-
Contributeur sécuritéBonjour,
"Je reviens sur le contrôle que je dois faire de mes supports USB...avec UsbFix ?"
Si tu possèdes d'autres supports USB externes (clés USB par exemple) il est très recommandé d'utiliser UsbFix comme tu l'as fait pour ton DD externe.
"Concernant l'infection, c'est dommage qu'on ne puisse savoir exactement où elle se situait. " Je t'ai situé l'infection par supports amovibles très précisément dans mon poste précédent.
Il ne faut pas confondre cette infection avec une autre infection de fichiers copiés sur clé USB ou DD externe. Cette dernière infection se détecte en analysant les fichiers présent sur ce support avec ton antivirus et aussi avec MBAM (après mise à jour). Il est aussi évident que si les fichiers sont copiés de ton pc, ils ne seront infectés que si ces fichiers présents sur le pc sont infectés eux-mêmes.
J'espère que c'est plus clair à présent.
Quand nous serons certains que le pc tourne bien, il sera impératif de purger la restauration système car en cas de restauration les infections présentes antérieurement pourraient réapparaitre. Je te donnerais la marche à suivre.
Si tu le veux bien nous pourrions procéder à un dernier contrôle :
* Télécharge AD-Remover sur ton Bureau. (Merci à C_XX)
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe
Miroir:
https://www.androidworld.fr/
/!\ Ferme toutes applications en cours /!\
/!\ Désactive provisoirement et seulement le temps de l'utilisation de AD-Remover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
- Double-clique sur l'icône Ad-Remover située sur ton Bureau.
- Sur la page, clique sur le bouton « Nettoyer »
- Confirme lancement du scan
- Laisse travailler l'outil.
- Poste le rapport qui apparaît à la fin.
(Le rapport est sauvegardé aussi sous C:\Ad-report-Clean.log )
-
Ok mais je n'ai vraiment pas le temps ce matin, je ferai çà après déjeuner.
Désolée...
A+ -
Avec pas mal de retard...me revoilà avec mon rapport AD-REMOVER.
J'espère avoir bien fait !
Quand je te disais qu'il serait interessant de savoir où se situait l'infection, je pensais qu'il était possible de connaître la source exacte : telle ou telle photo, tel mail, tel site, etc...excuse ma naïveté !
Je parlais de mes ennuis à mon fils tout à l'heure qui m'a dit que mon pc n'avait jamais été formaté depuis + de 5 ans...et qu'il aurait aussi besoin d'une restauration. C'est de çà dont tu m'as parlé ?
A + tard !
======= RAPPORT D'AD-REMOVER 2.0.0.1,E | UNIQUEMENT XP/VISTA/7 =======
Mis à jour par C_XX le 06/09/10 à 15:20
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org
C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 13:47:31 le 14/09/2010, Mode normal
Microsoft Windows XP Édition familiale Service Pack 3 (X86)
Dominique@PHIDO ( )
============== ACTION(S) ==============
(!) -- Fichiers temporaires supprimés.
============== SCAN ADDITIONNEL ==============
** Mozilla Firefox Version [3.5.12 (fr)] **
-- C:\Documents and Settings\Dominique\Application Data\Mozilla\FireFox\Profiles\j2t77uqq.default\Prefs.js --
browser.download.lastDir, C:\\Documents and Settings\\Dominique\\Bureau
browser.search.defaultenginename, Google
browser.search.defaulturl, hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
browser.search.selectedEngine, Google
browser.startup.homepage_override.mstone, rv:1.9.1.12
========================================
** Internet Explorer Version [8.0.6001.18702] **
[HKCU\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Enable Browser Extensions: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Custom Search URL: 1
Use Search Asst: no
[HKLM\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\WINDOWS\system32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm
========================================
C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 13 Fichier(s)
C:\Ad-Report-CLEAN[1].txt - 14/09/2010 (471 Octet(s))
Fin à: 13:50:33, 14/09/2010
============== E.O.F ============== -
Contributeur sécuritéIl n'est pas question de retard, tu fais les choses quand ça te convient.
C'est ok pour le rapport, il n'y a rien à signaler.
Le formatage et la restauration système sont 2 choses tout à fait différentes.
