Probleme avec security tool

zabou07 -  
flo-91 Messages postés 5973 Statut Contributeur sécurité -
Bonjour,


j'ai un pb avec le pc de mon fils, il est ne veut plus ouvrir aucun logiciel , ni aller sur le net, il n'y a qu'avast qui veut bien s'ouvrir et encore .....

j'ai réussis à obtenir le rappport de sécurity tool en l'enregistrant sur mon pc puisque nous sommes en réseau.

je vous poste ce rapport ici.

merci pour votre aide


Adware TASKMAN.EXE Virus.DOS.Squatter.9742 This is a dangerous memory resident parasitic highly polymorphic and stealth virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. Depending on their counters the virus also infects the "C:\DOS\KEYB.COM" file, if it exists. The virus does not infect the...
Malware query.dll Virus.Multi.Patras.1972 This is a dangerous memory resident multipartite virus. While executing an infected EXE file the virus writes itself to the boot sector of the C: drive and then returns the control to the host file. While loading from infected disk the virus hooks INT 8, waits for DOS loading procedure, allocates...
Trojan msv1_0.dll Trojan.Win32.LipGame.i This Trojan is a Windows PE EXE file written in C++ and packed using UPX. The file is 23552 bytes in size, and the unpacked file is 56832 bytes in size. The program is represented by a transparent icon, and it is therefore difficult to see it in some file managers. This Trojan is almost identical...
Rogue uwdf.exe Virus.DOS.Darkray_II.466 It is not a dangerous nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus displays the messages: This file contains a virus!!! Please COLD-boot from a write protected system disk and use you anti virus software!!! Dit virus is ter...
Malware iexplore.exe Virus.DOS.ProtoVirus.720.a These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files that are executed. The viruses contain the text string: ** ProtoVirus v1.0 by Chr'92 ** and check it while installing into the system memory. If that string is altered, the...
Worm AVICAP.DLL Worm.Win32.Autorun.cpe This worm creates copies of itself on removable storage media. It is a Windows PE EXE file. It is 73728 bytes in size. Installation Once launched, the worm copies its executable file to the Windows system directory: %System%\ssmicrco.scr Propagation The worm copies its executable file to all...
Dialer bootok.exe Exploit.PHP.Inject.f This exploit is designed to steal confidential information from Web application databases. It is a PHP file. It is 1,610 bytes in size. It is not packed in any way. It is written in PHP.
Backdoor cdfview.dll Backdoor.Win32.SdBot.at This Trojan provides a remote malicious user to perform operations on the victim machine. It is managed via IRC. The program itself is a Windows PE DLL file. It is written in Visual C++. The file is 43 520 bytes in size, and is not packed in any way. Installation This backdoor will be...
Backdoor comsnap.dll Backdoor.Win32.Surila.k Surila is a Trojan backdoor. The program is a Windows PE EXE file packed with Obsidium and written in Visual C++. The packed file size is 244 KB and the unpacked size is approximately 413 KB. Installation Upon being launched, Surila copies itself into the Windows system folder under the name...
Rogue dbmsrpcn.dll Virus.DOS.Mono.1063 It is a very dangerous memory resident parasitic virus. IT hooks INT 21h and infects COM files that are executed, and deletes the files that are opened. It infects the memory like "Cascade" virus, but contains several errors. It installs, infects and deletes the files only upon monochrome monitor...
Rogue dmstyle.dll Virus.DOS.Mono.1063 It is a very dangerous memory resident parasitic virus. IT hooks INT 21h and infects COM files that are executed, and deletes the files that are opened. It infects the memory like "Cascade" virus, but contains several errors. It installs, infects and deletes the files only upon monochrome monitor...
Worm els.dll Net-Worm.Win32.Aler.a This worm contains a backdoor function. It has been widely spammed via email. However, it does not spread via email, but via network resources with weak password protection. Infected messages Message subject Latest News about Arafat!!! Message body Hello guys! Latest news about...
