[RESOLU]Au secours j y comprend rien

[totoleheros1]

rien dans les deux fichier 0/42 a chaque fois.

 

Keskonfaidoncmaintenant?

[pear]

Tant mieux!

 

Ceci dit, si vous m'écrivez encore ceci , en Javanais, j'arrête!

Keskonfaidoncmaintenant?

 

Sous Vista, désactivez l'UAC

Télécharger Kaspersky Virus Removal Tool(VRT)

Le fichier fait + de 70M°, soyez patient.

 

Très simple à utiliser,Kaspersky Virus Removal Tool n'est pas un antivirus ou un outil de surveillance,

Il n'y a pas non plus de mise-à-jour automatique, il vous faudra donc télécharger la nouvelle version, qui est quotidiennement mise à jour, et l'installer à chaque fois que vous désirez l'utiliser.

Cliquer sur le fichier téléchargé pour installer VRT.

Poste de Travail->Propriétés->Restauration Système.

Cocher la case "Désactiver la Restauration sur tous les lecteurs".

Vous la décocherez par la suite et Redémarrerez après la procédure VRT.

Un nouveau point de restauration sera créé au redémarrage.

 

A On threat détection (si un malware est détecté)

Choisissez, en bas Disinfect,delete if cannot disinfected

Sélectionner les fichiers ou répertoires à analyser (disque dur, périphériques ou documents spécifiques) puis de lancer le processus Start Scan.

 

A la fin du scan:

Cliquer sur"Report" pour voir et enregistrer le rapport à poster.

Ensuite taper sur Exit pour désinstaller l'outil

Modifié le 14 août 2010 par pear

[totoleheros1]

Bonjour

 

pas vraiment une partie de plaisir ce logiciel , l ordi freeze encore souvent en plein processus. j ai du le lancer plusieurs fois pour avor une analyse complete

 

voila ce qui a été trouvé

 

Trojan.Win32.BHO.AVS dans C:\windows/system32/ascontest.dll

 

Trojan-spy.win32.delf.wh dans c:/APPS/OFFICE-1\OonePDF\SETUP.EXE/300.exe/

 

a priori traité

 

Sinon

 

detected backdoor.win32.sinowal.cc file unknow application

cannot be backed up backdoor.win32.sinowal.cc type:file dans: unknow application

detect backdoor.win32.sinowal.cc type: file dans : System memory

 

Demande alors une procedure speciale d erradication qui pour l'instant echoue car l ordi plante

 

Dois je insister avec ce logiciel jusqu'a ce que cela fonctionne ?

[totoleheros1]

la procedure speciale est allée au bout (task completed)

 

disinfected backdoor.win32.sinowal.cc type: file dans : System memory (2x le message)

 

disinfected backdoor.win32.sinowal.knf dans: device\harddisk0\DR0 (2x le message)

 

L'ordinateur a redémarré. Quelle est la marche à suivre ?

[pear]

J'ai besoin des rapports.

C'est écrit en fin de procédure.

 

Détecter et supprimer Backdoor.Win32.Sinowal.deg(Rootkit Mbr)

 

Télécharger antiboot de Kaspersky

Décompresser le fichier zip sur le bureau(Clic droit->Extraire vers..)

Lancez antiboot.exe

Si le pc n'est pas infecté vous aurez cette image

 

Si vous avez ce messageRootkit has been detected!Would you like to cure? y/n

Cliquez y pour désinfecter.

L'outil procède à la désinfection

Cliquez y puis validez pourRedémarrer[/b]

Modifié le 16 août 2010 par pear

[totoleheros1]

Pas d'infection detectée avec l'antiboot

 

Pour les rapports il y a un fichier .doc ou quelque chose à copier/coller? J ai juste une fenetre "rapport détaillé" dont j ai copié les points critiques avant. Par contre y a des tonnes de points important genre faille posible d apres virusliste.com , en general ce sont des extensions mso.dll , il faut que je les recopie tous?

[pear]

Lors de la dernière procédure (VRT)

vous avez pus lire ceci:

A la fin du scan:

Cliquer sur"Report" pour voir et enregistrer le rapport à poster.

