Comment me débarrasser de MALWARE DEFENSE
Fermé
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
-
22 déc. 2009 à 20:28
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 - 6 janv. 2010 à 13:08
jfkpresident Messages postés 13408 Date d'inscription lundi 3 septembre 2007 Statut Contributeur sécurité Dernière intervention 5 janvier 2015 - 6 janv. 2010 à 13:08
A voir également:
- Comment me débarrasser de MALWARE DEFENSE
- Malware byte - Télécharger - Antivirus & Antimalwares
- Supprimer malware - Guide
- Tor.jack malware - Forum Virus
- Svchost.exe c'est quoi comment s'en débarrasser - Guide
- Comment se débarrasser de mcafee - Guide
38 réponses
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
22 déc. 2009 à 20:31
22 déc. 2009 à 20:31
Hello ;)
Télécharge SEAF.exe de C_XX .
*Double clique sur SEAF.exe ("éxécuter en tant qu'administrateur pour vista) .
*Une fenetre Cmd va s'ouvrir .
*Tape mdefense,Malware Defense dans cette fenetre et "entrée" .
*Patiente pendant la recherche .
*Une fenetre avec un log .txt va s'afficher .
*Copie/colle ce rapport dans ta prochaine réponse .
Télécharge SEAF.exe de C_XX .
*Double clique sur SEAF.exe ("éxécuter en tant qu'administrateur pour vista) .
*Une fenetre Cmd va s'ouvrir .
*Tape mdefense,Malware Defense dans cette fenetre et "entrée" .
*Patiente pendant la recherche .
*Une fenetre avec un log .txt va s'afficher .
*Copie/colle ce rapport dans ta prochaine réponse .
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 20:39
22 déc. 2009 à 20:39
Désolée, mais impossible de télécharger l'adresse est introuvable
Et merci pour l'aide j'en ai vraiment besoin !!
Rectificatif : j'ai trouvé la page, la recherche est en cours
Et merci pour l'aide j'en ai vraiment besoin !!
Rectificatif : j'ai trouvé la page, la recherche est en cours
flo-91
Messages postés
5646
Date d'inscription
mardi 19 mai 2009
Statut
Contributeur sécurité
Dernière intervention
31 octobre 2019
1 118
22 déc. 2009 à 20:41
22 déc. 2009 à 20:41
Bonjour,
je viens juste signaler à jfkpresident que son lien envoi sur un site "rouge" = dangereux par WOT.
Tu t'es trompé ? lol
je viens juste signaler à jfkpresident que son lien envoi sur un site "rouge" = dangereux par WOT.
Tu t'es trompé ? lol
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 21:05
22 déc. 2009 à 21:05
Apparemment j'ai du réussir à le virer, mais, j'ai toujours ces messages d'erreurs et l'ordi rame.
Mais voilà déjà le post:
1. ========================= SEAF 1.0.0.6 - C_XX | 20:47:27,51
2.
3. Valeur(s) recherchée(s):
4.
5. Malware Defense
6. mdefense
7.
8.
9. ========================= Fichier(s)/Dossier(s):
10.
11. Aucun fichier/Dossier trouvé.
12.
13. ========================= Registre:
14.
15.
16.
17. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
18. "{5E2121EE-0300-11D4-8D3B-444553540000}"="Malware Defense extension"
19.
20.
21.
22.
23. ========================= E.O.F | 21:02:22,84
Mais voilà déjà le post:
1. ========================= SEAF 1.0.0.6 - C_XX | 20:47:27,51
2.
3. Valeur(s) recherchée(s):
4.
5. Malware Defense
6. mdefense
7.
8.
9. ========================= Fichier(s)/Dossier(s):
10.
11. Aucun fichier/Dossier trouvé.
12.
13. ========================= Registre:
14.
15.
16.
17. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
18. "{5E2121EE-0300-11D4-8D3B-444553540000}"="Malware Defense extension"
19.
20.
21.
22.
23. ========================= E.O.F | 21:02:22,84
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
22 déc. 2009 à 21:37
22 déc. 2009 à 21:37
je viens juste signaler à jfkpresident que son lien envoi sur un site "rouge" = dangereux par WOT. Tu t'es trompé ? lol
Le lien a du changé mais c'était bien un hébergement chez Orange a l'origine ..
Jeune novice : on va approfondir les recherches :
Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.
==>Double-clique sur RSIT.exe afin de lancer RSIT.
==>Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions).
==>Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
==>Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront :
log.txt (<<qui sera affiché) ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).
NB : Les rapports sont sauvegardés dans le dossier C:\rsit
==>Rend toi sur ce site: http://www.cijoint.fr/index.php
==>Clique sur "parcourir" et sélectionne ces fichiers ,un lien va etre créer .
==>Copie/colle ce lien dans ta prochaine réponse .
