Plusieurs "Cheval de troie" tenaces sur mon ordinateur portable!

Nan'Antho Messages postés 9 Statut Membre -
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention - 31 oct. 2013 à 22:18

Bonjour,

Un ami a formater mon ordinateur (Windows 7 professionnel) il y a deux jours, cela dit, par manque de temps, il n'a pas pu tout vérifier... Mais il m'a installé un VRAI anti-virus (AVIRA), et j'ai eu le bonheur de trouver 2 cheval de troie hier, 4 ce matin, c'est merveilleux n'est-ce pas?!

Pour le coup je trouve donc les "adresses" suivantes :

Windows/assembly/GAC_32
et
Windows/assembly/GAC_64

et sur le rapport d'AVIRA 4 noms en quarantaine :

4ccb4f4f.qua
545c60ec.qua
4d5c9029.qua
55cbbf83.qua

Pour chacun est écrit "Desktop.ini"

Merci d'avance pour vos réponses...

Afficher la suite

4 réponses

Réponse 1 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

Salut,

Tu es infecté par ZeroAccess qui bloque les téléchargements.
Tu peux suivre la manip suivante pour débloquer les téléchargements sur Firefox : https://www.malekal.com/sirefef-impossible-de-telecharger-sur-internet-explorer/

Si tu n'as pas Firefox, tu es alors obligé de télécharger RogueKiller depuis un autre PC et le transférer par clef USB sur le PC infecté.

[*] Télécharger sur le bureau https://forum.malekal.com/viewtopic.php?t=29444&start= (suivre le lien officiel)
[*] !!! ATTENTION !! Sur la page de RogueKiller - "Prendre Lien de téléchargement" - avec les cercles violets. En cliquant sur ces cercles le programme se télécharge.
[*] Quitter tous les programmes
[*] Lancer RogueKiller.exe.
[*] Attendre que le Prescan ait fini ...
[*] Lance un scan afin de débloquer le bouton Suppression à droite.
[*] Clic sur Suppression.
[*] Copie/colle le contenu du rapport ici.

!!! Je répète bien faire Suppression à droite et poster le rapport. !!!
0
Réponse 2 / 4
Nan'Antho Messages postés 9 Statut Membre

Tout d'abord, merci de ta réponse cela dit, je n'ai pas d'autres PC à disposition...Que puis-je faire d'autre? :/
0
1. SkiLLoF Messages postés 1655 Statut Membre 187
  
  As-tu firefox ?
  
  0
2. Nan'Antho Messages postés 9 Statut Membre
  
  Non, google chrome...
  
  0
3. SkiLLoF Messages postés 1655 Statut Membre 187
  
  Quand on veut on peut. Un cyber c'est possible ?
  
  0
4. Nan'Antho Messages postés 9 Statut Membre
  
  Je te remercie de vouloir m'aider mais ce genre de réflexion je m'en passerais volontiers, j'ai un bébé d'un mois, ce n'est pas non plus ma priorité!
  
  0
5. SkiLLoF Messages postés 1655 Statut Membre 187
  
  Ne t'enerve pas pour ca. C'est un peu d'humour lol
  
  0
Réponse 3 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

Télécharge et installe Malwarebyte MBAR : https://www.malekal.com/malwarebytes-anti-rootkit-mbar-beta/
Mets le à jour, fais un scan rapide, supprime tout et poste le rapport ici.
Enregistre le rapport sur http://pjjoint.malekal.com
Donne le lien pjjoint ici.
0
1. Nan'Antho Messages postés 9 Statut Membre
  
  Malwarebytes Anti-Rootkit BETA 1.07.0.1007
  
  (c) Malwarebytes Corporation 2011-2012
  
  OS version: 6.1.7601 Windows 7 Service Pack 1 x64
  
  Account is Administrative
  
  Internet Explorer version: 10.0.9200.16721
  
  File system is: NTFS
  Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
  CPU speed: 2.128000 GHz
  Memory total: 4148662272, free: 1803431936
  