 

Sans rapports, il n'y a pas d'aide possible.

 

Cela dit, votre dernier message est encourageant.

Avez vous encore quelque problème.

Modifié le 16 août 2010 par pear

[totoleheros1]

Ici Les rapports sur les evenements critiques

 

Autoscan: malfunction (events: 2, objects: 0, time: Unknown)

15/08/2010 09:09:10 Task started

15/08/2010 09:49:03 Detected: Trojan-Spy.Win32.Delf.wh C:\APPS\OFFICE_1\All\oonepdf\SETUP.EXE/300.exe/ASPack

 

Autoscan: completed 18 hours ago (events: 9, objects: 743816, time: 01:38:00)

15/08/2010 13:49:19 Task started

15/08/2010 15:18:23 Detected: Trojan.Win32.BHO.acvs C:\WINDOWS\system32\AscConTest.dll

15/08/2010 15:23:57 Detected: Backdoor.Win32.Sinowal.cc Unknown application

15/08/2010 15:23:57 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

15/08/2010 15:39:37 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:43:37 Task stopped

15/08/2010 16:02:46 Task started

15/08/2010 16:05:12 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 17:40:47 Task completed

Disinfect active threats: completed 20 hours ago (events: 3, objects: 2938, time: 00:06:52)

15/08/2010 15:43:35 Task started

15/08/2010 15:43:35 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:50:27 Task completed

Autoscan: malfunction (events: 1, objects: 0, time: Unknown)

Autoscan: malfunction (events: 1, objects: 1, time: Unknown)

Autoscan: malfunction (events: 1, objects: 0, time: Unknown)

Autoscan: malfunction (events: 1, objects: 0, time: Unknown)

Autoscan: malfunction (events: 1, objects: 0, time: Unknown)

Autoscan: stopped 12 hours ago (events: 2, objects: 136238, time: 00:46:55)

Autoscan: malfunction (events: 4, objects: 0, time: Unknown)

15/08/2010 23:47:11 Task started

16/08/2010 01:49:41 Detected: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 01:49:41 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 02:05:53 Detected: Backdoor.Win32.Sinowal.cc System Memory

<>: not defined: 0 (events: 2, objects: , time: 00:00:00)

16/08/2010 06:28:56 Task started

16/08/2010 06:28:56 Detected: Backdoor.Win32.Sinowal.cc System Memory

Autoscan: completed 10 minutes ago (events: 7, objects: 593248, time: 01:24:44)

16/08/2010 08:24:51 Task started

16/08/2010 09:46:43 Detected: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 09:46:43 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 10:02:18 Detected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:11:38 Task stopped

16/08/2010 10:43:11 Task started

16/08/2010 12:07:55 Task completed

Disinfect active threats: completed 1 hour ago (events: 4, objects: 3540, time: 00:14:53)

16/08/2010 10:11:37 Task started

16/08/2010 10:11:37 Detected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:26:30 Detected: Backdoor.Win32.Sinowal.knf \Device\Harddisk0\DR0

16/08/2010 10:26:30 Task completed

 

 

Ici tous les rapports sur evenements critiques et importants

 

Autoscan: malfunction (events: 2, objects: 0, time: Unknown)

15/08/2010 09:09:10 Task started

15/08/2010 09:49:03 Detected: Trojan-Spy.Win32.Delf.wh C:\APPS\OFFICE_1\All\oonepdf\SETUP.EXE/300.exe/ASPack

Autoscan: completed 18 hours ago (events: 12, objects: 743816, time: 01:38:00)

15/08/2010 13:49:19 Task started

15/08/2010 15:18:23 Detected: Trojan.Win32.BHO.acvs C:\WINDOWS\system32\AscConTest.dll

15/08/2010 15:19:27 Deleted: Trojan.Win32.BHO.acvs C:\WINDOWS\system32\AscConTest.dll

15/08/2010 15:23:57 Detected: Backdoor.Win32.Sinowal.cc Unknown application

15/08/2010 15:23:57 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

15/08/2010 15:39:37 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:43:37 Task stopped

15/08/2010 16:02:46 Task started

15/08/2010 16:05:12 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 16:05:23 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 16:05:23 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 17:40:47 Task completed