Aide en images si besoin
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 22:09
22 déc. 2009 à 22:09
Voici les deux liens proposés :
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijgtZNEyD.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijuxZFNES.txt
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijgtZNEyD.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijuxZFNES.txt
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 23:07
22 déc. 2009 à 23:07
Voici les deux liens proposés :
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijgtZNEyD.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijuxZFNES.txt
Après vérification de la mise à jour de hijackthis :
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijPSsZhAm.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijiH379BR.txt
Je dois retourner à mes obligations familiales, On peut réprendre plus tard ( demain !) ?
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijgtZNEyD.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijuxZFNES.txt
Après vérification de la mise à jour de hijackthis :
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijPSsZhAm.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijiH379BR.txt
Je dois retourner à mes obligations familiales, On peut réprendre plus tard ( demain !) ?
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 22:27
22 déc. 2009 à 22:27
après vérification de la mise à jour de hijackthis :
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijPSsZhAm.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijiH379BR.txt
log
http://www.cijoint.fr/cjlink.php?file=cj200912/cijPSsZhAm.txt
info
http://www.cijoint.fr/cjlink.php?file=cj200912/cijiH379BR.txt
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
22 déc. 2009 à 23:15
22 déc. 2009 à 23:15
Je dois retourner à mes obligations familiales, On peut réprendre plus tard ( demain !) ?
Aucuns soucis ,je regarde ton rapport .
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
22 déc. 2009 à 23:21
22 déc. 2009 à 23:21
Merci et à +
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
22 déc. 2009 à 23:25
22 déc. 2009 à 23:25
Ton disque dur est pratiquement plein et ta RAM est tres faible !
• Télécharge et install UsbFix par Chiquitine29
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir
• Double clic sur le raccourci UsbFix présent sur ton bureau .
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]
• Laisse travailler l'outil.
• Ensuite post le rapport UsbFix.txt qui apparaitra.
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html
• Télécharge et install UsbFix par Chiquitine29
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir
• Double clic sur le raccourci UsbFix présent sur ton bureau .
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
• Au second menu Choisis l'option " 1 " (recherche) et tape sur [entrée]
• Laisse travailler l'outil.
• Ensuite post le rapport UsbFix.txt qui apparaitra.
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.
• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 18:55
23 déc. 2009 à 18:55
Bonjour JFK Président
Voici le rapport usbfix :
############################## | UsbFix V6.066 |
User : Béda (Administrateurs) # ACER-FE8B363750
Update on 20/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 18:32:42 | 23/12/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]
C:\ -> Disque fixe local # 113,76 Go (20,5 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 114,22 Go (114,22 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque fixe local # 931,51 Go (398,45 Go free) [Iomega ScreenPlay HD] # NTFS
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe 716
C:\WINDOWS\system32\csrss.exe 792
C:\WINDOWS\system32\winlogon.exe 816
C:\WINDOWS\system32\services.exe 872
C:\WINDOWS\system32\lsass.exe 884
C:\WINDOWS\system32\svchost.exe 1068
C:\WINDOWS\system32\svchost.exe 1176
C:\WINDOWS\System32\svchost.exe 1284
C:\WINDOWS\system32\svchost.exe 1348
C:\WINDOWS\system32\svchost.exe 1440
C:\WINDOWS\system32\spoolsv.exe 1688
C:\WINDOWS\system32\svchost.exe 1832
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 1872
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe 1896
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1932
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 192
C:\WINDOWS\system32\bgsvcgen.exe 420
C:\Program Files\Bonjour\mDNSResponder.exe 532
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe 564
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe 640
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 1232
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1264
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1436
C:\WINDOWS\system32\svchost.exe 1756
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe 1300
C:\WINDOWS\System32\alg.exe 2148
C:\WINDOWS\Explorer.EXE 3008
C:\WINDOWS\system32\ctfmon.exe 3188
C:\WINDOWS\SOUNDMAN.EXE 3536
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe 3568
C:\WINDOWS\system32\SysMonitor.exe 3592
C:\Program Files\Acer\Acer eMode Management\AspireService.exe 3604
C:\Program Files\Acer\Acer eConsole\MediaSync.exe 3612
C:\Program Files\Acer TV-FM\PCMService.exe 3644
C:\WINDOWS\system32\LVCOMSX.EXE 3680
C:\Program Files\Logitech\Video\LogiTray.exe 3712
C:\Program Files\Logitech\Video\FxSvr2.exe 352
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe 2212
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe 2324
C:\Program Files\iTunes\iTunesHelper.exe 2468
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 2160
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 2328
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe 2104
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe 2120
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe 2588
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe 2620
C:\Program Files\FinePixViewer\QuickDCF2.exe 1848
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe 1360
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe 2680
C:\Program Files\iPod\bin\iPodService.exe 1400
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe 4092