  Downloaded database version: v2013.10.31.04
  Downloaded database version: v2013.10.11.02
  Initializing...
  ======================
  ------------ Kernel report ------------
  10/31/2013 16:33:24
  ------------ Loaded modules -----------
  \SystemRoot\system32\ntoskrnl.exe
  \SystemRoot\system32\hal.dll
  \SystemRoot\system32\kdcom.dll
  \SystemRoot\system32\mcupdate_GenuineIntel.dll
  \SystemRoot\system32\PSHED.dll
  \SystemRoot\system32\CLFS.SYS
  \SystemRoot\system32\CI.dll
  \SystemRoot\system32\drivers\Wdf01000.sys
  \SystemRoot\system32\drivers\WDFLDR.SYS
  \SystemRoot\system32\drivers\ACPI.sys
  \SystemRoot\system32\drivers\WMILIB.SYS
  \SystemRoot\system32\drivers\msisadrv.sys
  \SystemRoot\system32\drivers\pci.sys
  \SystemRoot\system32\drivers\vdrvroot.sys
  \SystemRoot\System32\drivers\partmgr.sys
  \SystemRoot\system32\drivers\compbatt.sys
  \SystemRoot\system32\drivers\BATTC.SYS
  \SystemRoot\system32\drivers\volmgr.sys
  \SystemRoot\System32\drivers\volmgrx.sys
  \SystemRoot\System32\drivers\mountmgr.sys
  \SystemRoot\system32\drivers\atapi.sys
  \SystemRoot\system32\drivers\ataport.SYS
  \SystemRoot\system32\drivers\msahci.sys
  \SystemRoot\system32\drivers\PCIIDEX.SYS
  \SystemRoot\system32\DRIVERS\iaStorA.sys
  \SystemRoot\system32\DRIVERS\storport.sys
  \SystemRoot\system32\drivers\amdxata.sys
  \SystemRoot\system32\drivers\fltmgr.sys
  \SystemRoot\system32\drivers\fileinfo.sys
  \SystemRoot\System32\Drivers\Ntfs.sys
  \SystemRoot\System32\Drivers\msrpc.sys
  \SystemRoot\System32\Drivers\ksecdd.sys
  \SystemRoot\System32\Drivers\cng.sys
  \SystemRoot\System32\drivers\pcw.sys
  \SystemRoot\System32\Drivers\Fs_Rec.sys
  \SystemRoot\system32\drivers\ndis.sys
  \SystemRoot\system32\drivers\NETIO.SYS
  \SystemRoot\System32\Drivers\ksecpkg.sys
  \SystemRoot\System32\drivers\tcpip.sys
  \SystemRoot\System32\drivers\fwpkclnt.sys
  \SystemRoot\system32\drivers\vmstorfl.sys
  \SystemRoot\system32\drivers\volsnap.sys
  \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
  \SystemRoot\System32\Drivers\spldr.sys
  \SystemRoot\System32\drivers\rdyboost.sys
  \SystemRoot\System32\Drivers\mup.sys
  \SystemRoot\system32\DRIVERS\iaStorF.sys
  \SystemRoot\System32\drivers\hwpolicy.sys
  \SystemRoot\System32\DRIVERS\fvevol.sys
  \SystemRoot\system32\drivers\disk.sys
  \SystemRoot\system32\drivers\CLASSPNP.SYS
  \SystemRoot\system32\DRIVERS\cdrom.sys
  \SystemRoot\System32\Drivers\Null.SYS
  \SystemRoot\System32\Drivers\Beep.SYS
  \SystemRoot\System32\drivers\vga.sys
  \SystemRoot\System32\drivers\VIDEOPRT.SYS
  \SystemRoot\System32\drivers\watchdog.sys
  \SystemRoot\System32\DRIVERS\RDPCDD.sys
  \SystemRoot\system32\drivers\rdpencdd.sys
  \SystemRoot\system32\drivers\rdprefmp.sys
  \SystemRoot\System32\Drivers\Msfs.SYS
  \SystemRoot\System32\Drivers\Npfs.SYS
  \SystemRoot\system32\DRIVERS\tdx.sys
  \SystemRoot\system32\DRIVERS\TDI.SYS
  \SystemRoot\system32\drivers\afd.sys
  \SystemRoot\System32\DRIVERS\netbt.sys
  \SystemRoot\system32\DRIVERS\wfplwf.sys
  \SystemRoot\system32\DRIVERS\pacer.sys
  \SystemRoot\system32\DRIVERS\vwififlt.sys
  \SystemRoot\system32\DRIVERS\netbios.sys
  \SystemRoot\system32\DRIVERS\wanarp.sys
  \SystemRoot\system32\DRIVERS\termdd.sys
  \SystemRoot\system32\DRIVERS\rdbss.sys
  \SystemRoot\system32\drivers\nsiproxy.sys
  \SystemRoot\system32\DRIVERS\mssmbios.sys
  \SystemRoot\System32\drivers\discache.sys
  \SystemRoot\system32\drivers\csc.sys
  \SystemRoot\System32\Drivers\dfsc.sys
  \SystemRoot\system32\DRIVERS\blbdrive.sys
  \SystemRoot\system32\DRIVERS\avkmgr.sys
  \SystemRoot\system32\DRIVERS\avipbb.sys
  \SystemRoot\system32\DRIVERS\tunnel.sys
  \SystemRoot\system32\DRIVERS\wmiacpi.sys
  \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  \SystemRoot\System32\drivers\dxgkrnl.sys
  \SystemRoot\System32\drivers\dxgmms1.sys
  \SystemRoot\system32\DRIVERS\HDAudBus.sys
  \SystemRoot\system32\DRIVERS\HECIx64.sys
  \SystemRoot\system32\DRIVERS\usbehci.sys
  \SystemRoot\system32\DRIVERS\USBPORT.SYS
  \SystemRoot\system32\DRIVERS\1394ohci.sys
  \SystemRoot\system32\DRIVERS\sdbus.sys
  \SystemRoot\system32\DRIVERS\rtl8192se.sys
  \SystemRoot\system32\DRIVERS\vwifibus.sys
  \SystemRoot\system32\DRIVERS\L1C62x64.sys
  \SystemRoot\system32\DRIVERS\i8042prt.sys
