TROJAN W32.AGENT.Z2 et autres... Fermé

Question

Bonjour,

J'éspère trouver ici quelqu'un susceptible de pouvoir m'aider par rapport à mon problème de trojans.

Suite à des alertes de mon antivirus ANTIVIR XP, lorsque je me connecte sur internet, j'ai contacté l'assistance Microsoft pour qu'elle me vienne en aide. Ces derniers m'ont fait téléchargé Mc Afee Stinger, Trojan Remover, A², un anti-Sasser..., que j'ai effectués en mode sans échec.

Seulement depuis que j'ai téléchargé tous ces fichiers, lorsque je reviens sur internet, les alertes se sont grandement multipliées.
Antivir détecte les trojans "Win32.Agent.an", "Dldr.Agent.Z.2", "Dldr.winSh.AC.02", etc... dans de multiples emplacements ".EXE", ".DAT" et ".DLL", mais malgré que je lui ordonne de les supprimer, les alertes sont toujours là.

Je sais aussi que l'on peut les éliminer manuellement, mais comment faire ? Comment désinfecter sans supprimer mes fichiers ? Ces trojans ont ils un nom et un outil de suppression spécifiques ?

Je vous remercie d'avance,
Elodie

OCB · Answer

passe un scann ici www.secuser.com ou ici www.ravantivirus.com et colle le rapport ici et apres on verra ce qu'on peut faire

knarf · Answer

Salut ! pour ton probleme de trojans et autres virus je te conseil de telecharger Kaspersky anti-virus 5.0 en version d'essaie de le mettre a jour de le configurer en protection+ analyse maximale et de selectionner
"analyser mon poste de travail" cet anti-virus est le meilleur du maché
je suis convaincu qu'il elimineras tout tes virus present sur ton disque dur
selectionne aussi "confirmer l'action aupres de l'utilisateur" et le tour est joué ! ensuite je te conseil de l'acheter y'a pas mieux dans les test il est no 1 voilà tiens-moi au courrant
@ + Knarf.

OCB · Answer

si antivir ne le détruit pas c'est que le trojan est surement dans un fichier qui est proteger doc ca changera rien le meilleur moyen c'est le scann en ligne

knarf · Answer

resalut antivir n'est pas comparable a KAV 5 ça ne te coute rien d'essayer ! l'avantage de KAV5 c qu'il desinfect radicalement ta machine, de + la nlle version 5.0142 te permet de faire un scan en mode sans echec , ça m'est t'arrivé de chopé un trojan downloader et KAV 5 la supprimé purement et simplement, installe le et tu verra.
@ +

OCB · Answer

antivir n'est pas comparable a KAV 5d'apres quels criteres ?

OCB · Answer

eh mais moi j'ai pas de problemes la on aide berger elodie

BmV · Answer

Salut.
1 - les "virus" détectés sous les noms de "backdoor.xxxx" ou de "trojan.xxxx" ou de "troj.xxxx" ne sont pas vraiment des virus mais des chevaux de troie (lire => http://www.commentcamarche.net/virus/trojan.php3) dont les antivirus traditionnels ont toujours du mal à se débarrasser ; ils ne sont en principe pas destructifs. Il ne suffit pas de les virer, il faut les empêcher de revenir !
2 - un logiciel facile, gratos et efficace pour en virer certains c'est SpybotS&d, avec notamment une version française, disponible ici http://sebsauvage.net/logiciels/spybotsd.html ou TheCleaner ici http://www.moosoft.com/thecleaner/ ou encore http://www.kephyr.com/spywarescanner/index.html ; tu peux aussi commencer par un scan anti-troyens ici http://assiste.free.fr/p/frameset/03_06.php .
3 - Important : l'installation d'un firewall http://www.commentcamarche.net/lan/firewall.php3 pour éviter ce genre de soucis est absolument indispensable ; large choix ici => http://www.firewall-net.com/fr/
4 - lire aussi, et dès que possible, la page "SafeHex" sur ce site http://sebsauvage.net/
A+

-=O(_BmV_)O=- L'amour comme épée,
|| || l'humour comme bouclier.

Elodie Berger · Answer

Suite à votre conversation, j'ai téléchargé kav5, mais une fois l'installation faite (mais apparement déficiente), mon ordi s'est planté, tout était bloqué. J'ai dù redémarrer en mode sans échec pour le faire fonctionner, et j'ai désinstallé kav5, après quoi tout a refonctionné normalement.
Depuis je n'ose plus rien faire, et je vais attendre la rentrée pour l'emmener à réparer !