Disinfect active threats: completed 20 hours ago (events: 5, objects: 2938, time: 00:06:52)

15/08/2010 15:43:35 Task started

15/08/2010 15:43:35 Detected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:43:37 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:43:37 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

15/08/2010 15:50:27 Task completed

 

Autoscan: malfunction (events: 23, objects: 0, time: Unknown)

15/08/2010 18:47:39 Task started

15/08/2010 18:50:00 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

15/08/2010 18:52:29 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

15/08/2010 18:54:45 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

15/08/2010 18:57:07 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

15/08/2010 18:59:14 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

15/08/2010 19:01:28 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

15/08/2010 20:16:04 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\e5cfccea16c63031d95372fb1c26\i386\mso.dll

15/08/2010 20:20:48 Detected: Adobe Photoshop BMP.8BI Bitmap File Handling Buffer Overflow - Securelist C:\Program Files\Adobe\Adobe Photoshop CS2\Modules externes\Formats de fichiers\BMP.8BI

15/08/2010 20:24:02 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

15/08/2010 20:26:17 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\ImageJ\jre\bin\java.exe

15/08/2010 20:26:52 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.5.0_04\bin\java.exe

15/08/2010 20:26:59 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.6.0_06\bin\java.exe

15/08/2010 20:50:07 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

15/08/2010 20:50:09 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll

15/08/2010 20:52:24 Detected: Adobe Flash Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

15/08/2010 21:05:08 Detected: QuickTime Player Streaming Debug Error Logging Buffer Overflow - Securelist C:\Program Files\QuickTime\QuickTimePlayer.exe

15/08/2010 21:10:00 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

15/08/2010 21:12:15 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

15/08/2010 21:14:44 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

15/08/2010 21:17:46 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

15/08/2010 21:20:26 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

15/08/2010 21:22:39 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

 

 

Autoscan: malfunction (events: 7, objects: 0, time: Unknown)

15/08/2010 22:05:38 Task started

15/08/2010 22:10:51 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

15/08/2010 22:14:23 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

15/08/2010 22:17:02 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

15/08/2010 22:19:30 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

15/08/2010 22:21:59 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

15/08/2010 22:24:42 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

Autoscan: stopped 12 hours ago (events: 8, objects: 136238, time: 00:46:55)

15/08/2010 22:51:16 Task started

15/08/2010 22:54:07 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

15/08/2010 22:56:38 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

15/08/2010 22:59:46 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

15/08/2010 23:02:17 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

15/08/2010 23:05:04 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

15/08/2010 23:08:49 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

15/08/2010 23:38:12 Task stopped

Autoscan: malfunction (events: 21, objects: 0, time: Unknown)

15/08/2010 23:47:11 Task started

15/08/2010 23:50:47 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

15/08/2010 23:52:10 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

15/08/2010 23:53:20 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

15/08/2010 23:54:32 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

15/08/2010 23:55:43 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

15/08/2010 23:57:19 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

16/08/2010 01:09:12 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\e5cfccea16c63031d95372fb1c26\i386\mso.dll

16/08/2010 01:14:06 Detected: Adobe Photoshop BMP.8BI Bitmap File Handling Buffer Overflow - Securelist C:\Program Files\Adobe\Adobe Photoshop CS2\Modules externes\Formats de fichiers\BMP.8BI

16/08/2010 01:17:50 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 01:20:17 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\ImageJ\jre\bin\java.exe

16/08/2010 01:20:45 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.5.0_04\bin\java.exe

16/08/2010 01:20:51 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.6.0_06\bin\java.exe

16/08/2010 01:45:57 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

16/08/2010 01:45:58 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll

16/08/2010 01:48:41 Detected: Adobe Flash Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

16/08/2010 01:49:41 Detected: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 01:49:41 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 02:01:23 Detected: QuickTime Player Streaming Debug Error Logging Buffer Overflow - Securelist C:\Program Files\QuickTime\QuickTimePlayer.exe

16/08/2010 02:05:17 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 02:05:53 Detected: Backdoor.Win32.Sinowal.cc System Memory

<>: not defined: 0 (events: 2, objects: , time: 00:00:00)