  \SystemRoot\system32\DRIVERS\kbdclass.sys
  \SystemRoot\system32\DRIVERS\mouclass.sys
  \SystemRoot\system32\DRIVERS\intelppm.sys
  \SystemRoot\system32\DRIVERS\CmBatt.sys
  \SystemRoot\system32\DRIVERS\CompositeBus.sys
  \SystemRoot\system32\DRIVERS\AgileVpn.sys
  \SystemRoot\system32\DRIVERS\rasl2tp.sys
  \SystemRoot\system32\DRIVERS\ndistapi.sys
  \SystemRoot\system32\DRIVERS\ndiswan.sys
  \SystemRoot\system32\DRIVERS\raspppoe.sys
  \SystemRoot\system32\DRIVERS\raspptp.sys
  \SystemRoot\system32\DRIVERS\rassstp.sys
  \SystemRoot\system32\DRIVERS\rdpbus.sys
  \SystemRoot\system32\DRIVERS\swenum.sys
  \SystemRoot\system32\DRIVERS\ks.sys
  \SystemRoot\system32\DRIVERS\umbus.sys
  \SystemRoot\system32\drivers\nvvad64v.sys
  \SystemRoot\system32\drivers\portcls.sys
  \SystemRoot\system32\drivers\drmk.sys
  \SystemRoot\system32\drivers\ksthunk.sys
  \SystemRoot\system32\DRIVERS\usbhub.sys
  \SystemRoot\system32\DRIVERS\sffp_sd.sys
  \SystemRoot\system32\DRIVERS\sffdisk.sys
  \SystemRoot\System32\Drivers\NDProxy.SYS
  \SystemRoot\system32\drivers\nvhda64v.sys
  \SystemRoot\system32\drivers\HdAudio.sys
  \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  \SystemRoot\system32\DRIVERS\USBD.SYS
  \SystemRoot\System32\Drivers\fastfat.SYS
  \SystemRoot\system32\DRIVERS\usbccgp.sys
  \SystemRoot\System32\Drivers\usbvideo.sys
  \SystemRoot\System32\Drivers\crashdmp.sys
  \SystemRoot\System32\Drivers\dump_diskdump.sys
  \SystemRoot\System32\Drivers\dump_iaStorA.sys
  \SystemRoot\System32\Drivers\dump_dumpfve.sys
  \SystemRoot\System32\win32k.sys
  \SystemRoot\System32\drivers\Dxapi.sys
  \SystemRoot\system32\DRIVERS\monitor.sys
  \SystemRoot\System32\TSDDD.dll
  \SystemRoot\System32\cdd.dll
  \SystemRoot\system32\drivers\luafv.sys
  \SystemRoot\system32\DRIVERS\avgntflt.sys
  \SystemRoot\system32\drivers\WudfPf.sys
  \SystemRoot\system32\DRIVERS\lltdio.sys
  \SystemRoot\system32\DRIVERS\nwifi.sys
  \SystemRoot\system32\DRIVERS\ndisuio.sys
  \SystemRoot\system32\DRIVERS\rspndr.sys
  \SystemRoot\system32\drivers\HTTP.sys
  \SystemRoot\system32\DRIVERS\bowser.sys
  \SystemRoot\System32\drivers\mpsdrv.sys
  \SystemRoot\system32\DRIVERS\mrxsmb.sys
  \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  \SystemRoot\system32\drivers\peauth.sys
  \SystemRoot\System32\Drivers\secdrv.SYS
  \SystemRoot\System32\DRIVERS\srvnet.sys
  \SystemRoot\System32\drivers\tcpipreg.sys
  \SystemRoot\System32\DRIVERS\srv2.sys
  \SystemRoot\System32\DRIVERS\srv.sys
  \SystemRoot\system32\DRIVERS\WUDFRd.sys
  \??\C:\Windows\system32\drivers\mbamchameleon.sys
  \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
  \Windows\System32\ntdll.dll
  \Windows\System32\smss.exe
  \Windows\System32\apisetschema.dll
  ----------- End -----------
  Done!
  <<<1>>>
  Upper Device Name: \Device\Harddisk2\DR1
  Upper Device Object: 0xfffffa80082bf060
  Upper Device Driver Name: \Driver\Disk\
  Lower Device Name: \Device\00000086\
  Lower Device Object: 0xfffffa80082bd750
  Lower Device Driver Name: \Driver\USBSTOR\
  <<<1>>>
  Upper Device Name: \Device\Harddisk0\DR0
  Upper Device Object: 0xfffffa8006e9d060
  Upper Device Driver Name: \Driver\Disk\
  Lower Device Name: \Device\0000006d\
  Lower Device Object: 0xfffffa80049e8230
  Lower Device Driver Name: \Driver\iaStorA\
  <<<2>>>
  Physical Sector Size: 512
  Drive: 0, DevicePointer: 0xfffffa8006e9d060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa8006e9db90, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa8006e9d060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  DevicePointer: 0xfffffa8006d29c50, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa80049e8230, DeviceName: \Device\0000006d\, DriverName: \Driver\iaStorA\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  <<<3>>>
  Volume: C:
  File system type: NTFS
  SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
  <<<2>>>
  <<<3>>>
  Volume: C:
  File system type: NTFS
  SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
  Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
  <<<2>>>
  <<<3>>>
  Volume: C:
  File system type: NTFS
  SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
  Done!
  Drive 0
  Scanning MBR on drive 0...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 508F9BBB
  
