[infecté] Rapport

salut lepayrenoel

fais un scan a l´aide de spybot et dis moi ce qu´il trouve...

*Spybot (gratuit) :
Téléchargement :
http://www.commentcamarche.net/telecharger/telecharger 122 spybot
voir demo d utilisation (merci Balltrap)
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm

@+

Non ya pas de chemin de processus ya juste a coter de User : NT AUTHORITY\SYSTEM

Re,

Click droit dessus et propriete, dans la nouvelle fenetre click sur l´onglet image, la tu devrais voir le chemain du processus...

dis moi quoi

@+

Il n'a pas de nom :s

Salut,

Tu le voie dans process explorer ?

C´est quoi son nom?

@+

Bon maintenant le CPU reste stable, mais il ya un processus sans nom (processus inactif) qui prend entre 85 et 99 du CPU, c'est normal ?

Ok, en attendant jai remit rundll32.exe la ou il etait parce que je ne pouvait pas lancer ajout/supression des programmes ou des trucs du style. Au cas ou yaurai un probleme encore avec ce fichier, je refait la meme manip ;)
Je fait ce que tu me dit.

Re,

Telecharge process xp et informes moi des processus qui prennent beaucoup d´uc

https://www.zebulon.fr/telechargements/utilitaires/systeme-utilitaires/process-explorer.html

tutoriel :

https://forum.zebulon.fr/topic/92628-mini-tuto-process-explorer/

@+

G!rly ? :)

[Custom Input]
< C:\Windows\System32\rundll32.exe >
C:\Windows\System32\rundll32.exe moved successfully.

OTMoveIt2 v1.0.20 log created on 02262008_184935

Donc sa à reussi ^^

Mais mon PC a toujours des monters aux niveau de l'UC (de - de 10% a 50%) sans rien faire.

Oui vas-y ;-)
dis moi quoi
@+

il est dans C:\Windows\System32
Je fait la manip avec MoveIt sauf que je met C:\Windows\System32\rundll32.exe ? (j'attend ta reponse avant de le faire xd)

Re,

Non ca n´a pas marché...

Tu peux verifier qu il est bien dans le dossier windows.

Sinon fait une recherche et dis moi dans quelle dossier il se trouve.

@+

Merci ^^

Voila le rapport mais je croit que sa a pas marcher :(

[Custom Input]
< C:\WINDOWS\rundlll32.exe >
File/Folder C:\WINDOWS\rundlll32.exe not found.

OTMoveIt2 v1.0.20 log created on 02262008_181237

Re,

Fais ceci :

* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

C:\WINDOWS\rundlll32.exe

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

@+

Le problème est toujours la, j'ai rundlll32.exe qui s'ouvre et qui se ferme, mon UC utilise de 40% a 90% et quand je lance "tout les programmes" et ben il bloque explorer. Je suis désesperé la...

Euh G!rly ? Tu es encore la ?

Enfin !!!
Le rapport :

AntiVir PersonalEdition Classic
Report file date: 2008-02-26 14:21

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: 549BAB8D84C2406

Version information:
BUILD.DAT : 270 15603 Bytes 2007-09-19 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 2007-09-13 14:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 2007-09-13 14:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 2007-09-13 14:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 2007-09-17 17:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 2007-08-03 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: F:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: 2008-02-26 14:21

Starting search for hidden objects.
'43478' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'hpoevm07.exe' - '1' Module(s) have been scanned
Scan process 'hpobrt07.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'VisualTaskTips.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'osd.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
Scan process 'btwdins.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
38 processes with 38 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!
Master boot sector HD1
[NOTE] No virus was found!
[WARNING] The boot sector file could not be read!
[WARNING] Error code: 0x0015

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '29' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Muestras\SROSA.SYS.Muestra EliBagle v11.02
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '481315c6.qua'!
C:\Program Files\Deneba\Canvas 7\Outils Canvas\aupdate.CVT
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '48341703.qua'!
C:\Program Files\LegacyGamers\LegacyGamers GunZ Online\gui.dll
[DETECTION] Contains suspicious code HEUR/Crypted
[INFO] The file was moved to '482d18e0.qua'!
C:\QooBox\Quarantine\catchme2008-02-20_133916.04.zip
[0] Archive type: ZIP
--> srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
--> wintems.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
--> mdelk.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '48381a87.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system\smss.exe.vir
[DETECTION] Is the Trojan horse TR/Proxy.Horst.Gen
[INFO] The file was moved to '48371a95.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\mdelk.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '48291a8d.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\wintems.exe.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '48321a94.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\2857187.exe.vir
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f91a66.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\305406.exe.vir
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f91a60.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\down\51953.exe.vir
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47fd1a64.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0141837.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '47f51b05.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0142836.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '47f51b08.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0142837.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b09.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0143856.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '47f51b0c.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0143857.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b0e.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP330\A0143858.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b0f.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143907.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b14.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143926.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b16.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143948.exe
[DETECTION] Is the Trojan horse TR/Bagle.Gen.B
[INFO] The file was moved to '47f51b18.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143975.exe
[DETECTION] Is the Trojan horse TR/Proxy.Horst.Gen
[INFO] The file was moved to '47f51b1a.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143984.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '47f51b1c.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP331\A0143985.exe
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '47f51b1d.qua'!
C:\System Volume Information\_restore{D31E7192-F03F-4069-BDEE-994BA2E2D533}\RP343\A0149816.dll
[DETECTION] Contains suspicious code HEUR/Crypted
[INFO] The file was moved to '47f51b51.qua'!
C:\WINDOWS\system32\mscfg.dll
[DETECTION] Contains suspicious code HEUR/Malware
[INFO] The file was moved to '48271d74.qua'!
Begin scan in 'F:\' <Fichiers>

End of the scan: 2008-02-26 15:33
Used time: 1:12:37 min

The scan has been done completely.

6438 Scanning directories
225089 Files were scanned
22 viruses and/or unwanted programs were found
4 Files were classified as suspicious:
0 files were deleted
0 files were repaired
24 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
225067 Files not concerned
1786 Archives were scanned
1 Warnings
2 Notes
43478 Objects were scanned with rootkit scan
0 Hidden objects were found

A chaque fois que lantivirus trouve quelque chose j'ai fait ce quil me conseillait, C'est bon?

C'est très long même xd.