rapport Avira: 4 entrée regedit invisible Résolu/Fermé

Question

Bonjour, Ma question est simple. J ai le rapport Avira qui montre 4 entrées de registres invisibles. Comment être sûr que les entrées ne sont pas infectées. Merci Avira Free Antivirus Report file date: 3 février 2012 09:52 Scanning for 3363733 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 x64 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : amer Computer name : AMER-PC Version information: BUILD.DAT : 12.0.0.849 Bytes 2011-09-23 20:19:00 AVSCAN.EXE : 12.1.0.17 490448 Bytes 2011-09-23 23:04:46 AVSCAN.DLL : 12.1.0.17 54224 Bytes 2011-09-23 18:34:56 LUKE.DLL : 12.1.0.17 68304 Bytes 2011-09-23 17:55:16 AVSCPLR.DLL : 12.1.0.21 99536 Bytes 2012-02-03 14:39:03 AVREG.DLL : 12.1.0.27 227536 Bytes 2012-02-03 14:39:03 VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-06 01:18:34 VBASE001.VDF : 7.11.0.0 13342208 Bytes 2010-12-14 16:07:39 VBASE002.VDF : 7.11.19.170 14374912 Bytes 2011-12-20 14:38:40 VBASE003.VDF : 7.11.21.238 4472832 Bytes 2012-02-01 14:38:50 VBASE004.VDF : 7.11.21.239 2048 Bytes 2012-02-01 14:38:50 VBASE005.VDF : 7.11.21.240 2048 Bytes 2012-02-01 14:38:50 VBASE006.VDF : 7.11.21.241 2048 Bytes 2012-02-01 14:38:50 VBASE007.VDF : 7.11.21.242 2048 Bytes 2012-02-01 14:38:50 VBASE008.VDF : 7.11.21.243 2048 Bytes 2012-02-01 14:38:50 VBASE009.VDF : 7.11.21.244 2048 Bytes 2012-02-01 14:38:50 VBASE010.VDF : 7.11.21.245 2048 Bytes 2012-02-01 14:38:51 VBASE011.VDF : 7.11.21.246 2048 Bytes 2012-02-01 14:38:51 VBASE012.VDF : 7.11.21.247 2048 Bytes 2012-02-01 14:38:51 VBASE013.VDF : 7.11.22.33 1486848 Bytes 2012-02-03 14:38:53 VBASE014.VDF : 7.11.22.34 2048 Bytes 2012-02-03 14:38:54 VBASE015.VDF : 7.11.22.35 2048 Bytes 2012-02-03 14:38:54 VBASE016.VDF : 7.11.22.36 2048 Bytes 2012-02-03 14:38:54 VBASE017.VDF : 7.11.22.37 2048 Bytes 2012-02-03 14:38:54 VBASE018.VDF : 7.11.22.38 2048 Bytes 2012-02-03 14:38:54 VBASE019.VDF : 7.11.22.39 2048 Bytes 2012-02-03 14:38:54 VBASE020.VDF : 7.11.22.40 2048 Bytes 2012-02-03 14:38:54 VBASE021.VDF : 7.11.22.41 2048 Bytes 2012-02-03 14:38:54 VBASE022.VDF : 7.11.22.42 2048 Bytes 2012-02-03 14:38:54 VBASE023.VDF : 7.11.22.43 2048 Bytes 2012-02-03 14:38:55 VBASE024.VDF : 7.11.22.44 2048 Bytes 2012-02-03 14:38:55 VBASE025.VDF : 7.11.22.45 2048 Bytes 2012-02-03 14:38:55 VBASE026.VDF : 7.11.22.46 2048 Bytes 2012-02-03 14:38:55 VBASE027.VDF : 7.11.22.47 2048 Bytes 2012-02-03 14:38:55 VBASE028.VDF : 7.11.22.48 2048 Bytes 2012-02-03 14:38:55 VBASE029.VDF : 7.11.22.49 2048 Bytes 2012-02-03 14:38:55 VBASE030.VDF : 7.11.22.50 2048 Bytes 2012-02-03 14:38:55 VBASE031.VDF : 7.11.22.53 61952 Bytes 2012-02-03 14:38:56 Engineversion : 8.2.8.48 AEVDF.DLL : 8.1.2.2 106868 Bytes 2012-02-03 14:39:03 AESCRIPT.DLL : 8.1.4.3 438649 Bytes 2012-02-03 14:39:02 AESCN.DLL : 8.1.8.2 131444 Bytes 2012-02-03 14:39:02 AESBX.DLL : 8.2.4.5 434549 Bytes 2012-02-03 14:39:03 AERDL.DLL : 8.1.9.15 639348 Bytes 2011-09-09 04:16:06 AEPACK.DLL : 8.2.16.2 799095 Bytes 2012-02-03 14:39:02 AEOFFICE.DLL : 8.1.2.25 201084 Bytes 2012-02-03 14:39:01 AEHEUR.DLL : 8.1.3.24 4387190 Bytes 2012-02-03 14:39:01 AEHELP.DLL : 8.1.19.0 254327 Bytes 2012-02-03 14:38:57 AEGEN.DLL : 8.1.5.21 409971 Bytes 2012-02-03 14:38:57 AEEMU.DLL : 8.1.3.0 393589 Bytes 2011-09-02 04:46:01 AECORE.DLL : 8.1.25.3 201079 Bytes 2012-02-03 14:38:56 AEBB.DLL : 8.1.1.0 53618 Bytes 2011-09-02 04:46:01 AVWINLL.DLL : 12.1.0.17 27344 Bytes 2011-09-23 17:13:18 AVPREF.DLL : 12.1.0.17 51920 Bytes 2011-09-23 16:53:57 AVREP.DLL : 12.1.0.17 179408 Bytes 2011-09-23 16:55:01 AVARKT.DLL : 12.1.0.17 223184 Bytes 2011-09-23 16:25:26 AVEVTLOG.DLL : 12.1.0.17 169168 Bytes 2011-09-23 16:34:37 SQLITE3.DLL : 3.7.0.0 398288 Bytes 2011-09-16 07:05:58 AVSMTP.DLL : 12.1.0.17 62928 Bytes 2011-09-23 17:03:47 NETNT.DLL : 12.1.0.17 17104 Bytes 2011-09-23 17:58:06 RCIMAGE.DLL : 12.1.0.17 4450000 Bytes 2011-09-23 18:37:25 RCTEXT.DLL : 12.1.0.16 96208 Bytes 2011-09-23 18:37:24 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp Logging.............................: default Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, Process scan........................: on Extended process scan...............: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: extended Start of the scan: 3 février 2012 09:52 Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! [INFO] Please restart the search with Administrator rights Master boot sector HD1 [INFO] No virus was found! [INFO] Please restart the search with Administrator rights Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! [INFO] Please restart the search with Administrator rights Boot sector 'D:\' [INFO] No virus was found! [INFO] Please restart the search with Administrator rights Starting search for hidden objects. HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}\ShellFolder\attributes [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray\BattMeter\Flyout\381b4222-f694-41f0-9685-ff5bb260df2e [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\SysTray\BattMeter\Flyout\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c [NOTE] The registry entry is invisible. Hidden driver [NOTE] A memory modification has been detected, which could potentially be used to hide file access attempts. The scan of running processes will be started Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'avscan.exe' - '80' Module(s) have been scanned Scan process 'avcenter.exe' - '109' Module(s) have been scanned Scan process 'AcroRd32.exe' - '64' Module(s) have been scanned Scan process 'AcroRd32.exe' - '33' Module(s) have been scanned Scan process 'googletalkplugin.exe' - '67' Module(s) have been scanned Scan process 'chrome.exe' - '43' Module(s) have been scanned Scan process 'chrome.exe' - '64' Module(s) have been scanned Scan process 'rundll32.exe' - '51' Module(s) have been scanned Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'chrome.exe' - '48' Module(s) have been scanned Scan process 'chrome.exe' - '128' Module(s) have been scanned Scan process 'avgnt.exe' - '77' Module(s) have been scanned Scan process 'mbamgui.exe' - '36' Module(s) have been scanned Scan process 'acrotray.exe' - '28' Module(s) have been scanned Scan process 'netsession_win.exe' - '57' Module(s) have been scanned Scan process 'tvnserver.exe' - '28' Module(s) have been scanned Scan process 'IAStorIcon.exe' - '51' Module(s) have been scanned Scan process 'PDVDDXSrv.exe' - '46' Module(s) have been scanned Scan process 'InputDirector.exe' - '46' Module(s) have been scanned Scan process 'netsession_win.exe' - '38' Module(s) have been scanned Scan process 'ISUSPM.exe' - '35' Module(s) have been scanned Starting to scan executable files (registry). The registry was scanned ( '3059' files ). Starting the file scan: Begin scan in 'C:\' Begin scan in 'D:\' End of the scan: 3 février 2012 13:21 Used time: 3:28:36 Hour(s) The scan has been done completely. 75183 Scanned directories 2092862 Files were scanned 0 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 Files were deleted 0 Viruses and unwanted programs were repaired 0 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 2092862 Files not concerned 15238 Archives were scanned 0 Warnings 4 Notes 1550908 Objects were scanned with rootkit scan 4 Hidden objects were found

