downloaded the latest adw, problem with a virus in the exe.. ramnit virus detected by .... reason core security.. brrrr... then downloaded
the exe on my external backup disk and ran the scan again... same result ... as the virus was already in my system, ran my recent backup.. virus gone
johan442, 2016-01-20 04:35:56 (UTC)
You are infected with file-virus. Win32/Ramnit (and related v...
lost the origin email... and cannot send any attachments here... pse repeat email and from there I can reply wih attachments (screenshots) thanks
well will try again by downloading aswcleaner and scan with malwarewarebytes and herdprotect and virus total
will then screen shoot regards
Hello,
it found ramnit b y avira antivirus and ESET Nod... so 3 anti virus programs found that virus... so deleted adwcleaner 5.03 and wont run it till later...it could be a false positive but seeing the result better be safe than sorry... my inkling is that it is a fale positive anyhow will look at it later and run herdprotect as you regularly update adw... thanks and regards
johan44...
I have an AES256 key in hexadecimal "8A64E947DAA12B6B7761F30192219270883F24D358D55A1E98E5364B801E9120".
That key is encrypted in AES256 and have to decrypt the following key and initialization vector:
Key = "517565747A616C636F61746C5349495038383838383838382020202020202020"
IV = "00000000000000000000000000000000".
The result of the decryption must be a string of 64 characters (hexadecimal).
...Bonjour !
Bon cette fois on met le paquet :
On va faire un fix FRST plus complet et en MSE :
Chapi
Hello, The following keys detected in the latest (v5.030) version are false positives belonging to Bitdefender's context menu entries:
HKLM\SOFTWARE\Classes\BDShellExt.BDMenu
HKLM\SOFTWARE\Classes\BDShellExt.BDMenu.1Screnshot link: http://i.imgur.com/wndgk0T.png
Could you please look into this?
Thank you
Bon,
Et bien on va le faire avec un outil vraiment plus puissant et qui ne protège pas tout ce qui est dans le dossier system32...
Bonjour,
Effectivement, je viens de reproduire le problème que tu rencontre, et malgré l'existence d'un fichier dans les drivers, il insiste sur le fait que le chemin n'est pas le bon.
Mais peut importe, une fois qu'il sera déchargé, on pourra le supprimer comme on veut.
Utilise donc le script suivant :
DisableDriver: MPCKpt
DisableDriver: MPCProtectService
DeleteRegKey: HKEY_LOCAL_MACHINE......
Me revoilà après la tentative avec le script corrigé : toujours la même erreur de syntaxe.
Je joins les captures d'écran de Blitzblank : https://up2sha.re/file?f=rWFIl7qxoLCB
A bientôt,
Jo