16/08/2010 06:28:56 Task started

16/08/2010 06:28:56 Detected: Backdoor.Win32.Sinowal.cc System Memory

Autoscan: completed 1 minute ago (events: 39, objects: 593248, time: 01:24:44)

16/08/2010 08:24:51 Task started

16/08/2010 08:26:04 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

16/08/2010 08:27:41 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

16/08/2010 08:28:46 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

16/08/2010 08:29:55 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

16/08/2010 08:30:53 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

16/08/2010 08:31:50 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

16/08/2010 09:25:22 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\e5cfccea16c63031d95372fb1c26\i386\mso.dll

16/08/2010 09:27:30 Detected: Adobe Photoshop BMP.8BI Bitmap File Handling Buffer Overflow - Securelist C:\Program Files\Adobe\Adobe Photoshop CS2\Modules externes\Formats de fichiers\BMP.8BI

16/08/2010 09:29:53 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 09:31:04 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\ImageJ\jre\bin\java.exe

16/08/2010 09:31:26 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.5.0_04\bin\java.exe

16/08/2010 09:31:34 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.6.0_06\bin\java.exe

16/08/2010 09:44:50 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

16/08/2010 09:44:50 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll

16/08/2010 09:46:12 Detected: Adobe Flash Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

16/08/2010 09:46:43 Detected: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 09:46:43 Cannot be backed up: Backdoor.Win32.Sinowal.cc Unknown application

16/08/2010 09:57:45 Detected: QuickTime Player Streaming Debug Error Logging Buffer Overflow - Securelist C:\Program Files\QuickTime\QuickTimePlayer.exe

16/08/2010 10:02:03 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 10:02:18 Detected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:11:38 Task stopped

16/08/2010 10:43:11 Task started

16/08/2010 10:49:58 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\0a02c6854959fdbec0c4aa\i386\mso.dll

16/08/2010 10:50:55 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\2ef1e1e403e317bc875e6ecce72e36\i386\mso.dll

16/08/2010 10:51:52 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\36f9fb44f69174921f892299b37e36\i386\mso.dll

16/08/2010 10:52:50 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\4a39ddee6aa4d2e3319487\i386\mso.dll

16/08/2010 10:53:46 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\5c8c8b123be1ae7fad8f72f89e\i386\mso.dll

16/08/2010 10:54:43 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\69013ea13debcc39730c\i386\mso.dll

16/08/2010 11:46:27 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\e5cfccea16c63031d95372fb1c26\i386\mso.dll

16/08/2010 11:48:38 Detected: Adobe Photoshop BMP.8BI Bitmap File Handling Buffer Overflow - Securelist C:\Program Files\Adobe\Adobe Photoshop CS2\Modules externes\Formats de fichiers\BMP.8BI

16/08/2010 11:51:00 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 11:52:12 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\ImageJ\jre\bin\java.exe

16/08/2010 11:52:34 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.5.0_04\bin\java.exe

16/08/2010 11:52:43 Detected: Sun Java JDK / JRE Multiple Vulnerabilities - Securelist C:\Program Files\Java\jre1.6.0_06\bin\java.exe

16/08/2010 12:06:03 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

16/08/2010 12:06:03 Detected: Adobe Shockwave Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Adobe\Shockwave 11\Plugin.dll

16/08/2010 12:07:23 Detected: Adobe Flash Player Multiple Vulnerabilities - Securelist C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

16/08/2010 12:07:55 Task completed

Disinfect active threats: completed 1 hour ago (events: 10, objects: 3540, time: 00:14:53)

16/08/2010 10:11:37 Task started

16/08/2010 10:11:37 Detected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:11:37 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:11:37 Disinfected: Backdoor.Win32.Sinowal.cc System Memory

16/08/2010 10:22:45 Detected: QuickTime Player Streaming Debug Error Logging Buffer Overflow - Securelist C:\Program Files\QuickTime\QuickTimePlayer.exe

16/08/2010 10:26:16 Detected: Microsoft Office OneNote URI Handling Vulnerability - Securelist C:\Program Files\Fichiers communs\Microsoft Shared\Office10\MSO.DLL

16/08/2010 10:26:30 Detected: Backdoor.Win32.Sinowal.knf \Device\Harddisk0\DR0

16/08/2010 10:26:30 Disinfected: Backdoor.Win32.Sinowal.knf \Device\Harddisk0\DR0

16/08/2010 10:26:30 Disinfected: Backdoor.Win32.Sinowal.knf \Device\Harddisk0\DR0

16/08/2010 10:26:30 Task completed

[pear]

Les événements critiques:

Cela signifie que vous avez des mies à jour à faire:

par exemple Java:

Java n'est pas à jour,donc vulnérable.