Elodie Berger · Answer

J'ai quand même effectué un scann de mon ordi, par curiosité ; si cela peut inspirer quelqu'un...

Elodie Berger · Answer

(SCANN AVEC ANTIVIR):

Creation date of the report file: 10.07.2004 09:43

AntiVir®/XP (2000 + NT) Personal Edition v6.26.00.01 of 06.07.2004
VDF file v6.26.0.22 (0) of 09.07.2004

This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.

Scanning for 87634 virus strains and unwanted programs.

Licensed for: AntiVir Personal Edition
Serial number: 0000149996-ADJIE-0001
FUSE: Basic license

Please enter the workstation and
contact name with phone number in this form:

Name ___________________________________________

Street ___________________________________________

Town ___________________________________________

Phone/Fax ___________________________________________

EMail ___________________________________________

Platform: Windows NT Workstation
Windows version: 5.1 Build 2600 ()
Username: Gérard Berger
Computername: CYRRUS
Processor: Pentium
Working memory: 261616 KB free

Version information:
AVWIN.DLL : v6.26.01.01 557096 06.07.2004 14:42:54
AVEWIN32.DLL : v6.26.0.5 434688 06.07.2004 10:51:50
AVGNT.EXE : v6.26.00.08 122920 07.07.2004 11:38:04
AVGUARD.EXE : v6.26.00.10 233512 06.07.2004 11:35:06
GUARDMSG.DLL : v6.26.00.03 90152 26.05.2004 12:33:30
AVGCMSG.DLL : v6.26.00.00 245800 26.05.2004 13:55:40
AVGNTDD.SYS : v6.26.00.07 34016 25.05.2004 18:35:04
AVPACK32.DLL : v6.22.00.24 299048 09.06.2004 16:05:52
AVGETVER.DLL : v6.22.00.00 24576 20.01.2004 14:14:00
AVWIN.DLL : v6.26.01.01 557096 06.07.2004 14:42:54
AVSHLEXT.DLL : v6.22.00.00 57344 20.01.2004 14:14:00
AVSched32.EXE : v6.23.00.00 110632 20.01.2004 14:14:00
AVSched32.DLL : v6.23.00.00 122880 20.01.2004 14:14:00
AVREG.DLL : v6.22.00.00 41000 20.01.2004 14:14:00
AVRep.DLL : v6.26.00.08 483368 08.07.2004 12:49:02
INETUPD.EXE : v6.26.00.01 200704 27.05.2004 12:50:44
INETUPD.DLL : v6.26.00.01 143360 27.05.2004 12:50:44
CTL3D32.DLL : v2.31.000 27136 28.08.2001 14:00:00
MFC42.DLL : v6.00.8665.0 995383 28.08.2001 14:00:00
MSVCRT.DLL : v7.0.2600.0 (xpclient.010817-1148
MSVCRT.DLL : v7.0.2600.0 (x 322560 28.08.2001 14:00:00
CTL3DV2.DLL : v2.04 21648 19.04.1994 00:00:00

Configuration file:

Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
Name of report file: C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
Start path: C:\Program Files\AVPersonal
Command line:
Start mode: unknown

Mode of report file:
[ ] Do not create report
[X] Overwrite report
[ ] Append new report

Data in report file:
[X] Infected files
[ ] Infected files with paths
[ ] All scanned files
[ ] Full information

Abridge report file:
[ ] Abridge report file

Warnings in report:
[X] Access denied/file locked
[X] Wrong file size in directory
[X] Wrong creation time in directory
[ ] COM file is too large
[X] Invalid start address
[X] Invalid EXE header
[X] Possibly damaged

Summary report:
[X] Create summary report
Output file: AVWIN.ACT
Maximum number of entries: 100

Where to search:
[X] Memory
[X] Boot record of selected drives
[X] Report unknown boot sectors
[X] All files
[ ] Program files

Response in case of a detection:
[X] Repair with prompt
[ ] Repair without prompt
[ ] Delete with prompt
[ ] Delete without prompt
[ ] Write in report file only
[X] Acoustic alarm

Response in case of destroyed files:
[X] Delete with prompt
[ ] Delete without prompt
[ ] Ignore