Le formatage est un nettoyage du disque dur qui remet ton PC à 0. Donc il faut tout réinstaller ensuite. Je ne le recommande que lorsqu'il n'y a pas possibilité de l'éviter.
La restauration système est une opération toute simple. On la purge lorsqu'il y a eu infection afin d'éviter une récupération de l'infection. On ne le fait que lorsque le PC est ok.
Une documentation pour comprendre ce que c'est ici :
https://www.commentcamarche.net/informatique/windows/147-restaurer-windows-avec-les-points-de-restauration/
https://www.commentcamarche.net/informatique/windows/147-restaurer-windows-avec-les-points-de-restauration/
Quand nous déciderons de la purger, voici comment procéder : http://service1.symantec.com/support/inter/tsgeninfointl.Nsf/fr_docid/20020830101856924
Pour le problème de double clic pour les pages Internet, j'ai bien une idée mais cela nécessite de fixer des lignes dans ZHPFix et je crains de ne pouvoir faire marche arrière en cas de pépin car ça ne s'est pas bien passé la dernière fois lorsque tu as voulu restaurer la quarantaine de ZHPFix.
@+-
Contributeur sécuritéEn complément à mon message ci-dessus.
J'ai creusé un peu plus tes rapports afin de repérer les fichiers Sony Ericson qui te tracassaient.
Il apparaissent sains mais nous pouvons pousser plus loin les recherches.
Note ils ont été installés le 06 septembre.
Rends-toi sur ce site : https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier : C:\WINDOWS\System32\drivers\seehcri.sys
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-notes.
Copie le dans ta réponse.
Si VirusTotal indique que le fichier a déjà été analysé, clique sur le bouton Ré-analyse le fichier maintenant.
Si tu ne trouves pas le fichier, fais ceci :
* Menu Démarrer --> Panneau de configuration --> Options des dossiers --> Affichage
* Coche "Afficher les fichiers et dossiers cachés", décoche "Masquer les extensions de fichiers connus", décoche "Masquer les fichiers protégés du Système", puis valide.
* Tu pourras à nouveau masquer les fichiers cachés une fois la manipulation terminée.
Tu pourras faire de même pour les fichiers suivant :
C:\WINDOWS\System32\drivers\ggflt.sys
C:\WINDOWS\System32\drivers\ggsemc.sys
-
-
VT Community Sign in ? My account ? Sign out Signing out... Languages ?
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
info@virustotal.com
Sign in to VT CommunitySafety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.
email
password
Keep me logged in
Sign in Signing in, please wait...
Login failed, please try again
Forgot your password? Create an account
Edit my profile
View my profile
Inbox
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: seehcri.sys
Submission date: 2010-09-14 15:10:33 (UTC)
Current status: queued (#1) queued analysing finished
Result: 0/ 43 (0.0%)
VT Community
not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.09.13.00 2010.09.13 -
AntiVir 8.2.4.52 2010.09.14 -
Antiy-AVL 2.0.3.7 2010.09.14 -
Authentium 5.2.0.5 2010.09.14 -
Avast 4.8.1351.0 2010.09.14 -
Avast5 5.0.594.0 2010.09.14 -
AVG 9.0.0.851 2010.09.14 -
BitDefender 7.2 2010.09.14 -
CAT-QuickHeal 11.00 2010.09.14 -
ClamAV 0.96.2.0-git 2010.09.14 -
Comodo 6073 2010.09.14 -
DrWeb 5.0.2.03300 2010.09.14 -
Emsisoft 5.0.0.37 2010.09.14 -
eSafe 7.0.17.0 2010.09.14 -
eTrust-Vet 36.1.7854 2010.09.14 -
F-Prot 4.6.1.107 2010.09.13 -
F-Secure 9.0.15370.0 2010.09.14 -
Fortinet 4.1.143.0 2010.09.13 -
GData 21 2010.09.14 -
Ikarus T3.1.1.88.0 2010.09.14 -
Jiangmin 13.0.900 2010.09.14 -