Téléchargez Javara

vers le bureau.

Dézippez.

lancez Javara.exe

clic sur mise à jour via jucheck

Si problème il y avait, cliquez la seconde option:

"Mettre à jour par le site de Sun"

 

clic sur installer

 

Revenez dans JavaRa

 

Cliquez Effacer les anciennes versions

Puis..... Autres Options ->Cocher Effacer les fichiers JRE Inutiles ->Exécuter

 

Antiboot ne voit plus Sinoval, mais par sécurité:

 

Télécharger MBRCheck

ou là:

 

du lien suivant et sauvegarder sur le Bureau :

Sous Vista->Exécuter en tant que Administrateur

- Lancer l'outil par double-clic ; une fenêtre noire apparaîtra.

- Patienter une dizaine de secondes pour permettre à l'outil de compléter l'analyse.

- N'exécuter aucune action qui pourrait être proposée ;

appuyez alors alors sur la touche N puis Entrée deux fois.

Si rien n'est détecté, pressez touche Entrée

 

Si ce message apparait

 

Found non-standard or infected MBR.

des options s'afficheront

Taper Ypour avoir plus d'options ou N pour quitter

 

Options:

[1] Dump the MBR of a physical disk to file.

[2] Restore the MBR of a physical disk with a standard boot code.

[3] Exit.

 

Choisissez l'option 2 et en fonction de votre système

Available MBR codes:

[ 0] Default (Windows XP)

[ 1] Windows XP

[ 2] Windows Server 2003

[ 3] Windows Vista

[ 4] Windows 2008

[ 5] Windows 7

[-1] Cancel

 

Par exemple:

Selectionner option 2, puis 0 (zero) pour le disqque système et encore 0 (zero)pour le code MBR par défaut.

 

A la question Do you want to fix the MBR code?

Cliquer 'YES et valider par ENTREE

Ce message s'affiche:

Successfully wrote new MBR code!

taper Exit

- Un rapport texte sera créé sur le Bureau, nommé MBRCheck_date_heure

- copier/coller le contenu du rapport ici

Redémarrer .

[totoleheros1]

Effectivement il y a un paquet de mises à jour à effectuer! Mais bon service exe ne tourne plus à 1G comme avant et l ordi est deja beaucoup plus stable et rapide, un vrai plaisir

 

Voici le rapport MBRcheck

 

MBRCheck, version 1.2.3

© 2010, AD

 

Command-line:

Windows Version: Windows XP Professional

Windows Information: Service Pack 3 (build 2600)

Logical Drives Mask: 0x0000000c

 

Kernel Drivers (total 182):