Response in case of destroyed files:
[X] No change
[ ] Current system time
[ ] Correct date

Drag&drop settings:
[X] Scan subdirectories

Profile settings:
[X] Scan subdirectories

Archive options
[X] Search archive
[X] All archive types

Miscellaneous options:
Temporary path: %TEMP% -> C:\temp
[X] Overwrite infected files
[ ] Detect idle time
[X] Allow interruptions of scan
[ ] Load AVWin®/NT Guard on System start

General settings:
[X] Save options on exiting AntiVir
Priority: medium

Drives:
A: Floppy drive
C: Hard disk
D: CD-ROM
E: CD-ROM

Start of scan: 10.07.2004 09:43

Memory test OK
Master boot record of hard disk HD0 OK
Boot record of drive C: OK

C:\
hiberfil.sys
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
pagefile.sys
Access denied! Error during file opening!
This is a Windows swap file. This file is locked by Windows.
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Gérard Berger
ntuser.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Gérard Berger\Bureau\Antivirus\NOD32
nodwntfr.exe
ArchiveType: RAR SFX (self extracting)
--> DISK1\data1.dat
ArchiveType: RAR
--> nms32.dll
WARNING! Error open file
C:\Documents and Settings\Gérard Berger\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\Gérard Berger\Local Settings\Temporary Internet Files\Content.IE5\CR8XCBFM
Menu[1].zip
ArchiveType: ZIP
NOTE! No files to extract.
C:\Documents and Settings\Gérard Berger\Local Settings\Temporary Internet Files\Content.IE5\DBFZPXCA
walledgarden[1].
Access denied! Error during file opening!
Error code: 0x0002
WARNING! Access error/file locked!
C:\Documents and Settings\Gérard Berger\Local Settings\Temporary Internet Files\Content.IE5\EYBHT39J
xscan53[1].cab
ArchiveType: CAB (Microsoft)
--> xscan.inf
NOTE! Bad header
--> xscan53.ocx
NOTE! Bad header
--> loadhttp.dll
NOTE! Bad header
--> patchw32.dll
NOTE! Bad header
--> tmupdate.ini
NOTE! Bad header
--> aucfg.ini
NOTE! Bad header
--> runtsckl.exe
NOTE! Bad header
C:\Documents and Settings\LocalService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\NetworkService
NTUSER.DAT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
ntuser.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows
UsrClass.dat
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
UsrClass.dat.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Install\Logiciel\Upd\PA2000\MAJ\2.2.1.4
Pa2000.zip
ArchiveType: ZIP
--> TV.zip
ArchiveType: ZIP
--> Symbol\SYM0062.bmp
Unkown Error
--> Symbol\SYM0002.bmp
Unkown Error
--> Symbol\SYM0003.bmp
Unkown Error
--> Symbol\SYM0004.bmp
Unkown Error
--> Symbol\SYM0005.bmp
Unkown Error
--> Symbol\SYM0006.bmp
Unkown Error
--> Symbol\SYM0007.bmp
Unkown Error
--> Symbol\SYM0008.bmp
Unkown Error
--> Symbol\SYM0009.bmp
Unkown Error
--> Symbol\SYM0010.bmp
Unkown Error
--> Symbol\SYM0011.bmp
Unkown Error
--> Symbol\SYM0012.bmp
Unkown Error
--> Symbol\SYM0013.bmp
Unkown Error
--> Symbol\SYM0014.bmp
Unkown Error
--> Symbol\SYM0015.bmp
Unkown Error
--> Symbol\SYM0016.bmp
Unkown Error
--> Symbol\SYM0017.bmp
Unkown Error
--> Symbol\SYM0018.bmp
Unkown Error
--> Symbol\SYM0019.bmp
Unkown Error
--> Symbol\SYM0020.bmp
Unkown Error
--> Symbol\SYM0021.bmp
Unkown Error
--> Symbol\SYM0022.bmp
Unkown Error
--> Symbol\SYM0023.bmp
Unkown Error
--> Symbol\SYM0024.bmp
Unkown Error
--> Symbol\SYM0025.bmp
Unkown Error
--> Symbol\SYM0026.bmp
Unkown Error
--> Symbol\SYM0027.bmp
Unkown Error
--> Symbol\SYM0028.bmp
Unkown Error
--> Symbol\SYM0029.bmp
Unkown Error
--> Symbol\SYM0030.bmp
Unkown Error
--> Symbol\SYM0031.bmp
Unkown Error
--> Symbol\SYM0032.bmp
Unkown Error
--> Symbol\SYM0033.bmp
Unkown Error
--> Symbol\SYM0034.bmp
Unkown Error
--> Symbol\SYM0035.bmp
Unkown Error
--> Symbol\SYM0036.bmp
Unkown Error