K7AntiVirus 9.63.2502 2010.09.14 -
Kaspersky 7.0.0.125 2010.09.14 -
McAfee 5.400.0.1158 2010.09.14 -
McAfee-GW-Edition 2010.1B 2010.09.14 -
Microsoft 1.6103 2010.09.14 -
NOD32 5450 2010.09.14 -
Norman 6.06.06 2010.09.14 -
nProtect 2010-09-14.01 2010.09.14 -
Panda 10.0.2.7 2010.09.14 -
PCTools 7.0.3.5 2010.09.14 -
Prevx 3.0 2010.09.14 -
Rising 22.65.01.04 2010.09.14 -
Sophos 4.57.0 2010.09.14 -
Sunbelt 6874 2010.09.14 -
SUPERAntiSpyware 4.40.0.1006 2010.09.14 -
Symantec 20101.1.1.7 2010.09.14 -
TheHacker 6.7.0.0.017 2010.09.14 -
TrendMicro 9.120.0.1004 2010.09.14 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.14 -
VBA32 3.12.14.0 2010.09.14 -
ViRobot 2010.8.25.4006 2010.09.14 -
VirusBuster 12.65.6.0 2010.09.14 -
Additional informationShow all
MD5 : e5b56569a9f79b70314fede6c953641e
SHA1 : c043286da0562dca16a14aa9abc3b0ce472019cd
SHA256: 41b088cd3ae5a342d44f2fdcb63975e15d79155f56dfc75631663d9c31d98634
ssdeep: 768:A0mE8TOn6APuRAWcebLzd/sXeThaa/0Kty4bm:A0n8TO32RAWcALR0uz/0KtNm
File size : 27632 bytes
First seen: 2010-01-14 19:49:11
Last seen : 2010-09-14 15:10:33
TrID:
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Sony Ericsson Mobile Communications
copyright....: (c) Sony Ericsson. All rights reserved.
product......: seehcri Device
description..: seehcri Driver
original name: seehcri.sys:
internal name: seehcri.sys:
file version.: 1.01
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information
[[ basic data ]]
entrypointaddress: 0x4EC7
timedatestamp....: 0x478488C1 (Wed Jan 09 08:41:37 2008)
machinetype......: 0x14c (I386)
[[ 7 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x480, 0x94D, 0x980, 6.33, 67827227166b2b21ff5c7a53f237f3d1
.rdata, 0xE00, 0x167, 0x180, 4.53, 5bd8eebb732656737340ed15f6862a7d
.data, 0xF80, 0xC0, 0x100, 0.29, a7d96055a84d278871f1bc66026404c3
PAGE, 0x1080, 0x3C46, 0x3C80, 6.53, fbf929d2b2177decf8ec048c19454214
INIT, 0x4D00, 0x834, 0x880, 5.75, 10a820565c2e4dc5b3f0533459dd73f3
.rsrc, 0x5580, 0x378, 0x380, 3.18, a528c002a4a13ced226f8d18be7a28f7
.reloc, 0x5900, 0x5AC, 0x600, 6.13, a88bed99db0bd2c347e4ed7f9e5c2cd1
[[ 1 import(s) ]]
ntoskrnl.exe: IoReleaseRemoveLockEx, IofCallDriver, IofCompleteRequest, IoAcquireRemoveLockEx, KeSetEvent, DbgPrint, PoStartNextPowerIrp, KeReleaseMutex, IoSetDeviceInterfaceState, KeWaitForSingleObject, ExFreePoolWithTag, IoGetDeviceInterfaces, RtlEqualUnicodeString, RtlInitUnicodeString, IoGetDeviceProperty, IoDetachDevice, PoSetPowerState, IoRegisterDeviceInterface, IoInitializeRemoveLockEx, KeInitializeEvent, IoDeleteDevice, IoAttachDeviceToDeviceStack, IoCreateDevice, IoReportDetectedDevice, KeClearEvent, IoBuildDeviceIoControlRequest, ObfDereferenceObject, ExAllocatePoolWithTag, IoGetAttachedDeviceReference, memcpy, IoBuildSynchronousFsdRequest, IoGetDeviceObjectPointer, ExAcquireResourceExclusiveLite, ExAcquireResourceSharedLite, KeEnterCriticalRegion, KeLeaveCriticalRegion, ExReleaseResourceLite, MmMapIoSpace, MmUnmapIoSpace, ZwClose, ZwQueryValueKey, ZwOpenKey, PoRequestPowerIrp, ExDeleteResourceLite, memset, IoReleaseRemoveLockAndWaitEx, PoCallDriver, KeInitializeMutex, ExInitializeResourceLite, DbgBreakPoint, RtlCopyUnicodeString, KeTickCount, KeBugCheckEx
VT Community
0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team
Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:
[b]text/b -- bold
[i]text/i -- italics
[u]text/u -- underline
[s]text/s -- strikethrough
[code]text/code -- preformatted text
You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.