0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

0x806E4000 \WINDOWS\system32\hal.dll

0xBA5A8000 \WINDOWS\system32\KDCOM.DLL

0xBA4B8000 \WINDOWS\system32\BOOTVID.dll

0xB9F78000 ACPI.sys

0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS

0xB9F67000 pci.sys

0xBA0A8000 isapnp.sys

0xBA4BC000 compbatt.sys

0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS

0xBA670000 pciide.sys

0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

0xBA5AC000 aliide.sys

0xBA5AE000 intelide.sys

0xBA5B0000 toside.sys

0xBA5B2000 viaide.sys

0xBA5B4000 cmdide.sys

0xBA0B8000 MountMgr.sys

0xB9F48000 ftdisk.sys

0xBA5B6000 dmload.sys

0xB9F22000 dmio.sys

0xBA330000 PartMgr.sys

0xBA4C4000 ACPIEC.sys

0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS

0xBA0C8000 VolSnap.sys

0xBA4C8000 cpqarray.sys

0xB9F0A000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS

0xB9EF2000 atapi.sys

0xBA4CC000 aha154x.sys

0xBA338000 sparrow.sys

0xBA4D0000 symc810.sys

0xBA0D8000 aic78xx.sys

0xBA4D4000 dac960nt.sys

0xBA0E8000 ql10wnt.sys

0xBA4D8000 amsint.sys

0xBA340000 asc.sys

0xBA4DC000 asc3550.sys

0xBA348000 mraid35x.sys

0xBA350000 i2omp.sys

0xBA4E0000 ini910u.sys

0xBA0F8000 ql1240.sys

0xBA108000 aic78u2.sys

0xBA358000 symc8xx.sys

0xBA360000 sym_hi.sys

0xBA368000 sym_u3.sys

0xBA370000 ABP480N5.SYS

0xBA378000 asc3350p.sys

0xBA5B8000 cd20xrnt.sys

0xBA118000 ultra.sys

0xB9ED9000 adpu160m.sys

0xBA380000 dpti2o.sys

0xBA128000 ql1080.sys

0xBA138000 ql1280.sys

0xBA148000 ql12160.sys

0xBA388000 perc2.sys

0xBA5BA000 perc2hib.sys

0xBA390000 hpn.sys

0xBA4E4000 cbidf2k.sys

0xB9EAD000 dac2w2k.sys

0xBA158000 disk.sys

0xBA168000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

0xB9E8D000 fltmgr.sys

0xBA178000 PxHelp20.sys

0xB9E76000 KSecDD.sys

0xB9DE9000 Ntfs.sys

0xB9DBC000 NDIS.sys

0xBA188000 sisagp.sys

0xBA198000 viaagp.sys

0xBA1A8000 ohci1394.sys

0xBA1B8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

0xB9DA2000 Mup.sys

0xBA1C8000 alim1541.sys

0xBA1D8000 amdagp.sys

0xBA1E8000 agp440.sys

0xBA1F8000 agpCPQ.sys

0xBA208000 04490172.sys

0xBA248000 \SystemRoot\system32\DRIVERS\nic1394.sys

0xBA5F6000 \SystemRoot\system32\DRIVERS\ATKACPI.sys

0xB9787000 \SystemRoot\system32\DRIVERS\intelppm.sys

0xB9395000 \SystemRoot\system32\DRIVERS\nv4_mini.sys

0xB9381000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

0xB9359000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

0xB91B7000 \SystemRoot\system32\DRIVERS\NETw3x32.sys

0xBA3F8000 \SystemRoot\system32\DRIVERS\usbuhci.sys

0xB9193000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

0xBA400000 \SystemRoot\system32\DRIVERS\usbehci.sys

0xB917F000 \SystemRoot\system32\DRIVERS\sdbus.sys

0xBA408000 \SystemRoot\system32\DRIVERS\rimmptsk.sys

0xB9777000 \SystemRoot\system32\DRIVERS\rimsptsk.sys

0xB9133000 \SystemRoot\system32\DRIVERS\rixdptsk.sys

0xB911F000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

0xB9767000 \SystemRoot\system32\DRIVERS\i8042prt.sys

0xBA410000 \SystemRoot\system32\DRIVERS\kbdclass.sys

0xB90EF000 \SystemRoot\system32\DRIVERS\SynTP.sys

0xBA5F8000 \SystemRoot\system32\DRIVERS\USBD.SYS

0xBA418000 \SystemRoot\system32\DRIVERS\mouclass.sys

