virus BDS/Bifrose.Gen ?

[loulou56]

bonjour je viens d installe antivir qui m a detecte ce virus BDS/Bifrose.Gen dans c/windows/sytem32/updating/udapte.exe

 

je l ai mis en quarantaine pour l instant si quelqu un a des infos sur ce virus ou ce que je dois faire merci de votre aide.

 

AntiVir PersonalEdition Classic

Report file date: jeudi 27 mars 2008 14:34

 

Scanning for 1168484 virus strains and unwanted programs.

 

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 2) [5.1.2600]

Username: SYSTEM

Computer name: LOU

 

Version information:

BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00

AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:30

AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:52

LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:48

LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:22

ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:16

ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:32:20

ANTIVIR2.VDF : 7.0.3.62 337408 Bytes 21/03/2008 13:32:20

ANTIVIR3.VDF : 7.0.3.83 109568 Bytes 27/03/2008 13:32:20

AVEWIN32.DLL : 7.6.0.75 3334656 Bytes 27/03/2008 13:32:20

AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:28

AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:18

AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24

AVPACK32.DLL : 7.6.0.3 360488 Bytes 27/03/2008 13:32:20

AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:08

AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:34

AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:20

NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:44

RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:14

RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:38

SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:22

 

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: interactive

Secondary action.................: ignore

Scan master boot sector..........: off

Scan boot sector.................: on

Boot sectors.....................: D:,

Scan memory......................: on

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: off

Scan all files...................: Intelligent file selection

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Macro heuristic..................: on

File heuristic...................: medium

 

Start of the scan: jeudi 27 mars 2008 14:34

 

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned

Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'unsecapp.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'RtkBtMnt.exe' - '1' Module(s) have been scanned

Scan process 'NBService.exe' - '1' Module(s) have been scanned

Scan process 'LockServ.exe' - '1' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehRecvr.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'LockMon.exe' - '1' Module(s) have been scanned

Scan process 'MemCheck.exe' - '1' Module(s) have been scanned

Scan process 'MSNMSGR.EXE' - '1' Module(s) have been scanned

Scan process 'RUNDLL32.EXE' - '1' Module(s) have been scanned

Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned

Scan process 'LManager.exe' - '1' Module(s) have been scanned

Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned

Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned

Scan process 'BisonBar.exe' - '1' Module(s) have been scanned

Scan process 'EHMSAS.EXE' - '1' Module(s) have been scanned

Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned

Scan process 'EHTRAY.EXE' - '1' Module(s) have been scanned

Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned

Scan process 'aawservice.exe' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned

Scan process 'LSASS.EXE' - '1' Module(s) have been scanned

Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned

Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned

Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned

Scan process 'SMSS.EXE' - '1' Module(s) have been scanned

50 processes with 50 modules were scanned

 

Start scanning boot sectors:

Boot sector 'C:\'

[NOTE] No virus was found!

Boot sector 'D:\'

[NOTE] No virus was found!

 

Starting to scan the registry.

The registry was scanned ( '41' files ).

 

 

Starting the file scan:

 

Begin scan in 'C:\' <ACER>

C:\pagefile.sys

[WARNING] The file could not be opened!

C:\hiberfil.sys

[WARNING] The file could not be opened!

C:\WINDOWS\system32\updating\update.exe

[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Bifrose.Gen Backdoor server programs

[iNFO] The file was moved to '484fa434.qua'!

Begin scan in 'D:\' <ACERDATA>

 

 

End of the scan: jeudi 27 mars 2008 15:01

Used time: 27:13 min

 

The scan has been done completely.

 

5095 Scanning directories

341747 Files were scanned

1 viruses and/or unwanted programs were found

0 Files were classified as suspicious:

0 files were deleted

0 files were repaired

1 files were moved to quarantine

0 files were renamed

2 Files cannot be scanned

341746 Files not concerned

7620 Archives were scanned

2 Warnings

0 Notes

Modifié le 27 mars 2008 par loulou56

[Zonk]

Antivir pourrait être optimiser

Voici un petit guide:

Tuto Antivir

.....surveille à bien activer la recherche de " rootkits" et "scan master boot sector"

(ces fonctions sont souvent oubliées par les gens)

 

Cherche à activer le mode "Expert" et à optimiser la recherche des menaces...

(et personnellement dans l'onglet "scanner" j'active tout les items dans

"Rootkit search" et

"Manual selection"

Aide en image message #184

Aide en image message #113

Enlève les cd ou dvd qui peuvent être dans les lecteurs car ils seront analysés inutilement lors de vérifications

@+