Goodware Malware Spam attachment/link
P2P download Propagating via IM Network worm
Drive-by-download
Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.
Preview commentEdit comment Post comment Posting comment...
Comment successfully posted
ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com- Terms of Service & Privacy Policy -
Zut , j'avais pas vu la suite...
Additional informationShow all
MD5 : e5b56569a9f79b70314fede6c953641e
SHA1 : c043286da0562dca16a14aa9abc3b0ce472019cd
SHA256: 41b088cd3ae5a342d44f2fdcb63975e15d79155f56dfc75631663d9c31d98634
ssdeep: 768:A0mE8TOn6APuRAWcebLzd/sXeThaa/0Kty4bm:A0n8TO32RAWcALR0uz/0KtNm
File size : 27632 bytes
First seen: 2010-01-14 19:49:11
Last seen : 2010-09-14 15:10:33
TrID:
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Sony Ericsson Mobile Communications
copyright....: (c) Sony Ericsson. All rights reserved.
product......: seehcri Device
description..: seehcri Driver
original name: seehcri.sys:
internal name: seehcri.sys:
file version.: 1.01
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEInfo: PE structure information
[[ basic data ]]
entrypointaddress: 0x4EC7
timedatestamp....: 0x478488C1 (Wed Jan 09 08:41:37 2008)
machinetype......: 0x14c (I386)
[[ 7 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x480, 0x94D, 0x980, 6.33, 67827227166b2b21ff5c7a53f237f3d1
.rdata, 0xE00, 0x167, 0x180, 4.53, 5bd8eebb732656737340ed15f6862a7d
.data, 0xF80, 0xC0, 0x100, 0.29, a7d96055a84d278871f1bc66026404c3
PAGE, 0x1080, 0x3C46, 0x3C80, 6.53, fbf929d2b2177decf8ec048c19454214
INIT, 0x4D00, 0x834, 0x880, 5.75, 10a820565c2e4dc5b3f0533459dd73f3
.rsrc, 0x5580, 0x378, 0x380, 3.18, a528c002a4a13ced226f8d18be7a28f7
.reloc, 0x5900, 0x5AC, 0x600, 6.13, a88bed99db0bd2c347e4ed7f9e5c2cd1
[[ 1 import(s) ]]
ntoskrnl.exe: IoReleaseRemoveLockEx, IofCallDriver, IofCompleteRequest, IoAcquireRemoveLockEx, KeSetEvent, DbgPrint, PoStartNextPowerIrp, KeReleaseMutex, IoSetDeviceInterfaceState, KeWaitForSingleObject, ExFreePoolWithTag, IoGetDeviceInterfaces, RtlEqualUnicodeString, RtlInitUnicodeString, IoGetDeviceProperty, IoDetachDevice, PoSetPowerState, IoRegisterDeviceInterface, IoInitializeRemoveLockEx, KeInitializeEvent, IoDeleteDevice, IoAttachDeviceToDeviceStack, IoCreateDevice, IoReportDetectedDevice, KeClearEvent, IoBuildDeviceIoControlRequest, ObfDereferenceObject, ExAllocatePoolWithTag, IoGetAttachedDeviceReference, memcpy, IoBuildSynchronousFsdRequest, IoGetDeviceObjectPointer, ExAcquireResourceExclusiveLite, ExAcquireResourceSharedLite, KeEnterCriticalRegion, KeLeaveCriticalRegion, ExReleaseResourceLite, MmMapIoSpace, MmUnmapIoSpace, ZwClose, ZwQueryValueKey, ZwOpenKey, PoRequestPowerIrp, ExDeleteResourceLite, memset, IoReleaseRemoveLockAndWaitEx, PoCallDriver, KeInitializeMutex, ExInitializeResourceLite, DbgBreakPoint, RtlCopyUnicodeString, KeTickCount, KeBugCheckEx
VT Community
0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team -
ANALYSE DU 2ème LIEN
VT Community Sign in ? My account ? Sign out Signing out... Languages ?
