Trojan-Downloader.Win32.Agent variant
Résolu/Fermé
Clorel
Messages postés
29
Date d'inscription
samedi 28 avril 2007
Statut
Membre
Dernière intervention
21 août 2013
-
28 avril 2007 à 17:43
cougar - 20 déc. 2007 à 19:23
cougar - 20 déc. 2007 à 19:23
A voir également:
- Trojan-Downloader.Win32.Agent variant
- Trojan remover - Télécharger - Antivirus & Antimalwares
- Trojan al11 ✓ - Forum Virus
- Trojan win32 - Forum Virus
- Agent quick share ✓ - Forum Virus
- Quick Start : qu'est-ce que c'est ? ✓ - Forum Virus
3 réponses
green day
Messages postés
26371
Date d'inscription
vendredi 30 septembre 2005
Statut
Modérateur, Contributeur sécurité
Dernière intervention
27 décembre 2019
2 162
28 avril 2007 à 17:53
28 avril 2007 à 17:53
Salut
supprime le logiciel : Error Safe
puis fais ce qui est indiqué ici : cas n°2
page internet google redirigee
et poste les rapport demander à la fin, dans nettoyage !
@+
supprime le logiciel : Error Safe
puis fais ce qui est indiqué ici : cas n°2
page internet google redirigee
et poste les rapport demander à la fin, dans nettoyage !
@+
Clorel
Messages postés
29
Date d'inscription
samedi 28 avril 2007
Statut
Membre
Dernière intervention
21 août 2013
28 avril 2007 à 18:18
28 avril 2007 à 18:18
Fixwareout Last edited 4/5/2007
Post this report in the forums please
...
»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdmug.exe"
»»»»» System restarted
»»»»» Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "xedocne" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "repiwoh" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "23plhps" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "mgcppp" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "tesvaf" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "32refaselif" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "xqqmd" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "xedocne" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "gib_ogol" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "repiwoh" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "llun" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "23plhps" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "mgcppp" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "tesvaf" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "32refaselif" Deleted
....
»»»»» Misc files.
C:\Documents and Settings\All Users\Favoris\Download Free Spyware Remover.url Deleted
C:\Documents and Settings\All Users\Favoris\NEW VIAGRA at Half Price!.url Deleted
C:\Documents and Settings\All Users\Favoris\Online Chat With Nude Girls.url Deleted
C:\Documents and Settings\All Users\Favoris\Order CIALIS online without leaving home..url Deleted
C:\Documents and Settings\All Users\Favoris\PC protection in under 2 minutes!.url Deleted
C:\Documents and Settings\All Users\Favoris\SEX Dating - Real Girls For Real SEX.url Deleted
C:\Documents and Settings\All Users\Favoris\Stop PopUps On Your Computer.url Deleted
C:\Documents and Settings\All Users\Favoris\VIAGRA at incredible low price. Bonus Pills!.url Deleted
C:\Documents and Settings\All Users\Favoris\View ADULT photos of REAL GIRLS!.url Deleted
C:\WINDOWS\BALLOON.WAV Deleted
C:\WINDOWS\System32\close.bmp Deleted
C:\WINDOWS\System32\dating.bmp Deleted
C:\WINDOWS\System32\gambling.bmp Deleted
C:\WINDOWS\System32\idesk.conf Deleted
C:\WINDOWS\System32\insurance.bmp Deleted
C:\WINDOWS\System32\msblank.html Deleted
C:\WINDOWS\System32\pharmacy.bmp Deleted
C:\WINDOWS\System32\xxx.bmp Deleted
C:\Documents and Settings\All Users\Favoris\Online Pharmacy Deleted
C:\Documents and Settings\All Users\Favoris\Sex and Dating Deleted
C:\Documents and Settings\All Users\Favoris\Spyware Uninstall Deleted
C:\WINDOWS\System32\msblank32.html Deleted
....
»»»»» Checking for older varients.
....
Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.
Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or https://virusscan.jotti.org/
»»»»» Other
C:\WINDOWS\Temp\kdmug.ren 66047 2004-08-19
»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTAvTray"="C:\\Program Files\\Creative\\SBLive\\Program\\CTAvTray.EXE"
"SsAAD.exe"="C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe"
"ccApp"="\"C:\\Program Files\\Fichiers communs\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Symantec PIF AlertEng"="\"C:\\Program Files\\Fichiers communs\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Fichiers communs\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Error Safe"="\"C:\\Program Files\\Error Safe Free\\ers.exe\" /min"
"MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»
Post this report in the forums please
...
»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdmug.exe"
»»»»» System restarted
»»»»» Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "xedocne" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "repiwoh" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "23plhps" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "mgcppp" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "tesvaf" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "32refaselif" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins "xqqmd" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "xedocne" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "gib_ogol" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "repiwoh" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "llun" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "23plhps" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "mgcppp" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "tesvaf" Deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls "32refaselif" Deleted
....
»»»»» Misc files.
C:\Documents and Settings\All Users\Favoris\Download Free Spyware Remover.url Deleted
C:\Documents and Settings\All Users\Favoris\NEW VIAGRA at Half Price!.url Deleted
C:\Documents and Settings\All Users\Favoris\Online Chat With Nude Girls.url Deleted
C:\Documents and Settings\All Users\Favoris\Order CIALIS online without leaving home..url Deleted
C:\Documents and Settings\All Users\Favoris\PC protection in under 2 minutes!.url Deleted
C:\Documents and Settings\All Users\Favoris\SEX Dating - Real Girls For Real SEX.url Deleted
C:\Documents and Settings\All Users\Favoris\Stop PopUps On Your Computer.url Deleted
C:\Documents and Settings\All Users\Favoris\VIAGRA at incredible low price. Bonus Pills!.url Deleted
C:\Documents and Settings\All Users\Favoris\View ADULT photos of REAL GIRLS!.url Deleted
C:\WINDOWS\BALLOON.WAV Deleted
C:\WINDOWS\System32\close.bmp Deleted
C:\WINDOWS\System32\dating.bmp Deleted
C:\WINDOWS\System32\gambling.bmp Deleted
C:\WINDOWS\System32\idesk.conf Deleted
C:\WINDOWS\System32\insurance.bmp Deleted
C:\WINDOWS\System32\msblank.html Deleted
C:\WINDOWS\System32\pharmacy.bmp Deleted
C:\WINDOWS\System32\xxx.bmp Deleted
C:\Documents and Settings\All Users\Favoris\Online Pharmacy Deleted
C:\Documents and Settings\All Users\Favoris\Sex and Dating Deleted
C:\Documents and Settings\All Users\Favoris\Spyware Uninstall Deleted
C:\WINDOWS\System32\msblank32.html Deleted
....
»»»»» Checking for older varients.
....
Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection.
Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or https://virusscan.jotti.org/
»»»»» Other
C:\WINDOWS\Temp\kdmug.ren 66047 2004-08-19
»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTAvTray"="C:\\Program Files\\Creative\\SBLive\\Program\\CTAvTray.EXE"
"SsAAD.exe"="C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe"
"ccApp"="\"C:\\Program Files\\Fichiers communs\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\""
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Symantec PIF AlertEng"="\"C:\\Program Files\\Fichiers communs\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Fichiers communs\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\""
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Error Safe"="\"C:\\Program Files\\Error Safe Free\\ers.exe\" /min"
"MessengerPlus3"="\"C:\\Program Files\\MessengerPlus! 3\\MsgPlus.exe\" /WinStart"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
....
Hosts file was reset, If you use a custom hosts file please replace it
»»»»» End report »»»»»