0xB9757000 \SystemRoot\system32\DRIVERS\imapi.sys

0xB9747000 \SystemRoot\system32\DRIVERS\cdrom.sys

0xB9737000 \SystemRoot\system32\DRIVERS\redbook.sys

0xB90CC000 \SystemRoot\system32\DRIVERS\ks.sys

0xB9C92000 \SystemRoot\system32\DRIVERS\CmBatt.sys

0xB9727000 \SystemRoot\System32\Drivers\tosrfcom.sys

0xBA5FA000 \SystemRoot\system32\DRIVERS\serscan.sys

0xBA764000 \SystemRoot\system32\DRIVERS\audstub.sys

0xB9717000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

0xBA57C000 \SystemRoot\system32\DRIVERS\ndistapi.sys

0xB90B5000 \SystemRoot\system32\DRIVERS\ndiswan.sys

0xBA258000 \SystemRoot\system32\DRIVERS\raspppoe.sys

0xBA268000 \SystemRoot\system32\DRIVERS\raspptp.sys

0xBA420000 \SystemRoot\system32\DRIVERS\TDI.SYS

0xB907C000 \SystemRoot\system32\DRIVERS\psched.sys

0xBA278000 \SystemRoot\system32\DRIVERS\msgpc.sys

0xBA428000 \SystemRoot\system32\DRIVERS\ptilink.sys

0xBA430000 \SystemRoot\system32\DRIVERS\raspti.sys

0xB904C000 \SystemRoot\system32\DRIVERS\rdpdr.sys

0xBA288000 \SystemRoot\system32\DRIVERS\termdd.sys

0xBA5FC000 \SystemRoot\system32\DRIVERS\swenum.sys

0xB8FEE000 \SystemRoot\system32\DRIVERS\update.sys

0xB988D000 \SystemRoot\system32\DRIVERS\mssmbios.sys

0xBA298000 \SystemRoot\system32\DRIVERS\tosporte.sys

0xBA2A8000 \SystemRoot\System32\Drivers\NDProxy.SYS

0xB6F06000 \SystemRoot\system32\drivers\ADIHdAud.sys

0xB6EE2000 \SystemRoot\system32\drivers\portcls.sys

0xBA2B8000 \SystemRoot\system32\drivers\drmk.sys

0xB6D67000 \SystemRoot\system32\DRIVERS\smserial.sys

0xBA438000 \SystemRoot\System32\Drivers\Modem.SYS

0xBA2D8000 \SystemRoot\system32\DRIVERS\usbhub.sys

0xB9CD2000 \SystemRoot\System32\Drivers\i2omgmt.SYS

0xBA2E8000 \SystemRoot\System32\Drivers\tosrfusb.sys

0xBA604000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

0xBA7DF000 \SystemRoot\System32\Drivers\Null.SYS

0xBA606000 \SystemRoot\System32\Drivers\Beep.SYS

0xBA450000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

0xBA458000 \SystemRoot\System32\drivers\vga.sys

0xBA608000 \SystemRoot\System32\Drivers\mnmdd.SYS

0xBA60C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

0xBA460000 \SystemRoot\System32\Drivers\Msfs.SYS

0xBA468000 \SystemRoot\System32\Drivers\Npfs.SYS

0xB9CCA000 \SystemRoot\system32\DRIVERS\rasacd.sys

0xB6D0C000 \SystemRoot\system32\DRIVERS\ipsec.sys

0xB6CB3000 \SystemRoot\system32\DRIVERS\tcpip.sys

0xBA2F8000 \SystemRoot\System32\Drivers\aswTdi.SYS

0xB6C8D000 \SystemRoot\system32\DRIVERS\ipnat.sys

0xB6C65000 \SystemRoot\system32\DRIVERS\netbt.sys

0xBA308000 \SystemRoot\system32\DRIVERS\wanarp.sys

0xB6C43000 \SystemRoot\System32\drivers\afd.sys

0xBA318000 \SystemRoot\system32\DRIVERS\netbios.sys

0xB9D92000 \SystemRoot\system32\DRIVERS\arp1394.sys

0xB6C18000 \SystemRoot\system32\DRIVERS\rdbss.sys

0xB6BA8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

0xB9D72000 \SystemRoot\System32\Drivers\Fips.SYS

0xB6AA6000 \SystemRoot\System32\Drivers\SynMini.sys

0xB9D62000 \SystemRoot\System32\Drivers\STREAM.SYS

0xB90AD000 \SystemRoot\System32\Drivers\SYNSAM.SYS

0xBA470000 \SystemRoot\System32\Drivers\SynCamd.sys

0xB69DC000 \SystemRoot\System32\Drivers\SynPin.sys

