aswMBR : fix MBR

[Malekal_morte]

AVAST Software a sorti un fix pour les infections MBR.
Le fix se nomme aswMBR, dont voici le lien : http://public.avast.com/~gmerek/aswMBR.htm

Une capture exemple :


Le programme propose de télécharger les définitions virales D'Avast!.
Cela est conseillé, en effet, AswMBR peux aussi scanner le disque à la recherche de programme malicieux.





Une détection malicieuse soit au niveau du MBR, soit un rootkit sur un driver.



puis des fichiers malicieux sont détectés.


Le bouton Fix MBR permet de réparer le MBR dans le cas où celui-ci a été infecté.
Le bouton Save log permet d'enregistre le rapport.

aswMBR version 0.9.9.1649 Copyright(c) 2011 AVAST Software
Run date: 2012-02-28 13:05:41
-----------------------------
13:05:41.763 OS Version: Windows 5.1.2600 Service Pack 2
13:05:41.763 Number of processors: 1 586 0x1A05
13:05:41.763 ComputerName: MAKKK UserName: Mak
13:05:42.263 Initialize success
13:14:12.841 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:14:12.841 Disk 0 Vendor: VMware_Virtual_IDE_Hard_Drive 00000001 Size: 8192MB BusType: 3
13:14:12.841 Disk 0 MBR read successfully
13:14:12.841 Disk 0 MBR scan
13:14:12.841 Disk 0 Windows XP default MBR code
13:14:12.841 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 8181 MB offset 63
13:14:12.857 Disk 0 scanning sectors +16755795
13:14:13.013 Disk 0 scanning C:\WINDOWS\system32\drivers
13:14:22.544 Service scanning
13:14:26.247 Modules scanning
13:14:27.654 Disk 0 trace - called modules:
13:14:27.669 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS
13:14:27.669 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x823d7ab8]
13:14:27.669 3 CLASSPNP.SYS[f86db05b] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x823d4d98]
13:14:28.169 Scan finished successfully
13:23:22.591 Verifying
13:23:32.591 Disk 0 Windows 501 MBR fixed successfully
13:23:51.451 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Mak\Bureau\MBR.dat"
13:23:51.451 The log file has been saved successfully to "C:\Documents and Settings\Mak\Bureau\aswMBR.txt"

Un fichier MBR.dat est aussi créé et peux être scanné sur http://www.virustotal.com en cas de doute.

[maxoubaxter]

bonjour poouvez vous m'aidez j'ai une ligne jaune et je sais pas si c'est un virus ou pas voici mon rapport

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-12-13 18:22:33
-----------------------------
18:22:33.046 OS Version: Windows 5.1.2600 Service Pack 3
18:22:33.046 Number of processors: 1 586 0x2C02
18:22:33.046 ComputerName: ADMIN-07FDFC959 UserName: admin
18:22:34.812 Initialize success
18:22:35.734 AVAST engine defs: 12121301
18:22:43.906 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
18:22:43.906 Disk 0 Vendor: Hitachi_HDS721616PLAT80 P22OA8BA Size: 152627MB BusType: 3
18:22:43.906 Disk 0 MBR read successfully
18:22:43.921 Disk 0 MBR scan
18:22:43.953 Disk 0 Windows XP default MBR code
18:22:43.968 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 60000 MB offset 2048
18:22:43.984 Disk 0 Partition - 00 0F Extended LBA 42613 MB offset 225288000
18:22:44.000 Disk 0 scanning sectors +312560640
18:22:44.062 Disk 0 scanning C:\WINDOWS\system32\drivers
18:23:16.453 Service scanning
18:23:46.812 Service WRkrn C:\WINDOWS\System32\drivers\WRkrn.sys **LOCKED** 32 <------------------------------
18:23:49.421 Modules scanning
18:24:03.375 Disk 0 trace - called modules:
18:24:03.390 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys videX32.sys PCIIDEX.SYS
18:24:03.390 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89b7dab8]
18:24:03.390 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\00000062[0x89c133a0]
18:24:03.390 5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89bed9b8]
18:24:04.078 AVAST engine scan C:\WINDOWS
18:24:06.484 AVAST engine scan C:\WINDOWS\system32
18:26:48.250 AVAST engine scan C:\WINDOWS\system32\drivers
18:27:06.578 AVAST engine scan C:\Documents and Settings\admin
18:30:06.109 AVAST engine scan C:\Documents and Settings\All Users
18:30:20.015 Scan finished successfully
18:54:45.062 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\admin\Bureau\MBR.dat"
18:54:45.078 The log file has been saved successfully to "C:\Documents and Settings\admin\Bureau\aswMBR.txt"

[angelique]

Faut créer ton propre sujet !! tu une solution Webroot SecureAnywhere sur ton PC , si oui ç'est lié.

Product:
Webroot SecureAnywhere
Company:
Webroot
Description:
Webroot SecureAnywhere
Version:
8.0.1.44
MD5:
20FE8507D2C728191F1E02B590A590BF
SHA1:
BDC7D1F2A82584EE1A2461484B3C464CD66B57D2
SHA256:
091AFE036888DC5DDC49BEAD04E5E5FDE50489FB541B17E1B48532B86353B06F
Size:
107336
Directory:
%SYSDIR%\drivers\WRkrn.sys
Operating System:
Windows 7