Adware fsusd.dll Virus.DOS.Later.959 This is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM and to the end of EXE files that are executed or opened. While installing into the memory, before return to the host program this virus disinfects the host file. If an installed DOS have...
Spyware imeshare.dll Trojan-PSW.Win32.Nilage.ha This Trojan belongs to a family of programs designed to steal system passwords. It steals confidential data about the victim machine, including passwords and information entered via the keyboard. The Trojan itself is a Windows PE EXE file approximately 68KB in size, packed using ASPack. The...
Dialer ipsmsnap.dll Exploit.Linux.Lacksand This exploit is written in C, and is approximately 16KB in size. It uses a loophole present in NIPrint LPD-LPR Print Server versions 4.10 and lower.
Backdoor kbdhe.dll Backdoor.Win32.Kbot.al This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 12787 bytes in size. Installation Once launched, the backdoor copies its executable file to the Windows system directory: %System%\mssrv32.exe The backdoor then creates a service...
Adware kbdur.dll Virus.DOS.Later.959 This is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM and to the end of EXE files that are executed or opened. While installing into the memory, before return to the host program this virus disinfects the host file. If an installed DOS have...
Adware mfc40loc.dll Virus.DOS.Beast.a This is a dangerous stealth virus that affects COM files, writing itself at the file beginning. A file is infected as it is executed or closed. The beginning of the file is saved at the first unused sector of the last cluster of the file. ? <----------- File -------------------------->...
Spyware mmcex.dll Trojan-PSW.Win32.LdPinch.abm This Trojan program is designed to steal confidential user data. It harvests user names and passwords to a range of services and programs, and incorporates an SMTP server. The Trojan is a Windows PE EXE file, written in C++, and is 58410 bytes in size. Once launched, the Trojan copies itself to...
Backdoor mrinfo.exe Backdoor.Win32.AckCmd This Troajn program can be used for remote administration of the victim machine. It has both a client and a server component. The server component is written in Microsoft Visual C++. It is 28672 bytes in size, and is not packed in any way. The client component is also written in Microsoft Visual...
Adware MSRDO20.DLL Virus.DOS.Accept.3619 This is a dangerous memory resident parasitic encrypted virus. It hooks INT 21h and writes itself at the end of COM and EXE files that are executed. If the file is already infected, the virus searches for other executable files and hits them. The virus contains the internal text string:...
Backdoor msxml2.dll Backdoor.Win32.Surila.k Surila is a Trojan backdoor. The program is a Windows PE EXE file packed with Obsidium and written in Visual C++. The packed file size is 244 KB and the unpacked size is approximately 413 KB. Installation Upon being launched, Surila copies itself into the Windows system folder under the name...
Adware ntmarta.dll Virus.Linux.Gildo It is not a dangerous, memory resident parasitic virus. It was written in the assembler language. It uses system calls (syscall) while working with files. The virus infects ELF files. It writes itself to the middle of the file. After starts the virus divides a main process and continues its work....
Backdoor nview.dll Backdoor.Win32.Small.v This Trojan program makes it possible for a remote malicious user to manage the victim machine. It is a Windows PE EXE file. It is written in Visual C++. It is not packed in any way. The file is 924 bytes in size.
Rogue nvwrshu.dll Virus.DOS.Exorcist.212 It is a very dangerous nonmemory resident overwriting virus. It searches for COM files, then overwrites them, and displays the message: Bad command or file name then returns to DOS. On 1st of any month the virus erases sectors on the C: drive. The virus also contains the text strings: [RED...