0xB5E1B000 \SystemRoot\System32\Drivers\SynPipe.sys

0xBA614000 \SystemRoot\System32\Drivers\SynScan.sys

0xB5DCC000 \SystemRoot\System32\Drivers\aswSP.SYS

0xBA480000 \SystemRoot\System32\Drivers\Aavmker4.SYS

0xB58AC000 \SystemRoot\system32\DRIVERS\04490171.sys

0xB57F0000 \SystemRoot\System32\Drivers\tosrfbd.sys

0xB9D12000 \SystemRoot\system32\DRIVERS\Tosrfhid.sys

0xB9D02000 \SystemRoot\System32\Drivers\tosrfbnp.sys

0xBA4A8000 \SystemRoot\system32\DRIVERS\tosrfnds.sys

0xB9797000 \SystemRoot\System32\Drivers\Cdfs.SYS

0xBF800000 \SystemRoot\System32\win32k.sys

0xB57C4000 \SystemRoot\System32\drivers\Dxapi.sys

0xBA3A0000 \SystemRoot\System32\watchdog.sys

0xBF000000 \SystemRoot\System32\drivers\dxg.sys

0xBA7F5000 \SystemRoot\System32\drivers\dxgthk.sys

0xBF012000 \SystemRoot\System32\nv4_disp.dll

0xBFFA0000 \SystemRoot\System32\ATMFD.DLL

0xB48C3000 \SystemRoot\System32\Drivers\aswFsBlk.SYS

0xB6E52000 \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys

0xB4853000 \SystemRoot\system32\DRIVERS\ndisuio.sys

0xB46D0000 \SystemRoot\System32\Drivers\aswMon2.SYS

0xB3C37000 \SystemRoot\System32\Drivers\HTTP.sys

0xBA488000 \SystemRoot\System32\Drivers\aswRdr.SYS

0xB360A000 \SystemRoot\system32\drivers\wdmaud.sys

0xB389F000 \SystemRoot\system32\drivers\sysaudio.sys

0x7C910000 \WINDOWS\system32\ntdll.dll

 

Processes (total 38):

0 System Idle Process

4 System

1020 C:\WINDOWS\system32\smss.exe

1072 csrss.exe

1104 C:\WINDOWS\system32\winlogon.exe

1148 C:\WINDOWS\system32\services.exe

1160 C:\WINDOWS\system32\lsass.exe

1332 C:\WINDOWS\system32\svchost.exe

1380 svchost.exe

1420 C:\Program Files\Windows Defender\MsMpEng.exe

1460 C:\WINDOWS\system32\svchost.exe

1600 svchost.exe

1816 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

344 C:\WINDOWS\system32\spoolsv.exe

968 C:\WINDOWS\ehome\ehrecvr.exe

988 C:\WINDOWS\ehome\ehSched.exe

1064 C:\WINDOWS\system32\inetsrv\inetinfo.exe

1304 C:\Program Files\Canon\IJPLM\ijplmsvc.exe

1480 C:\Program Files\Java\jre6\bin\jqs.exe

1512 C:\Program Files\Microsoft LifeCam\MSCamS32.exe

1532 C:\WINDOWS\system32\nvsvc32.exe

1552 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

1676 C:\WINDOWS\system32\snmp.exe

1708 svchost.exe

164 C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

204 C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

248 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVC.EXE

532 mcrdsvc.exe

864 C:\WINDOWS\system32\wuauclt.exe

2080 alg.exe

2184 C:\WINDOWS\system32\wbem\wmiapsrv.exe

2204 wmiprvse.exe

2312 C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLIDSVCM.EXE

3404 C:\WINDOWS\explorer.exe

3524 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

3540 C:\PROGRA~1\ALWILS~1\Avast5\AvastUI.exe

3548 C:\WINDOWS\system32\ctfmon.exe

888 C:\Documents and Settings\Bene\Bureau\MBRCheck.exe

 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`f3947600 (NTFS)

 

PhysicalDrive0 Model Number: ST9120822A, Rev: 3.ALA

 

Size Device Name MBR Status

--------------------------------------------

111 GB \\.\PhysicalDrive0 Windows 98 MBR code detected

SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E

 

 

Done!

 

y a t il encore des trucs louches qui tournent?