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
info@virustotal.com
Sign in to VT CommunitySafety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.
email
password
Keep me logged in
Sign in Signing in, please wait...
Login failed, please try again
Forgot your password? Create an account
Edit my profile
View my profile
Inbox
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: ggflt.sys
Submission date: 2010-09-14 15:18:56 (UTC)
Current status: queued (#4) queued (#4) analysing finished
Result: 0/ 43 (0.0%)
VT Community
not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.09.13.00 2010.09.13 -
AntiVir 8.2.4.52 2010.09.14 -
Antiy-AVL 2.0.3.7 2010.09.14 -
Authentium 5.2.0.5 2010.09.14 -
Avast 4.8.1351.0 2010.09.14 -
Avast5 5.0.594.0 2010.09.14 -
AVG 9.0.0.851 2010.09.14 -
BitDefender 7.2 2010.09.14 -
CAT-QuickHeal 11.00 2010.09.14 -
ClamAV 0.96.2.0-git 2010.09.14 -
Comodo 6073 2010.09.14 -
DrWeb 5.0.2.03300 2010.09.14 -
Emsisoft 5.0.0.37 2010.09.14 -
eSafe 7.0.17.0 2010.09.14 -
eTrust-Vet 36.1.7854 2010.09.14 -
F-Prot 4.6.1.107 2010.09.13 -
F-Secure 9.0.15370.0 2010.09.14 -
Fortinet 4.1.143.0 2010.09.13 -
GData 21 2010.09.14 -
Ikarus T3.1.1.88.0 2010.09.14 -
Jiangmin 13.0.900 2010.09.14 -
K7AntiVirus 9.63.2502 2010.09.14 -
Kaspersky 7.0.0.125 2010.09.14 -
McAfee 5.400.0.1158 2010.09.14 -
McAfee-GW-Edition 2010.1B 2010.09.14 -
Microsoft 1.6103 2010.09.14 -
NOD32 5450 2010.09.14 -
Norman 6.06.06 2010.09.14 -
nProtect 2010-09-14.01 2010.09.14 -
Panda 10.0.2.7 2010.09.14 -
PCTools 7.0.3.5 2010.09.14 -
Prevx 3.0 2010.09.14 -
Rising 22.65.01.04 2010.09.14 -
Sophos 4.57.0 2010.09.14 -
Sunbelt 6874 2010.09.14 -
SUPERAntiSpyware 4.40.0.1006 2010.09.14 -
Symantec 20101.1.1.7 2010.09.14 -
TheHacker 6.7.0.0.017 2010.09.14 -
TrendMicro 9.120.0.1004 2010.09.14 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.14 -
VBA32 3.12.14.0 2010.09.14 -
ViRobot 2010.8.25.4006 2010.09.14 -
VirusBuster 12.65.6.0 2010.09.14 -
Additional informationShow all
MD5 : 007aea2e06e7cef7372e40c277163959
SHA1 : 61649070fc0b597bfea5d9f4b9bad7348f05ff7d
SHA256: 805906adc7c5473b767932a552fec7500d0f3f7cb45d8defe6a1567f2038ef88
ssdeep: 192:2uK749vN2bcQS8yowJL/aMjGwP7oZgjl3PMYb04lB5+ebMclMHT:2u64dAS8YJLWd6jVo4l
NbM
File size : 13224 bytes
First seen: 2009-06-30 23:33:18
Last seen : 2010-09-14 15:18:56
TrID:
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Sony Ericsson Mobile Communications
copyright....: Copyright (c) 2007-2009 Sony Ericsson Mobile Communications
product......: Gordon_s Gate
description..: SEMC USB Flash Driver Filter
original name: ggflt.sys
internal name: ggflt.sys
file version.: 2.2.0.5
comments.....: n/a
signers......: Sony Ericsson Mobile Communications AB
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 9:13 AM 4/6/2009
verified.....: -
PEInfo: PE structure information
[[ basic data ]]
entrypointaddress: 0x769
timedatestamp....: 0x49D3216E (Wed Apr 01 08:10:22 2009)
machinetype......: 0x14c (I386)
[[ 6 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x480, 0x41C, 0x480, 5.73, c7298656c023abb74b5a621acbd78df2
.rdata, 0x900, 0xF7, 0x100, 4.90, bc4b4e6502117030c322326512b68ea8
.data, 0xA00, 0x87C, 0x880, 0.15, 0b0fad0169c357dc7e92e5c0e7209bcd
INIT, 0x1280, 0x184, 0x200, 4.16, 9a638ccf34742a60d2d7e8c19035d755
.rsrc, 0x1480, 0x3B8, 0x400, 3.14, 55a2b56cf61953d84aafff0bf3e86232
.reloc, 0x1880, 0xCC, 0x100, 3.79, c624bba09ab7a945e993551212a929ad
[[ 2 import(s) ]]
ntoskrnl.exe: IofCompleteRequest, IoBuildDeviceIoControlRequest, RtlCopyUnicodeString, KeTickCount, IofCallDriver, KeInitializeEvent, KeWaitForSingleObject
WDFLDR.SYS: WdfVersionUnbind, WdfVersionBind
VT Community
0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team
Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:
[b]text/b -- bold
[i]text/i -- italics
[u]text/u -- underline
[s]text/s -- strikethrough
[code]text/code -- preformatted text
You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.