--> Symbol\SYM0037.bmp
Unkown Error
--> Symbol\SYM0038.bmp
Unkown Error
--> Symbol\SYM0039.bmp
Unkown Error
--> Symbol\SYM0040.bmp
Unkown Error
--> Symbol\SYM0041.bmp
Unkown Error
--> Symbol\SYM0042.bmp
Unkown Error
--> Symbol\SYM0043.bmp
Unkown Error
--> Symbol\SYM0044.bmp
Unkown Error
--> Symbol\SYM0045.bmp
Unkown Error
--> Symbol\SYM0046.bmp
Unkown Error
--> Symbol\SYM0047.bmp
Unkown Error
--> Symbol\SYM0048.bmp
Unkown Error
--> Symbol\SYM0049.bmp
Unkown Error
--> Symbol\SYM0050.bmp
Unkown Error
--> Symbol\SYM0051.bmp
Unkown Error
--> Symbol\SYM0052.bmp
Unkown Error
--> Symbol\SYM0053.bmp
Unkown Error
--> Symbol\SYM0054.bmp
Unkown Error
--> Symbol\SYM0055.bmp
Unkown Error
--> Symbol\SYM0056.bmp
Unkown Error
--> Symbol\SYM0057.bmp
Unkown Error
--> Symbol\SYM0058.bmp
Unkown Error
--> Symbol\SYM0059.bmp
Unkown Error
--> Symbol\SYM0060.bmp
Unkown Error
--> Symbol\SYM0061.bmp
Unkown Error
--> Symbol\SYM0001.bmp
Unkown Error
--> Symbol\SYM0063.bmp
Unkown Error
C:\Install\Logiciel\Upd\PA2000\MAJ\2.2.1.4\Pa2000
TV.zip
ArchiveType: ZIP
--> Symbol\SYM0062.bmp
Unkown Error
--> Symbol\SYM0002.bmp
Unkown Error
--> Symbol\SYM0003.bmp
Unkown Error
--> Symbol\SYM0004.bmp
Unkown Error
--> Symbol\SYM0005.bmp
Unkown Error
--> Symbol\SYM0006.bmp
Unkown Error
--> Symbol\SYM0007.bmp
Unkown Error
--> Symbol\SYM0008.bmp
Unkown Error
--> Symbol\SYM0009.bmp
Unkown Error
--> Symbol\SYM0010.bmp
Unkown Error
--> Symbol\SYM0011.bmp
Unkown Error
--> Symbol\SYM0012.bmp
Unkown Error
--> Symbol\SYM0013.bmp
Unkown Error
--> Symbol\SYM0014.bmp
Unkown Error
--> Symbol\SYM0015.bmp
Unkown Error
--> Symbol\SYM0016.bmp
Unkown Error
--> Symbol\SYM0017.bmp
Unkown Error
--> Symbol\SYM0018.bmp
Unkown Error
--> Symbol\SYM0019.bmp
Unkown Error
--> Symbol\SYM0020.bmp
Unkown Error
--> Symbol\SYM0021.bmp
Unkown Error
--> Symbol\SYM0022.bmp
Unkown Error
--> Symbol\SYM0023.bmp
Unkown Error
--> Symbol\SYM0024.bmp
Unkown Error
--> Symbol\SYM0025.bmp
Unkown Error
--> Symbol\SYM0026.bmp
Unkown Error
--> Symbol\SYM0027.bmp
Unkown Error
--> Symbol\SYM0028.bmp
Unkown Error
--> Symbol\SYM0029.bmp
Unkown Error
--> Symbol\SYM0030.bmp
Unkown Error
--> Symbol\SYM0031.bmp
Unkown Error
--> Symbol\SYM0032.bmp
Unkown Error
--> Symbol\SYM0033.bmp
Unkown Error
--> Symbol\SYM0034.bmp
Unkown Error
--> Symbol\SYM0035.bmp
Unkown Error
--> Symbol\SYM0036.bmp
Unkown Error
--> Symbol\SYM0037.bmp
Unkown Error
--> Symbol\SYM0038.bmp
Unkown Error
--> Symbol\SYM0039.bmp
Unkown Error
--> Symbol\SYM0040.bmp
Unkown Error
--> Symbol\SYM0041.bmp
Unkown Error
--> Symbol\SYM0042.bmp
Unkown Error
--> Symbol\SYM0043.bmp
Unkown Error
--> Symbol\SYM0044.bmp
Unkown Error
--> Symbol\SYM0045.bmp
Unkown Error
--> Symbol\SYM0046.bmp
Unkown Error
--> Symbol\SYM0047.bmp
Unkown Error
--> Symbol\SYM0048.bmp
Unkown Error
--> Symbol\SYM0049.bmp
Unkown Error
--> Symbol\SYM0050.bmp
Unkown Error
--> Symbol\SYM0051.bmp
Unkown Error
--> Symbol\SYM0052.bmp
Unkown Error
--> Symbol\SYM0053.bmp
Unkown Error
--> Symbol\SYM0054.bmp
Unkown Error
--> Symbol\SYM0055.bmp
Unkown Error
--> Symbol\SYM0056.bmp
Unkown Error
--> Symbol\SYM0057.bmp
Unkown Error
--> Symbol\SYM0058.bmp
Unkown Error
--> Symbol\SYM0059.bmp
Unkown Error
--> Symbol\SYM0060.bmp
Unkown Error
--> Symbol\SYM0061.bmp
Unkown Error
--> Symbol\SYM0001.bmp
Unkown Error
--> Symbol\SYM0063.bmp
Unkown Error
C:\Program Files\AVPersonal\INFECTED
APIWF.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
APPTM32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
ATLKU32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
ATLNG32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
ATLVX.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
CRND.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
