Virus Srosa.Sys Bagle Gen Win 32

rolala analyse terminée !! mais il m'affiche pas le tableau pour enregistrer le rapport : Internet explorer freeze !

online scanner démarre !

Re,

Nardino donne ceci :
« DiagHelp fonctionne parfaitement sous Vista, mais il faut faire désactiver l'UAC au préalable et surtout ne pas oublier de le faire réactiver après utilisation et désinfection, si nécessaire.
On obtiendra :
Sur le bureau, catchme.log
A la racine du système, resultat.txt
upload_moi_V-Vista.tar.gz »

Euh! ... Puis passe Kaspersky on line ....

Je m'en vais.
Al.

re Max

1) quand reviens papa ?

2) post un nouveau scan FindB

3) edit, je viens de tester dialghelp et y a soucis

Avira AntiVir Personal
Report file date: 2008-08-22 15:12

Scanning for 1566590 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows Vista
Windows version: (plain) [6.0.6000]
Boot mode: Normally booted
Username: SYSTEM
Computer name: BQC

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 2008-08-12 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 2008-06-26 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 2008-05-26 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 2008-06-12 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 2008-05-26 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 2007-07-18 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 2008-06-24 13:54:15
ANTIVIR2.VDF : 7.0.6.10 2587136 Bytes 2008-08-14 17:12:58
ANTIVIR3.VDF : 7.0.6.51 217600 Bytes 2008-08-21 17:13:02
Engineversion : 8.1.1.23
AEVDF.DLL : 8.1.0.5 102772 Bytes 2008-02-25 09:58:21
AESCRIPT.DLL : 8.1.0.68 315770 Bytes 2008-08-21 17:13:21
AESCN.DLL : 8.1.0.23 119156 Bytes 2008-07-10 12:44:49
AERDL.DLL : 8.1.0.20 418165 Bytes 2008-04-24 12:37:48
AEPACK.DLL : 8.1.2.1 364917 Bytes 2008-07-15 12:58:35
AEOFFICE.DLL : 8.1.0.22 192890 Bytes 2008-08-21 17:13:19
AEHEUR.DLL : 8.1.0.50 1388918 Bytes 2008-08-21 17:13:17
AEHELP.DLL : 8.1.0.15 115063 Bytes 2008-07-10 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 2008-08-21 17:13:06
AEEMU.DLL : 8.1.0.7 430452 Bytes 2008-07-31 08:33:21
AECORE.DLL : 8.1.1.8 172406 Bytes 2008-07-31 08:33:21
AEBB.DLL : 8.1.0.1 53617 Bytes 2008-07-10 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 2008-07-09 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 2008-05-16 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 2008-08-21 17:13:03
AVREG.DLL : 8.0.0.1 33537 Bytes 2008-05-09 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 2008-02-12 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 2008-06-12 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 2008-01-22 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 2008-06-12 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 2008-01-25 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 2008-06-12 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 2008-06-27 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:, E:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 2008-08-22 15:12

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'cfp.exe' - '1' Module(s) have been scanned
Scan process 'mfpmp.exe' - '0' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned
Scan process 'conime.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned
Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'taskeng.exe' - '1' Module(s) have been scanned
Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned
Scan process 'SteamService.exe' - '1' Module(s) have been scanned
Scan process 'wlcomm.exe' - '1' Module(s) have been scanned
Scan process 'eRecoveryService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'AluSchedulerSvc.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'IAANTmon.exe' - '1' Module(s) have been scanned
Scan process 'eDSService.exe' - '1' Module(s) have been scanned
Scan process 'DQLWinService.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'AlertService.exe' - '1' Module(s) have been scanned
Scan process 'MemCheck.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'Steam.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'sidebar.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'wpcumi.exe' - '1' Module(s) have been scanned
Scan process 'V0230Mon.exe' - '1' Module(s) have been scanned
Scan process 'IntelHCTAgent.exe' - '1' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned
Scan process 'dwm.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SLsvc.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'audiodg.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsm.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'wininit.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
62 processes with 62 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD4
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD5
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights
Master boot sector HD6
[INFO] No virus was found!
[WARNING] System error [21]: Le périphérique n'est pas prêt.
[INFO] Please restart the search with Administrator rights

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Boot sector 'E:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '47' files ).

Starting the file scan:

Begin scan in 'C:\' <ACER>
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\mONEY\Monopoly.2003.New.Edition.Multilanguage.Powered.By.NordAllianZ.par.eMule-Paradise.com.rar
[WARNING] An exception has been identified!
[WARNING] In the module 'aecore.dll' an exception occured.
Calling the function AVEPROC_TestFile in file: \\?\C:\mONEY\Monopoly.2003.New.Edition.Multilanguage.Powered.By.NordAllianZ.par.eMule-Paradise.com.rar
Error description:ACCESS_VIOLATION
EAX = 08810568 EBX = 02876AE8
ECX = 088104B4 EDX = 000001D2
ESI = 073CE6DF EDI = 02876ae4
EIP = 01DDC8C3 EBP = 07BF0030
ESP = 0233F1E8 Flg = 00010283
CS = 00000023 SS = 0000001B
Begin scan in 'D:\'
D:\Documents and Settings\Sam.BQC\Local Settings\Temporary Internet Files\Content.IE5\SHUNGPIN\swflash[1].cab
[0] Archive type: CAB (Microsoft)
--> Flash9d.ocx
[WARNING] No further files can be extracted from this archive. The archive will be closed
D:\Documents and Settings\Sam.BQC\Local Settings\Temporary Internet Files\Content.IE5\WLUB0DEZ\hardwaredetection_2_0_4_9[1].cab
[0] Archive type: CAB (Microsoft)
--> setupmconfig.exe
[DETECTION] Contains a recognition pattern of the (harmful) BDS/VB.erb back-door program
[NOTE] The file was moved to '4920c2f8.qua'!
Begin scan in 'E:\' <DATA>

End of the scan: 2008-08-22 15:47
Used time: 34:46 Minute(s)

The scan has been done completely.