  Partition information:
  
  Partition 0 type is Primary (0x7)
  Partition is ACTIVE.
  Partition starts at LBA: 2048 Numsec = 204800
  Partition file system is NTFS
  Partition is bootable
  
  Partition 1 type is Primary (0x7)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 206848 Numsec = 487868416
  
  Partition 2 type is Primary (0x7)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 488075264 Numsec = 488697856
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 500107862016 bytes
  Sector size: 512 bytes
  
  Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
  Done!
  Physical Sector Size: 512
  Drive: 1, DevicePointer: 0xfffffa800755b4a0, DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa800755cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa800755b4a0, DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  DevicePointer: 0xfffffa800755c040, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa800755b780, DeviceName: Unknown, DriverName: \Driver\sffp_sd\
  DevicePointer: 0xfffffa8007559060, DeviceName: \Device\SdBus-0\, DriverName: \Driver\sdbus\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  Drive 1
  Scanning MBR on drive 1...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 0
  
  Partition information:
  
  Partition 0 type is Other (0x6)
  Partition is ACTIVE.
  Partition starts at LBA: 227 Numsec = 3862301
  Partition file system is FAT
  Partition is not bootable
  
  Partition 1 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 2 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 1977614336 bytes
  Sector size: 512 bytes
  
  Done!
  Physical Sector Size: 512
  Drive: 2, DevicePointer: 0xfffffa80082bf060, DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa80082be790, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa80082bf060, DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  DevicePointer: 0xfffffa80082b9300, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa80082bd750, DeviceName: \Device\00000086\, DriverName: \Driver\USBSTOR\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  Drive 2
  Scanning MBR on drive 2...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 590212
  
  Partition information:
  
  Partition 0 type is Other (0xe)
  Partition is ACTIVE.
  Partition starts at LBA: 63 Numsec = 127877
  Partition file system is FAT
  Partition is not bootable
  