CRRK.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
D3BG32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
D3ON32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
D3PW.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
D3YW.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
IEZI32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
IPHU.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
IPJN.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
IPPE.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
ipwo.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
ipwo.VIR00
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
JAVAOA32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
JAVAYQ32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
MFCDP32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
NKWHE.DAT.VIR
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
NPKMP.DAT.001
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
NPKMP.DAT.VIR
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
NTTX32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
PPEEU.DAT.VIR
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
PQXWM.DAT.VIR
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
SDKLP32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
SDKPL32.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
UUAKQ.DAT.001
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
UUAKQ.DAT.002
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
UUAKQ.DAT.003
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
UUAKQ.DAT.004
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
UUAKQ.DAT.VIR
[DETECTION] The Trojan horse TR/Dldr.WinSh.AC.02
WAS DELETED!
WINJR.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Agent.Z.2
WAS DELETED!
C:\Program Files\ESET\Install\DISK1
data1.dat
ArchiveType: RAR
--> nms32.dll
WARNING! Error open file
C:\Program Files\TDS3\xDynamic\TDS.Unpk
d3nq.exe
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
eayyqt.dat
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
n_jcmfwn.dat
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
C:\Rivage_Dossier\zManuels
Rivage_manuel_multisite.exe
ArchiveType: ZIP SFX (self extracting)
NOTE! The whole archive is password protected
Error! Could not change directory: System Volume Information
C:\WINDOWS\system32
apiin32.dll
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.1
WAS DELETED!
d3nq.exe
[DETECTION] The Trojan horse TR/Dldr.Agent.AP.2
WAS DELETED!
C:\WINDOWS\system32\config
default
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
DEFAULT.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
sam
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
security
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
software
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SOFTWARE.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
system
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SYSTEM.LOG
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!

End of scan: 10.07.2004 10:37
Time taken: 54:17 min

4794 directories were scanned
101767 files were scanned
27 warning messages were issued
39 files were deleted
0 files were repaired
39 detections

gelo13 · Answer

pour TROJAN W32.AGENT.Z2
j'ai été victime du meme message et en faisant ALT-CTRL-SUP
j'ai vu un programme inconnu pour moi qui s'appelle crck.exe.
Je l'ai tout simplement supprimé du dossier windows et ca à l'air
d'aller beaucoup mieu.
Attention la base de registre a aussi été touché. Entre autre tous ce qui concerne les parametrage d'internet explorer (page d'ouverture, url de recherche...)

TROJAN W32.AGENT.Z2 et autres...

11 réponses

Discussions similaires