Bonjour,
J'aimerais savoir comment me débarrasser de C:\WINDOWS\new_drv.sys.Avast Pro détecte ce virus à chaque démarrage de l'ordi. J'ai effectué SDFix et j'ai eu ceci:
b]SDFix: Version 1.173 /b
Run by Anthony on 22/04/2008 at 17:00
Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Anthony\Bureau\NOUVEA~1\SDFix
[b]Checking Services /b:
[b]Name /b:
MicroSoft Media Tools
new_drv
[b]Path /b:
"C:\WINDOWS\MSmedia.exe"
\??\C:\WINDOWS\new_drv.sys
MicroSoft Media Tools - Deleted
new_drv - Deleted
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files /b:
Trojan Files Found:
C:\WINDOWS\SYSTEM32\K.EXE - Deleted
C:\Documents and Settings\Anthony\Application Data\Install.dat - Deleted
C:\Documents and Settings\Anthony\Local Settings\Temp\2.dllb - Deleted
C:\Documents and Settings\Anthony\Local Settings\Temp\6.dllb - Deleted
C:\Documents and Settings\Anthony\Local Settings\Temp\7.dllb - Deleted
C:\Program Files\BraveSentry\BraveSentry0.bs - Deleted
C:\Program Files\BraveSentry\BraveSentry1.bs - Deleted
C:\WINDOWS\system32\k.exe - Deleted
C:\WINDOWS\9129837.exe - Deleted
C:\WINDOWS\system32\regscan.exe - Deleted
C:\WINDOWS\system32\vx.tll - Deleted
Folder C:\Program Files\BraveSentry - Removed
Removing Temp Files
[b]ADS Check /b:
[b]Final Check /b:
catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 17:06:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 104
[b]Remaining Services /b:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\PACK SECURITE\\backweb\\542802\\program\\fspex.exe"="C:\\Program Files\\PACK SECURITE\\backweb\\542802\\program\\fspex.exe:*:enabled:PACK SECURITE"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\IncrediMail\\bin\\ImApp.exe"="C:\\Program Files\\IncrediMail\\bin\\ImApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"C:\\Program Files\\PACK SECURITE\\backweb\\542802\\program\\fspex.exe"="C:\\Program Files\\PACK SECURITE\\backweb\\542802\\program\\fspex.exe:*:enabled:PACK SECURITE"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[b]Remaining Files /b:
File Backups: - C:\DOCUME~1\Anthony\Bureau\NOUVEA~1\SDFix\backups\backups.zip
[b]Files with Hidden Attributes /b:
Thu 19 Aug 2004 1,667,584 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Thu 19 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Thu 19 Aug 2004 4,639 A.SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe"
Fri 28 Jan 2005 73,728 A.SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe"
Sat 1 Jan 2000 40,960 ..SHR --- "C:\WINDOWS\system32\cidjwsdrv.dll"
Fri 29 Dec 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sat 30 Mar 2002 51,712 A..H. --- "C:\Documents and Settings\Anthony\Mes documents\Expos‚ TPE\~WRL0002.tmp"
Thu 19 Aug 2004 73,728 A.SH. --- "C:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe"
Sat 22 Apr 2006 33,280 A..H. --- "C:\Documents and Settings\Anthony\Mes documents\BTS GPN\Bazard dossier vautour\Rapport de stage\Dossier\~WRL0368.tmp"
[b]Finished!/b
Est ce que le virus a été desintallé de mon ordi.
merci de me contacter !