Goodware Malware Spam attachment/link
P2P download Propagating via IM Network worm
Drive-by-download
Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.
Preview commentEdit comment Post comment Posting comment...
Comment successfully posted
ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com- Terms of Service & Privacy Policy -
ANALYSE DU 3ème LIEN
VT Community Sign in ? My account ? Sign out Signing out... Languages ?
VirusTotal's website has changed, we need new translations, do you feel like helping the community?
info@virustotal.com
Sign in to VT CommunitySafety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.
email
password
Keep me logged in
Sign in Signing in, please wait...
Login failed, please try again
Forgot your password? Create an account
Edit my profile
View my profile
Inbox
Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...
0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.
File name: ggsemc.sys
Submission date: 2010-09-14 15:22:46 (UTC)
Current status: queued queued analysing finished
Result: 0/ 43 (0.0%)
VT Community
not reviewed
Safety score: -
Compact Print results Antivirus Version Last Update Result
AhnLab-V3 2010.09.13.00 2010.09.13 -
AntiVir 8.2.4.52 2010.09.14 -
Antiy-AVL 2.0.3.7 2010.09.14 -
Authentium 5.2.0.5 2010.09.14 -
Avast 4.8.1351.0 2010.09.14 -
Avast5 5.0.594.0 2010.09.14 -
AVG 9.0.0.851 2010.09.14 -
BitDefender 7.2 2010.09.14 -
CAT-QuickHeal 11.00 2010.09.14 -
ClamAV 0.96.2.0-git 2010.09.14 -
Comodo 6073 2010.09.14 -
DrWeb 5.0.2.03300 2010.09.14 -
Emsisoft 5.0.0.37 2010.09.14 -
eSafe 7.0.17.0 2010.09.14 -
eTrust-Vet 36.1.7854 2010.09.14 -
F-Prot 4.6.1.107 2010.09.13 -
F-Secure 9.0.15370.0 2010.09.14 -
Fortinet 4.1.143.0 2010.09.13 -
GData 21 2010.09.14 -
Ikarus T3.1.1.88.0 2010.09.14 -
Jiangmin 13.0.900 2010.09.14 -
K7AntiVirus 9.63.2512 2010.09.14 -
Kaspersky 7.0.0.125 2010.09.14 -
McAfee 5.400.0.1158 2010.09.14 -
McAfee-GW-Edition 2010.1B 2010.09.14 -
Microsoft 1.6103 2010.09.14 -
NOD32 5450 2010.09.14 -
Norman 6.06.06 2010.09.14 -
nProtect 2010-09-14.01 2010.09.14 -
Panda 10.0.2.7 2010.09.14 -
PCTools 7.0.3.5 2010.09.14 -
Prevx 3.0 2010.09.14 -
Rising 22.65.01.04 2010.09.14 -
Sophos 4.57.0 2010.09.14 -
Sunbelt 6874 2010.09.14 -
SUPERAntiSpyware 4.40.0.1006 2010.09.14 -
Symantec 20101.1.1.7 2010.09.14 -
TheHacker 6.7.0.0.017 2010.09.14 -
TrendMicro 9.120.0.1004 2010.09.14 -
TrendMicro-HouseCall 9.120.0.1004 2010.09.14 -
VBA32 3.12.14.0 2010.09.14 -
ViRobot 2010.8.25.4006 2010.09.14 -
VirusBuster 12.65.6.0 2010.09.14 -
Additional informationShow all
MD5 : c73de35960ca75c5ab4ae636b127c64e
SHA1 : a99a2762003dc5044da9cb445f11a5e0008bd553
SHA256: 0c22eecd64cc06ab820ed6a2e76fbc7ab072379fd14837cf95ba3ef105abb745
ssdeep: 384:AyZ0MrtCewuzsMZUc2gh6zBhYJLWd6jVo4lNbPR:AyZjM1a1h6zBsLAmXvbPR
File size : 25512 bytes
