View original (French)

Windows Virus newdev.exe???

Solved
Lilipi Posted messages 10 Status Member -  
Lilipi Posted messages 10 Status Member -
Hello,
Let me explain.
I have a PC with a dual boot of Ubuntu and Windows 7.

For a few hours now, when I boot my PC into Windows, it is extremely slow, so much so that I can't do anything!!! (it takes more than 20 minutes to load the desktop icons ...)

It took over 45 minutes to shut down ...

Anyway, I can no longer use Windows at the moment.

So I booted into Ubuntu where I don't seem to have any problems.

I downloaded ClamTK and scanned my System32 folder.

Here are the results:
/Windows/System32/newdev.exe
status: Win.Trojan.Agent-213258

My question is, is this a false positive?? If not, what should I do? Should I quarantine the file??

Do you have any idea how to solve this slowdown problem ...???? (considering that I can't boot into Windows right now ....)

Thank you in advance!

Configuration: Linux / Firefox 19.0

9 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 711
     
    Hi,

    It looks like malware, yes.

    Download http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner AdwCleaner (from Xplode) on your desktop.
    Run it, click on [Delete] and wait for the scan to finish (No need to do a Search beforehand).
    Once the scan is complete, a report will open. Post the content of the report in your next reply by copy/pasting.
    If that doesn't work, use the site http://pjjoint.malekal.com to host the report, give the link to the report in a new message.

    Note: The report is also saved under C:\AdwCleaner[S1].txt

    then:

    Do an OTL scan to diagnose the running programs and detect infections:

    You can follow the instructions on this page to help you: https://www.malekal.com/tutorial-otl/

    * Download http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ on your desktop.
    (If you're using Vista/Win7, you must right-click on OTL and choose Run as administrator)

    In the case of Avast!, do not run the program in the Sandbox (see the help link above).

    * Launch OTL
    * At the top right of Quick Analysis, check "all users"
    * On OTL, under Customization, copy-paste the script below:

    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %temp%\.exe /s
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    %systemroot%\system32\consrv.dll
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    /md5start
    explorer.exe
    winlogon.exe
    wininit.exe
    /md5stop
    HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
    HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
    CREATERESTOREPOINT
    nslookup www.google.fr /c
    SAVEMBR:0
    hklm\software\clients\startmenuinternet|command /rs
    hklm\software\clients\startmenuinternet|command /64 /rs

    * Click on the Analyze button.

    DO NOT COPY/PASTE THE REPORT HERE - PROVIDE THE PJJOINT LINK
    * When the scan is finished, use the site http://pjjoint.malekal.com/ to send the OTL.txt report (and Extra.txt if present), give the PJJOINT links pointing to these reports here in a new message.
    DO NOT COPY/PASTE THE REPORT HERE - PROVIDE THE PJJOINT LINK

    --
    Like the angel you are, you laugh creating a lightness in my chest,
    Your eyes they penetrate me,
    (Your answer's always 'maybe')
    That's when I got up and left.
    1