Information\_restore{DB006B39-8110-49B6-A12E-31261A17778B}\RP19\A0003247.sys
[DETECTION] Is the TR/Patched.Gen Trojan
Begin scan in 'E:\'
Beginning disinfection:
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\sfvfs02.sys.vir
[DETECTION] Is the TR/Patched.Gen Trojan
[NOTE] The file was moved to '4c69be27.qua'!
C:\System Volume Information\_restore{DB006B39-8110-49B6-A12E-31261A17778B}\RP19\A0003247.sys
[DETECTION] Is the TR/Patched.Gen Trojan
[NOTE] The file was moved to '4c23bdf1.qua'!
End of the scan: mercredi 19 mai 2010 12:30
Used time: 27:04 Minute(s)
The scan has been done completely.
10567 Scanned directories
314093 Files were scanned
2 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
2 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
314090 Files not concerned
2579 Archives were scanned
1 Warnings
3 Notes
63927 Objects were scanned with rootkit scan
0 Hidden objects were found