Trojan-Spy.HTML.Bankfraud.dq

j'ai essayé de scanner le fichier C:\WINDOWS\system32\qrejitof.exe , et ça n'a pas marché, ensuite j'ai essayé de l'envoyer en fichier attaché par mail à Virus total et ça ne veut pas, ça dit que c'est un fichier à zéro octet donc il ne peut pas envoyer un fichier vide. Je fais un scan complet avec antivir et je te recontacte.

merci

voila le rapport de Avira





Avira AntiVir Personal
Report file date: vendredi 17 octobre 2008 18:52

Scanning for 1688451 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Normally booted
Username: SYSTEM
Computer name: TITANIUM

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.7.12 4066816 Bytes 08/10/2008 19:21:21
ANTIVIR3.VDF : 7.0.7.51 266752 Bytes 16/10/2008 06:55:16
Engineversion : 8.2.0.5
AEVDF.DLL : 8.1.0.6 102772 Bytes 17/10/2008 06:55:24
AESCRIPT.DLL : 8.1.1.9 319867 Bytes 17/10/2008 06:55:23
AESCN.DLL : 8.1.1.3 123252 Bytes 17/10/2008 06:55:22
AERDL.DLL : 8.1.1.2 438644 Bytes 20/09/2008 19:15:44
AEPACK.DLL : 8.1.2.4 369014 Bytes 17/10/2008 06:55:22
AEOFFICE.DLL : 8.1.0.28 196987 Bytes 17/10/2008 06:55:21
AEHEUR.DLL : 8.1.0.59 1438071 Bytes 20/09/2008 19:15:43
AEHELP.DLL : 8.1.1.2 115062 Bytes 17/10/2008 06:55:20
AEGEN.DLL : 8.1.0.41 319861 Bytes 17/10/2008 06:55:20
AEEMU.DLL : 8.1.0.9 393588 Bytes 17/10/2008 06:55:19
AECORE.DLL : 8.1.2.6 172406 Bytes 17/10/2008 06:55:18
AEBB.DLL : 8.1.0.3 53618 Bytes 17/10/2008 06:55:17
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 04/08/2008 20:14:10
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 17 octobre 2008 18:52

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'FTCOMModule.exe' - '1' Module(s) have been scanned
Scan process 'OraConfigRecover.exe' - '1' Module(s) have been scanned
Scan process 'CoreCom.exe' - '1' Module(s) have been scanned
Scan process 'ConnectivityManager.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'hposts08.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'hpoevm08.exe' - '1' Module(s) have been scanned
Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned
Scan process 'hpohmr08.exe' - '1' Module(s) have been scanned
Scan process 'qrejitof.exe' - '1' Module(s) have been scanned
Module is infected -> 'C:\WINDOWS\system32\qrejitof.exe'
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'Launcher.exe' - '1' Module(s) have been scanned
Scan process 'SystrayApp.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process 'qrejitof.exe' has been terminated
C:\WINDOWS\system32\qrejitof.exe
[DETECTION] Is the TR/BHO.aqs Trojan
[NOTE] The file was deleted!

43 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan the registry.

The registry was scanned ( '45' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{3F2B557D-6E4A-468B-A5E2-77D7E321C4EB}\RP5\A0000108.exe
[DETECTION] Is the TR/BHO.aqs Trojan
[NOTE] The file was moved to '4928cc30.qua'!
Begin scan in 'D:\'
D:\Jeux\rFactor\rFactor.exe
[DETECTION] Is the TR/Banker.Banker.ykb Trojan
[NOTE] The file was moved to '4959d78c.qua'!
D:\System Volume Information\_restore{3F2B557D-6E4A-468B-A5E2-77D7E321C4EB}\RP5\A0000109.exe
[DETECTION] Is the TR/Banker.Banker.ykb Trojan
[NOTE] The file was moved to '4928d8be.qua'!


End of the scan: vendredi 17 octobre 2008 20:25
Used time: 1:32:39 Hour(s)

The scan has been done completely.

3858 Scanning directories
182313 Files were scanned
5 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
1 files were deleted
0 files were repaired
3 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
182307 Files not concerned
1306 Archives were scanned
1 Warnings
4 Notes



merci

bonjour,

j'ai fait ce que tu m'as dit et ça donne ça

File/Folder C:\WINDOWS\system32\qrejitof.exe not found.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 10182008_095624


j'ai vraiment choppé un truc à la con je crois

rebonjour,

en fait je crois que c'est bon, le fichier "qrejitof" n'est plus dans C:\Windows\System32

mais je vais lancer une analyse avec antivir

merci a plus tard

apparement c'est bon depuis ce matin plus de soucis, je laisse le pc tourner toute la journée et je te recontacte pour confirmer

merci pour tout

bonjour,

franchement, merci pour tout, nikel, tout fonctionne, plus de bug, parfait. Et tu m'as devancé, je voulais te demander comment protéger correctement mon ordi et j'ai déjà la réponse, merci encore pour tout le temps que tu as passé sur mon problème. En espérant ne plus avoir à vous déranger.

a plus, super sympa