Dialer paqsp.dll Exploit.Linux.SSHD22.a Under the SSHD22 name KAV detects a couple of tools widely used on the Internet by hackers to compromise systems vulnerable to the security flaw known as the "SSH CRC-32 compensation attack". Initially reported in October 2001, (for details you may check the CERT advisory 2001-35, at: http:...
Spyware pid.dll Trojan-PSW.Win32.Nilage.ha This Trojan belongs to a family of programs designed to steal system passwords. It steals confidential data about the victim machine, including passwords and information entered via the keyboard. The Trojan itself is a Windows PE EXE file approximately 68KB in size, packed using ASPack. The...
Rogue riched32.dll Virus.DOS.TempVir.466 It is a harmless nonmemory resident parasitic virus. It searches for COM files only in C:\TEMP\ directory, then writes itself to the end of the file. The virus does not manifest itself in any way, it contains the text string: C:\TEMP\*.COM
Adware routemon.exe Virus.DOS.Accept.3619 This is a dangerous memory resident parasitic encrypted virus. It hooks INT 21h and writes itself at the end of COM and EXE files that are executed. If the file is already infected, the virus searches for other executable files and hits them. The virus contains the internal text string:...
Worm sfcfiles.dll Net-Worm.Win32.CodeRed.a CodeRed (aka Code Red, Bady) is an Internet worm that replicates between Windows 2000 servers running Microsoft's IIS (Internet Information Services) and the Microsoft Index Server 2.0 or the Windows 2000 Indexing Service. It does this by exploiting a bug known as "Unchecked Buffer in the Index...
Dialer spiisupd.exe Exploit.HTML.Ascii.c This exploit uses a vulnerability in Internet Explorer (CVE-2006-3227) to run on the victim machine. It is an HTML page. It is 1058 bytes in size. It is not packed in any way.
Dialer termsrv.dll Exploit.HTML.Ascii.ad This exploit uses a vulnerability in Internet Explorer (CVE-2006-3227) to run on the victim machine. It is an HTML page. It is 2641 bytes in size. It is not packed in any way.
Spyware url.dll Trojan-PSW.Win32.LdPinch.zm This Trojan is designed to steal confidential information. The Trojan itself is a Windoes PE EXE file 20205 bytes in size, packed using MEW. The unpacked file is approximately 120KB in size. Installation Once launched, the Trojan creates a file called ssmc.dll, which is 19968 byts in size, in the...
Dialer vssvc.exe Exploit.HTML.Ascii.e This exploit uses a vulnerability in Internet Explorer (CVE-2006-3227) to run on the victim machine. It is an HTML page. It is 1315 bytes in size. It is not packed in any way.
Worm wmpencen.dll Net-Worm.Perl.Santy.a This worm uses a vulnerability in phpBB, which is used to create forums and web sites, to spread via the Internet. phpBB versions lower than 2.0.11 are vulnerable. The worm is written in Perl, and is 4966 bytes in size. Propagation The worm creates a specially formulated Google search request....
Worm ws2help.dll Net-Worm.Linux.Mighty "Mighty" is an Internet worm that infects Linux machines running the popular "Apache" web server software. It does that by exploiting a vulnerability in the "Secure Sockets Layer" SSL "mod_ssl" interface code of the server which was originally reported on July 30, 2002, and listed by the Computer...
A voir également:

21 réponses

flo-91 Messages postés 5973 Statut Contributeur sécurité 1 120
 
Bien, on va remplacer les fichiers infectés :


Avant d'utiliser ComboFix :

ferme les fenêtres de tous les programmes en cours.

Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.


» ouvre ton bloc note[executer--notepad] et copies/colles le contenu du cadre ci dessous:



KillAll::

FCopy::


C:\Documents and Settings\Administrateur\Bureau\svchost.exe | C:\Windows\System32\svchost.exe






> Va en haut de la page et clique sur le menu"Fichier" , une liste apparait=>
> Choisis "Enregistrer sous" et choisis "Bureau"
> Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript
> Clique sur le bouton "Enregistrer" à droite du champs "nom du fichier"
> Quitte le Bloc Notes.
> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe


* suis les instructions
* ça va etre rapide
* Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt
0