g3n-h@ckm@n · Answer

salut deja l'heuristique doit etre reglée sur moyen , pas sur haute

legyptien · Answer

et si je fais ca, il trouvera les fichiers caché qu il ne trouve pas actuellement ?

g3n-h@ckm@n · Answer

refais un scan avec l heuristique sur moyen , s il detecte rien ca veut dire que c'est des faux positifs on ne met jamais une heuristique au maximum , c'est bon pour planter un system quand on est novice

legyptien · Answer

je viens de verifier mon heuristic. Il est sur moyen. Ca m aurait etonné aussi qu il soit sur haut, j ai laissé les parametres par default n etant pas un expert...

legyptien · Answer

je fais quoi pour mes entrees ? je vais essayer de les trouver manuellement ...

g3n-h@ckm@n · Answer

File heuristic......................: extended

legyptien · Answer

je sais bien mais je garanti que c'est pas ce qu'il y a d ecrit sur mes parametres Avira (que je n ai pas changé depuis le scan). Enfin bon.

g3n-h@ckm@n · Answer

re

telecharge et enregistre ceci sur ton bureau :

Pre_Scan

Avertissement: tous les processus non-vitaux de windows seront coupés --> pas de panique. 

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition du rapport sur le bureau.

si 'outil est bloqué par l'infection utilise cette version : Version .pif

ou encore cette version renommée : Winlogon.exe

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

 Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler 

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan après redemarrage

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

heberge le rapport sur http://pjjoint.malekal.com et donne le lien obtenu

Rapport Avira: 4 entrée regedit invisible

8 réponses

Discussions similaires