21225 Scanning directories
388826 Files were scanned
1 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
1 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
388823 Files not concerned
4025 Archives were scanned
8 Warnings
1 Notes

Oups, nan je suis en mode normal =S

Attendez jvous envoie un Antivir bientot.

Un Anti Bagle ..qui normalement devrait etre efficace.... maxouxd , avant de l'utiliser demande accord des autres.

https://www.01net.com/telecharger/
http://francias.softpicks.net/software/Anti-Bagle_fr-20960.htm

Salut maxouxd,

Accepterais-tu de relancer ScanOnlineKaspersky ?
http://www.commentcamarche.net/forum/affich 7950743 virus srosa sys bagle gen win 32?page=5#95
SVP
Merci

Al.

Vous avez essayer un Anti Bagle ? (dsl j'ai pas tout lu...)

Exactement, si jlexecute pas en mode admin, sa marche mais bloque. En mode admin, il me dit que j'ai ma extrait...

et puis lui il peut démarrer Hikackthis ! le méchant !

250 e message (j'inaugure^^)

Je vois que vous essayer tant bien que mal à le sortir du Bagle de ***** , je vous en félicite :) ..perserver fera vaincre.

EDIT: ici un cas de bagle supprimé...peut etre vous l'avez déjà vu ou non, alors je poste au cas ou...

http://www.commentcamarche.net/forum/affich 2609792 virus bagle impossible a eliminer?page=4#0

Mdrrrr sa va bien être comme sa pour vous un jour. (bientôt ?)

-;)

Juste pour dire bonjours , Al, Ske, et Maxou !!

@+

Bonjour à tous,

À l'avenir et pour DiagHelp sous Vista, voici la procédure à appliquer.

ATTENTION : Avec VISTA il faut :
1°- Désactive le UAC « contrôle des comptes utilisateurs » (tu le réactiveras après ta désinfection):
Explications, là: < https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html >
ou là; < https://www.generation-nt.com/ >
(Vas dans "démarrer" puis "panneau de configuration".
- Double Clique sur l'icône "Comptes d'utilisateurs"
- Clique ensuite sur désactiver et valide).
(toujours redémarrer le PC pour que ce soit effectif)

2°- Télécharge DiagHelp.zip < http://www.malekal.com/download/DiagHelp.zip > sur ton bureau
- - Ne double-clic pas dessus !!
==> Fais un "clic-droit" sur le fichier et "extraire tout" .
- - Un nouveau dossier va être créé DiagHelp
- - Ouvre-le et clic-droit sur go.cmd (le .cmd peut ne pas apparaître) < http://img149.imageshack.us/img149/4927/screenshot173gl8.gif >, puis choisir "Exécuter en temps qu'administrateur".

Et poursuivre comme indiqué à l'origine sous XP ==> C’est-à-dire :

•- L'analyse va commencer, ceci peut durer quelques minutes, laisse faire et appuie sur une touche quand on te le demande.

Notes:
1)- Lors du scan, une fenêtre "Sysinternals Software Licence Terms" va s'ouvrir > clique sur "Agree"
2)- Tu vas certainement recevoir une alerte du pare-feu te demandant si tu acceptes que le processus "sigcheck.exe" puisse se connecter à Internet > "Accepte".
3)- Pendant l'analyse, à la fin du rapport "catchme", il te sera demandé d'appuyer sur une touche afin de poursuivre le scan, suis bien les instructions à l'écran! N'oublie pas !
4- (**) A la fin du scan tu seras dirigé vers la page de l'auteur afin d'expédier le fichier C:\upload_moi_xxxxx.zip ==> Envoie le fichier (c'est chez le concepteur) s’il te plaît.
(Si l'envoi ne va pas, alors expédie-le en pièce jointe à partir de ta messagerie e-Mail habituelle)
Si tu reçois un message d'erreur ferme simplement la page internet et clique sur la touche [Enter]
•- A la fin de l'analyse, il te sera redemandé de redémarrer l'ordinateur...

•- Une fois l'ordinateur redémarré le rapport va apparaître sur le bloc-notes.
Ce dernier se trouve sur C:\resultat.txt
- Copie/colle le contenu du bloc-notes qui s'ouvre, pour cela : « Dans le bloc-notes, cliquez sur le menu Edition / Sélectionner tout > à nouveau menu Edition / copier > pour terminer dans un nouveau message ici, faire un clic droit / coller. »

- Tutoriel ici : < http://www.malekal.com/DiagHelp/DiagHelp.php >
NOTE : (**) Avant la fin Diaghelp ouvre le navigateur pour les besoins de l'upload. Quand cela plante, (maintenant j'attends même plus), je ferme le navigateur pour laisser terminer le scan et avoir accès au fichier texte

Al.

Complexe, sa va mettre du temps, j'y go quand mes parents sont là !

Bon .... laisse tomber DiagHelp ... Bagle doit empècher son fonctionnement ...

Installes Elibagla directement sous C -> " C:\Elibagla.exe "

Ensuite tu vas démarrer en mode sans échec :

->Tu vas lancer Elibagla deux fois dans chaques sessions et tu sauvegarderas chaques rapports directement sous C ( pour les retrouver facilement )

-> Ensuite tu lanceras Combofix ( de ta session ) .

Redémarres ton PC ( si ce n'est pas déjà fait par Combo ) et postes nous tous les rapports
obtenus ( en précisant pour ceux d'Elibagla , de quelles sessions ils proviennent ... ) .