|
|
|
|
Bonjour,
Quelqu'un pourrait-il analyser les 2 rapports d'analyse de clés USB ci dessous et me dire si'il y a infection
Seule la partie Registre # Mountpoints2 comporte quelque chose dans les 2 cas, ne sachant pas de quoi il retourne je prefère me renseigner.
D'avance Merci
############################## | UsbFix V6.047 |
User : DSETUP (Users) #
Update on 02/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 1:39:32 PM | 11/3/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : Symantec AntiVirus Corporate Edition 10.1.6.6000 [ Enabled | Updated ]
FW : Symantec Client Firewall[ (!) Disabled ]8.7.4.110
C:\ -> Local Fixed Disk # 37.27 Go (17.1 Go free) # NTFS
D:\ -> CD-ROM Disc
E:\ -> Removable Disk # 498.74 Mo (498.73 Mo free) # FAT32
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\AccessManager\Client\AMBroker.exe
C:\WINDOWS\system32\ccsrvc.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\CfgWzSvc.exe
C:\Program Files\Altiris\Carbon Copy\shellker.exe
C:\Program Files\IP VPN Remote Services\cvpnd.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\DNTUS26.EXE
c:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\AccessManager\PMAC\sp_SWIns.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\Altiris\CARBON~1\client.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Altiris\AClient\AClntUsr.EXE
C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe
C:\Program Files\AccessManager\Client\AccessMgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
################## | Fichiers # Dossiers infectieux |
################## | Registre # Clés Run infectieuses |
################## | Registre # Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\D
Shell\AutoRun\command =D:\ShelExec.exe postimage.hta
HKCU\..\..\Explorer\MountPoints2\{3ab4af58-c874-11de-8b60-0014c2c79042}
Shell\AutoRun\command =E:\KEYGEN.EXE
################## | Suspect | http://www.virustotal.com |
################## | Cracks / Keygens / Serials |
################## | ! Fin du rapport # UsbFix V6.047 ! |
-----------------------------------------------------------------------------------------------------------------------------
############################## | UsbFix V6.047 |
User : DSETUP (Users) #
Update on 02/11/2009 by Chiquitine29, C_XX & Chimay8
Start at: 2:02:24 PM | 11/3/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Pentium(R) 4 CPU 2.80GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : Symantec AntiVirus Corporate Edition 10.1.6.6000 [ Enabled | Updated ]
FW : Symantec Client Firewall[ (!) Disabled ]8.7.4.110
C:\ -> Local Fixed Disk # 37.27 Go (17.11 Go free) # NTFS
D:\ -> CD-ROM Disc
E:\ -> Removable Disk # 1009.73 Mo (334.25 Mo free) [JACK] # FAT
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\AccessManager\Client\AMBroker.exe
C:\WINDOWS\system32\ccsrvc.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\CfgWzSvc.exe
C:\Program Files\Altiris\Carbon Copy\shellker.exe
C:\Program Files\IP VPN Remote Services\cvpnd.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\DNTUS26.EXE
c:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
C:\Program Files\AccessManager\PMAC\sp_SWIns.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\Altiris\CARBON~1\client.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Altiris\AClient\AClntUsr.EXE
C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe
C:\Program Files\AccessManager\Client\AccessMgr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
################## | Fichiers # Dossiers infectieux |
################## | Registre # Clés Run infectieuses |
################## | Registre # Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\D
Shell\AutoRun\command =D:\ShelExec.exe postimage.hta
HKCU\..\..\Explorer\MountPoints2\{3ab4af58-c874-11de-8b60-0014c2c79042}
Shell\AutoRun\command =E:\KEYGEN.EXE
################## | Suspect | http://www.virustotal.com |
################## | Cracks / Keygens / Serials |
################## | ! Fin du rapport # UsbFix V6.047 ! |
Configuration: Windows XP Internet Explorer 6.0
Relance usbfix
|
100% ca n'existe qu'a la star ac
|