  Partition 1 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 2 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 65505280 bytes
  Sector size: 512 bytes
  
  Done!
  Infected: C:\Windows\System32\DpiScaling.exe --> [Trojan.FakeMS]
  Infected: C:\Windows\System32\s.ico --> [Malware.Trace]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ --> [Trojan.0Access]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \... --> [Trojan.0Access]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\??? --> [Trojan.0Access]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0} --> [Trojan.0Access]
  Infected: c:\Program Files (x86)\Google\Desktop\Install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\googleupdate.exe --> [Trojan.0Access]
  Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE --> [Trojan.0Access]
  Infected: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE --> [Trojan.0Access]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\l --> [Trojan.0Access]
  Infected: c:\Program Files (x86)\Google\Desktop\Install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\L\00000004.@ --> [Trojan.0Access]
  Infected: c:\Program Files (x86)\Google\Desktop\Install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\L\201d3dde --> [Trojan.0Access]
  Infected: c:\Program Files (x86)\Google\Desktop\Install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\L\76603ac3 --> [Trojan.0Access]
  Infected: c:\program files (x86)\google\desktop\install\{e0351537-05f6-14f2-5011-52522b4c0bf0}\ \...\???\{e0351537-05f6-14f2-5011-52522b4c0bf0}\u --> [Trojan.0Access]
  Infected: C:\Program Files (x86)\Google\Desktop\Install\{e0351537-05f6-14f2-5011-52522b4c0bf0} --> [Trojan.0Access]
  Scan finished
  Creating System Restore point...
  Cleaning up...
  Executing an action fixdamage.exe...
  Success!
  Queuing an action fixdamage.exe
  Removal scheduling successful. System shutdown needed.
  System shutdown occurred
  =======================================
  
  ---------------------------------------
  Malwarebytes Anti-Rootkit BETA 1.07.0.1007
  
  (c) Malwarebytes Corporation 2011-2012
  
  OS version: 6.1.7601 Windows 7 Service Pack 1 x64
  
  Account is Administrative
  
  Internet Explorer version: 10.0.9200.16721
  
  File system is: NTFS
  Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
  CPU speed: 2.128000 GHz
  Memory total: 4148662272, free: 3005517824
  
  =======================================
  ---------------------------------------
  Malwarebytes Anti-Rootkit BETA 1.07.0.1007
  
  (c) Malwarebytes Corporation 2011-2012
  
  OS version: 6.1.7601 Windows 7 Service Pack 1 x64
  
  Account is Administrative
  
  Internet Explorer version: 10.0.9200.16721
  
  File system is: NTFS
  Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
  CPU speed: 2.128000 GHz
  Memory total: 4148662272, free: 2131664896
  