First seen: 2009-06-30 23:34:04
Last seen : 2010-09-14 15:22:46
TrID:
Clipper DOS Executable (33.3%)
Generic Win/DOS Executable (33.0%)
DOS Executable Generic (33.0%)
VXD Driver (0.5%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
sigcheck:
publisher....: Sony Ericsson Mobile Communications
copyright....: Copyright (c) 2007-2009 Sony Ericsson Mobile Communications
product......: Gordon_s Gate
description..: SEMC USB Flash Driver
original name: ggsemc.sys
internal name: ggsemc.sys
file version.: 2.2.0.5
comments.....: n/a
signers......: Sony Ericsson Mobile Communications AB
VeriSign Class 3 Code Signing 2004 CA
Class 3 Public Primary Certification Authority
signing date.: 9:13 AM 4/6/2009
verified.....: -
PEInfo: PE structure information
[[ basic data ]]
entrypointaddress: 0x2704
timedatestamp....: 0x49D3216F (Wed Apr 01 08:10:23 2009)
machinetype......: 0x14c (I386)
[[ 6 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x480, 0x2854, 0x2880, 6.13, df6259321197f7f61fb3a81678be5dc2
.rdata, 0x2D00, 0x674, 0x680, 4.03, ed9bc6d3bc608fab7cf2c2db1c789172
.data, 0x3380, 0x8CC, 0x900, 0.21, 47b16b46939879dafc8af58be7687d48
INIT, 0x3C80, 0x34C, 0x380, 5.12, a0f5359fa070425dd46d487cd104944a
.rsrc, 0x4000, 0x3B0, 0x400, 3.11, d8b1278bf7b49a3255502b7bf6476196
.reloc, 0x4400, 0x51E, 0x580, 5.28, a00777232a0c28546e3962987078c366
[[ 4 import(s) ]]
ntoskrnl.exe: ObfDereferenceObject, ObReferenceObjectByHandle, IoOpenDeviceRegistryKey, ZwQueryValueKey, ZwOpenKey, RtlInitUnicodeString, memcpy, ZwFlushKey, ObQueryNameString, ZwCreateKey, _snwprintf, wcsncmp, KeTickCount, KeBugCheckEx, _wcsupr, wcsstr, wcschr, wcsncpy, ZwClose, RtlCopyUnicodeString, RtlUnwind, memset, ZwSetValueKey, KeInitializeEvent
HAL.dll: ExAcquireFastMutex, ExReleaseFastMutex
USBD.SYS: _USBD_ParseConfigurationDescriptorEx@28
WDFLDR.SYS: WdfVersionUnbind, WdfVersionBind
VT Community
0
This file has never been reviewed by any VT Community member. Be the first one to comment on it!
VirusTotal Team
Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?
You can add basic styles to your comments using the following accepted bbcode tags:
[b]text/b -- bold
[i]text/i -- italics
[u]text/u -- underline
[s]text/s -- strikethrough
[code]text/code -- preformatted text
You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.
Goodware Malware Spam attachment/link
P2P download Propagating via IM Network worm
Drive-by-download
Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.
Preview commentEdit comment Post comment Posting comment...
Comment successfully posted
ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: info@virustotal.com- Terms of Service & Privacy Policy -
Contributeur sécuritéBien, je te confirme donc que les fichiers Sony Ericsson sont sains ;-)
Précédent
- 1
- 2
- 3
- 4