  =======================================
  Initializing...
  ------------ Kernel report ------------
  10/31/2013 18:02:50
  ------------ Loaded modules -----------
  \SystemRoot\system32\ntoskrnl.exe
  \SystemRoot\system32\hal.dll
  \SystemRoot\system32\kdcom.dll
  \SystemRoot\system32\mcupdate_GenuineIntel.dll
  \SystemRoot\system32\PSHED.dll
  \SystemRoot\system32\CLFS.SYS
  \SystemRoot\system32\CI.dll
  \SystemRoot\system32\drivers\CLASSPNP.SYS
  \SystemRoot\System32\drivers\imofugc.sys
  \SystemRoot\system32\drivers\Wdf01000.sys
  \SystemRoot\system32\drivers\WDFLDR.SYS
  \SystemRoot\system32\drivers\ACPI.sys
  \SystemRoot\system32\drivers\WMILIB.SYS
  \SystemRoot\system32\drivers\msisadrv.sys
  \SystemRoot\system32\drivers\pci.sys
  \SystemRoot\system32\drivers\vdrvroot.sys
  \SystemRoot\System32\drivers\partmgr.sys
  \SystemRoot\system32\drivers\compbatt.sys
  \SystemRoot\system32\drivers\BATTC.SYS
  \SystemRoot\system32\drivers\volmgr.sys
  \SystemRoot\System32\drivers\volmgrx.sys
  \SystemRoot\System32\drivers\mountmgr.sys
  \SystemRoot\system32\drivers\atapi.sys
  \SystemRoot\system32\drivers\ataport.SYS
  \SystemRoot\system32\drivers\msahci.sys
  \SystemRoot\system32\drivers\PCIIDEX.SYS
  \SystemRoot\system32\DRIVERS\iaStorA.sys
  \SystemRoot\system32\DRIVERS\storport.sys
  \SystemRoot\system32\drivers\amdxata.sys
  \SystemRoot\system32\drivers\fltmgr.sys
  \SystemRoot\system32\drivers\fileinfo.sys
  \SystemRoot\System32\Drivers\Ntfs.sys
  \SystemRoot\System32\Drivers\msrpc.sys
  \SystemRoot\System32\Drivers\ksecdd.sys
  \SystemRoot\System32\Drivers\cng.sys
  \SystemRoot\System32\drivers\pcw.sys
  \SystemRoot\System32\Drivers\Fs_Rec.sys
  \SystemRoot\system32\drivers\ndis.sys
  \SystemRoot\system32\drivers\NETIO.SYS
  \SystemRoot\System32\Drivers\ksecpkg.sys
  \SystemRoot\System32\drivers\tcpip.sys
  \SystemRoot\System32\drivers\fwpkclnt.sys
  \SystemRoot\system32\drivers\vmstorfl.sys
  \SystemRoot\system32\drivers\volsnap.sys
  \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
  \SystemRoot\System32\Drivers\spldr.sys
  \SystemRoot\System32\drivers\rdyboost.sys
  \SystemRoot\System32\Drivers\mup.sys
  \SystemRoot\system32\DRIVERS\iaStorF.sys
  \SystemRoot\System32\drivers\hwpolicy.sys
  \SystemRoot\System32\DRIVERS\fvevol.sys
  \SystemRoot\system32\drivers\disk.sys
  \SystemRoot\system32\DRIVERS\cdrom.sys
  \SystemRoot\System32\Drivers\Null.SYS
  \SystemRoot\System32\Drivers\Beep.SYS
  \SystemRoot\System32\drivers\vga.sys
  \SystemRoot\System32\drivers\VIDEOPRT.SYS
  \SystemRoot\System32\drivers\watchdog.sys
  \SystemRoot\System32\DRIVERS\RDPCDD.sys
  \SystemRoot\system32\drivers\rdpencdd.sys
  \SystemRoot\system32\drivers\rdprefmp.sys
  \SystemRoot\System32\Drivers\Msfs.SYS
  \SystemRoot\System32\Drivers\Npfs.SYS
  \SystemRoot\system32\DRIVERS\tdx.sys
  \SystemRoot\system32\DRIVERS\TDI.SYS
  \SystemRoot\system32\drivers\afd.sys
  \SystemRoot\System32\DRIVERS\netbt.sys
  \SystemRoot\system32\DRIVERS\wfplwf.sys
  \SystemRoot\system32\DRIVERS\pacer.sys
  \SystemRoot\system32\DRIVERS\vwififlt.sys
  \SystemRoot\system32\DRIVERS\netbios.sys
  \SystemRoot\system32\DRIVERS\wanarp.sys
  \SystemRoot\system32\DRIVERS\termdd.sys
  \SystemRoot\system32\DRIVERS\rdbss.sys
  \SystemRoot\system32\drivers\nsiproxy.sys
  \SystemRoot\system32\DRIVERS\mssmbios.sys
  \SystemRoot\System32\drivers\discache.sys
  \SystemRoot\system32\drivers\csc.sys
  \SystemRoot\System32\Drivers\dfsc.sys
  \SystemRoot\system32\DRIVERS\blbdrive.sys
  \SystemRoot\system32\DRIVERS\avkmgr.sys
  \SystemRoot\system32\DRIVERS\avipbb.sys
  \SystemRoot\system32\DRIVERS\tunnel.sys
  \SystemRoot\system32\DRIVERS\wmiacpi.sys
  \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  \SystemRoot\System32\drivers\dxgkrnl.sys
  \SystemRoot\System32\drivers\dxgmms1.sys
  \SystemRoot\system32\DRIVERS\HDAudBus.sys
  \SystemRoot\system32\DRIVERS\HECIx64.sys
  \SystemRoot\system32\DRIVERS\usbehci.sys
  \SystemRoot\system32\DRIVERS\USBPORT.SYS
  \SystemRoot\system32\DRIVERS\1394ohci.sys
  \SystemRoot\system32\DRIVERS\sdbus.sys
  \SystemRoot\system32\DRIVERS\rtl8192se.sys
  \SystemRoot\system32\DRIVERS\vwifibus.sys
  \SystemRoot\system32\DRIVERS\L1C62x64.sys
  \SystemRoot\system32\DRIVERS\i8042prt.sys
  \SystemRoot\system32\DRIVERS\kbdclass.sys
  \SystemRoot\system32\DRIVERS\mouclass.sys
  \SystemRoot\system32\DRIVERS\intelppm.sys
  \SystemRoot\system32\DRIVERS\CmBatt.sys
  \SystemRoot\system32\DRIVERS\CompositeBus.sys
  \SystemRoot\system32\DRIVERS\AgileVpn.sys
  \SystemRoot\system32\DRIVERS\rasl2tp.sys
  \SystemRoot\system32\DRIVERS\ndistapi.sys
  \SystemRoot\system32\DRIVERS\ndiswan.sys
  \SystemRoot\system32\DRIVERS\raspppoe.sys
  \SystemRoot\system32\DRIVERS\raspptp.sys
  \SystemRoot\system32\DRIVERS\rassstp.sys
  \SystemRoot\system32\DRIVERS\rdpbus.sys
  \SystemRoot\system32\DRIVERS\swenum.sys
  \SystemRoot\system32\DRIVERS\ks.sys
  \SystemRoot\system32\DRIVERS\umbus.sys
  \SystemRoot\system32\drivers\nvvad64v.sys
  \SystemRoot\system32\drivers\portcls.sys
  \SystemRoot\system32\drivers\drmk.sys
  \SystemRoot\system32\drivers\ksthunk.sys
  \SystemRoot\system32\DRIVERS\usbhub.sys
  \SystemRoot\system32\DRIVERS\sffp_sd.sys
  \SystemRoot\system32\DRIVERS\sffdisk.sys
  \SystemRoot\System32\Drivers\NDProxy.SYS
  \SystemRoot\system32\drivers\nvhda64v.sys
  \SystemRoot\system32\drivers\HdAudio.sys
  \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  \SystemRoot\system32\DRIVERS\USBD.SYS
  \SystemRoot\System32\Drivers\fastfat.SYS
  \SystemRoot\system32\DRIVERS\usbccgp.sys
  \SystemRoot\System32\Drivers\usbvideo.sys
  \SystemRoot\System32\Drivers\crashdmp.sys
  \SystemRoot\System32\Drivers\dump_diskdump.sys
  \SystemRoot\System32\Drivers\dump_iaStorA.sys
  \SystemRoot\System32\Drivers\dump_dumpfve.sys
  \SystemRoot\System32\win32k.sys
  \SystemRoot\System32\drivers\Dxapi.sys
  \SystemRoot\system32\DRIVERS\monitor.sys
  \SystemRoot\System32\TSDDD.dll
  \SystemRoot\System32\cdd.dll
  \SystemRoot\system32\drivers\luafv.sys
  \SystemRoot\system32\DRIVERS\avgntflt.sys
  \SystemRoot\system32\drivers\WudfPf.sys
  \SystemRoot\system32\DRIVERS\lltdio.sys
  \SystemRoot\system32\DRIVERS\nwifi.sys
  \SystemRoot\system32\DRIVERS\ndisuio.sys
  \SystemRoot\system32\DRIVERS\rspndr.sys
  \SystemRoot\system32\drivers\HTTP.sys
  \SystemRoot\system32\DRIVERS\bowser.sys
  \SystemRoot\System32\drivers\mpsdrv.sys
  \SystemRoot\system32\DRIVERS\mrxsmb.sys
  \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  \SystemRoot\system32\drivers\peauth.sys
  \SystemRoot\System32\Drivers\secdrv.SYS
  \SystemRoot\System32\DRIVERS\srvnet.sys
  \SystemRoot\System32\drivers\tcpipreg.sys
  \SystemRoot\System32\DRIVERS\srv2.sys
  \SystemRoot\System32\DRIVERS\srv.sys
  \SystemRoot\system32\DRIVERS\WUDFRd.sys
  \SystemRoot\system32\drivers\spsys.sys
  \??\C:\Windows\system32\drivers\mbamchameleon.sys
  \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
  \Windows\System32\ntdll.dll
  \Windows\System32\smss.exe
  \Windows\System32\apisetschema.dll
  ----------- End -----------
  Done!
  <<<1>>>
  Upper Device Name: \Device\Harddisk2\DR1
  Upper Device Object: 0xfffffa80080c3790
  Upper Device Driver Name: \Driver\Disk\
  Lower Device Name: \Device\00000086\
  Lower Device Object: 0xfffffa80080c0700
  Lower Device Driver Name: \Driver\USBSTOR\
  <<<1>>>
  Upper Device Name: \Device\Harddisk0\DR0
  Upper Device Object: 0xfffffa8006e9d060
  Upper Device Driver Name: \Driver\Disk\
  Lower Device Name: \Device\0000006d\
  Lower Device Object: 0xfffffa80049e2770
  Lower Device Driver Name: \Driver\iaStorA\
  <<<2>>>
  Physical Sector Size: 512
  Drive: 0, DevicePointer: 0xfffffa8006e9d060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa8006e9db90, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa8006e9d060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  DevicePointer: 0xfffffa8006d2cad0, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa80049e2770, DeviceName: \Device\0000006d\, DriverName: \Driver\iaStorA\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  <<<3>>>
  Volume: C:
  File system type: NTFS
  SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
  Drive 0
  Scanning MBR on drive 0...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 508F9BBB
  
  Partition information:
  
  Partition 0 type is Primary (0x7)
  Partition is ACTIVE.
  Partition starts at LBA: 2048 Numsec = 204800
  Partition file system is NTFS
  Partition is bootable
  
  Partition 1 type is Primary (0x7)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 206848 Numsec = 487868416
  
  Partition 2 type is Primary (0x7)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 488075264 Numsec = 488697856
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 500107862016 bytes
  Sector size: 512 bytes
  
  Done!
  Physical Sector Size: 512
  Drive: 1, DevicePointer: 0xfffffa8007572970, DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa80075724a0, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa8007572970, DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  DevicePointer: 0xfffffa8007572c50, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa80075684c0, DeviceName: Unknown, DriverName: \Driver\sffp_sd\
  DevicePointer: 0xfffffa800756b8b0, DeviceName: \Device\SdBus-0\, DriverName: \Driver\sdbus\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk1\SR0\, DriverName: \Driver\sffdisk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  Drive 1
  Scanning MBR on drive 1...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 0
  
  Partition information:
  
  Partition 0 type is Other (0x6)
  Partition is ACTIVE.
  Partition starts at LBA: 227 Numsec = 3862301
  Partition file system is FAT
  Partition is not bootable
  
  Partition 1 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 2 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 1977614336 bytes
  Sector size: 512 bytes
  
  Done!
  Physical Sector Size: 512
  Drive: 2, DevicePointer: 0xfffffa80080c3790, DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  --------- Disk Stack ------
  DevicePointer: 0xfffffa80080c2040, DeviceName: Unknown, DriverName: \Driver\partmgr\
  DevicePointer: 0xfffffa80080c3790, DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  DevicePointer: 0xfffffa80080c0c50, DeviceName: Unknown, DriverName: \Driver\iaStorF\
  DevicePointer: 0xfffffa80080c0700, DeviceName: \Device\00000086\, DriverName: \Driver\USBSTOR\
  ------------ End ----------
  Alternate DeviceName: \Device\Harddisk2\DR1\, DriverName: \Driver\Disk\
  Upper DeviceData: 0x0, 0x0, 0x0
  Lower DeviceData: 0x0, 0x0, 0x0
  Drive 2
  Scanning MBR on drive 2...
  Inspecting partition table:
  MBR Signature: 55AA
  Disk Signature: 590212
  
  Partition information:
  
  Partition 0 type is Other (0xe)
  Partition is ACTIVE.
  Partition starts at LBA: 63 Numsec = 127877
  Partition file system is FAT
  Partition is not bootable
  
  Partition 1 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 2 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Partition 3 type is Empty (0x0)
  Partition is NOT ACTIVE.
  Partition starts at LBA: 0 Numsec = 0
  
  Disk Size: 65505280 bytes
  Sector size: 512 bytes
  
  Done!
  Scan finished
  =======================================
  
  Removal queue found; removal started
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_2048_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_1_0_227_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_r.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_2_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_2_0_63_i.mbam...
  Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_2_r.mbam...
  Removal finished
  
  0
2. Nan'Antho Messages postés 9 Statut Membre
  
  https://pjjoint.malekal.com/files.php?read=20131031_11b13n1412u11
  
  0
Réponse 4 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

je pense qu'on est au bout.
Utilise Eset Repair pour réparer les services : https://forum.malekal.com/viewtopic.php?t=36444&start=

comment va le PC ?
0

Newsletters