C:\Program Files\eMule\emule.exe 5380
C:\Program Files\Internet Explorer\iexplore.exe 5736
C:\Program Files\Windows Live\Toolbar\wltuser.exe 576
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe 3652
C:\WINDOWS\system32\wbem\wmiprvse.exe 5956
################## | Fichiers # Dossiers infectieux |
################## | Registre # Clés infectieuses |
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registre # Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{d7d3e8a6-aaa6-11db-9ead-0007cb0000ff}
Shell\AutoRun\command =K:\LaunchU3.exe
################## | Cracks / Keygens / Serials |
"K:\A CLASSER\le plaisir de maigrir weight watcher robert laffont edition france loisir new crack 2009.zip"
-> Contain : Setup.exe 3238400 DFLT-N 1% 3192539 19-02-2009 10:53:18 484f53ad
"K:\BUREAU\musique 1\Musiques de DisneyLand Paris\MUSIQUE DE DESSIN-ANIME WALT DISNEY\Gagner de l'argent sur internet\La 2Šme triche Eurobarre quand vous ˆtes absent\Crack surfrobot.zip"
-> Contain : keygen.exe 59904 DFLT-N 5% 56702 18-11-2001 17:11:52 147bdc37
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf aggiornamento.exe
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf.exe
"K:\musique\planning pour maigrir docteur dukan (incl. KeyGen).rar"
-> contain : keygen\crack.exe
################## | ! Fin du rapport # UsbFix V6.066 ! |
Voici le rapport usbfix :
############################## | UsbFix V6.066 |
User : Béda (Administrateurs) # ACER-FE8B363750
Update on 20/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 18:32:42 | 23/12/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]
C:\ -> Disque fixe local # 113,76 Go (20,5 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 114,22 Go (114,22 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque fixe local # 931,51 Go (398,45 Go free) [Iomega ScreenPlay HD] # NTFS
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe 716
C:\WINDOWS\system32\csrss.exe 792
C:\WINDOWS\system32\winlogon.exe 816
C:\WINDOWS\system32\services.exe 872
C:\WINDOWS\system32\lsass.exe 884
C:\WINDOWS\system32\svchost.exe 1068
C:\WINDOWS\system32\svchost.exe 1176
C:\WINDOWS\System32\svchost.exe 1284
C:\WINDOWS\system32\svchost.exe 1348
C:\WINDOWS\system32\svchost.exe 1440
C:\WINDOWS\system32\spoolsv.exe 1688
C:\WINDOWS\system32\svchost.exe 1832
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 1872
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe 1896
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1932
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 192
C:\WINDOWS\system32\bgsvcgen.exe 420
C:\Program Files\Bonjour\mDNSResponder.exe 532
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe 564
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe 640
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 1232
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1264
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1436
C:\WINDOWS\system32\svchost.exe 1756
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe 1300
C:\WINDOWS\System32\alg.exe 2148
C:\WINDOWS\Explorer.EXE 3008
C:\WINDOWS\system32\ctfmon.exe 3188
C:\WINDOWS\SOUNDMAN.EXE 3536
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe 3568
C:\WINDOWS\system32\SysMonitor.exe 3592
C:\Program Files\Acer\Acer eMode Management\AspireService.exe 3604
C:\Program Files\Acer\Acer eConsole\MediaSync.exe 3612
C:\Program Files\Acer TV-FM\PCMService.exe 3644
C:\WINDOWS\system32\LVCOMSX.EXE 3680
C:\Program Files\Logitech\Video\LogiTray.exe 3712
C:\Program Files\Logitech\Video\FxSvr2.exe 352
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe 2212
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe 2324
C:\Program Files\iTunes\iTunesHelper.exe 2468
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 2160
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 2328
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe 2104
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe 2120
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe 2588
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe 2620
C:\Program Files\FinePixViewer\QuickDCF2.exe 1848
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe 1360
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe 2680
C:\Program Files\iPod\bin\iPodService.exe 1400
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe 4092
C:\Program Files\eMule\emule.exe 5380
C:\Program Files\Internet Explorer\iexplore.exe 5736
C:\Program Files\Windows Live\Toolbar\wltuser.exe 576
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe 3652
C:\WINDOWS\system32\wbem\wmiprvse.exe 5956
################## | Fichiers # Dossiers infectieux |
################## | Registre # Clés infectieuses |
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registre # Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{d7d3e8a6-aaa6-11db-9ead-0007cb0000ff}
Shell\AutoRun\command =K:\LaunchU3.exe
################## | Cracks / Keygens / Serials |
"K:\A CLASSER\le plaisir de maigrir weight watcher robert laffont edition france loisir new crack 2009.zip"
-> Contain : Setup.exe 3238400 DFLT-N 1% 3192539 19-02-2009 10:53:18 484f53ad
"K:\BUREAU\musique 1\Musiques de DisneyLand Paris\MUSIQUE DE DESSIN-ANIME WALT DISNEY\Gagner de l'argent sur internet\La 2Šme triche Eurobarre quand vous ˆtes absent\Crack surfrobot.zip"
-> Contain : keygen.exe 59904 DFLT-N 5% 56702 18-11-2001 17:11:52 147bdc37
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf aggiornamento.exe
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf.exe
"K:\musique\planning pour maigrir docteur dukan (incl. KeyGen).rar"
-> contain : keygen\crack.exe
################## | ! Fin du rapport # UsbFix V6.066 ! |
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
23 déc. 2009 à 20:14
23 déc. 2009 à 20:14
Il faudrait que tu supprimes ces cracks (ils sont sources d'infections ! )
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
• Double clic sur le raccourci UsbFix présent sur ton bureau
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
• Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]
• Ton bureau disparaitra et le pc redémarrera .
• Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.
• Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d avoir été infectés sans les ouvrir
• Double clic sur le raccourci UsbFix présent sur ton bureau
• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .
• Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]
• Ton bureau disparaitra et le pc redémarrera .
• Au redémarrage , UsbFix scannera ton pc , laisse travailler l'outil.
• Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .
• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )
( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 20:58
23 déc. 2009 à 20:58
############################## | UsbFix V6.066 |
User : Béda (Administrateurs) # ACER-FE8B363750
Update on 20/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 20:42:41 | 23/12/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]
C:\ -> Disque fixe local # 113,76 Go (16,98 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 114,22 Go (114,22 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque fixe local # 931,51 Go (398,45 Go free) [Iomega ScreenPlay HD] # NTFS
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe 712
C:\WINDOWS\system32\csrss.exe 788
C:\WINDOWS\system32\winlogon.exe 812
C:\WINDOWS\system32\services.exe 868
C:\WINDOWS\system32\lsass.exe 888
C:\WINDOWS\system32\svchost.exe 1088
C:\WINDOWS\system32\svchost.exe 1192
C:\WINDOWS\System32\svchost.exe 1300
C:\WINDOWS\system32\svchost.exe 1356
C:\WINDOWS\system32\logonui.exe 1476
C:\WINDOWS\system32\svchost.exe 1492
C:\WINDOWS\system32\spoolsv.exe 1704
C:\WINDOWS\system32\svchost.exe 1848
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 1888
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe 1912
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1948
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 196
C:\WINDOWS\system32\bgsvcgen.exe 504
C:\Program Files\Bonjour\mDNSResponder.exe 540
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe 572
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe 648
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 1260
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1292
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1488
C:\WINDOWS\system32\svchost.exe 828
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe 1308
C:\WINDOWS\system32\wbem\wmiapsrv.exe 704
C:\WINDOWS\System32\alg.exe 2140
C:\WINDOWS\system32\wbem\wmiprvse.exe 2168
C:\WINDOWS\system32\userinit.exe 2848
C:\Program Files\Google\Update\GoogleUpdate.exe 2856
C:\WINDOWS\Explorer.EXE 2924
C:\Program Files\Internet Explorer\Iexplore.exe 2984
C:\WINDOWS\system32\dwwin.exe 3012
C:\WINDOWS\system32\ctfmon.exe 3164
C:\Program Files\Windows Live\Toolbar\wltuser.exe 3224
C:\WINDOWS\system32\wbem\wmiprvse.exe 3568
################## | Fichiers # Dossiers infectieux |
Supprimé ! C:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1006
Supprimé ! C:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1007
Supprimé ! K:\$Recycle.Bin\S-1-5-21-3029813722-3470990763-3053855249-1000
Supprimé ! K:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1006
Supprimé ! K:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1007
################## | Registre # Clés infectieuses |
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registre # Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\{d7d3e8a6-aaa6-11db-9ead-0007cb0000ff}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[19/01/2007 20:46|--a------|153] C:\AUTOEXEC.BAT
[21/11/2006 10:54|-rahs----|216] C:\boot.ini
[05/08/2004 13:00|-rahs----|4952] C:\Bootfont.bin
[21/09/2008 13:18|--a------|14437] C:\ComboFix.txt
[02/11/2005 23:53|--a------|0] C:\CONFIG.SYS
[17/12/2007 21:02|--a------|319] C:\drmHeader.bin
[09/12/2006 11:18|--a------|0] C:\dump_dvd.vob
[?|?|?] C:\hiberfil.sys
[02/11/2005 23:53|-rahs----|0] C:\IO.SYS
[01/12/2006 10:23|--a------|183] C:\LogiSetup.log
[02/11/2005 23:53|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 13:00|-rahs----|47564] C:\NTDETECT.COM
[03/09/2008 18:14|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[03/11/2005 17:31|-rahs----|75] C:\Preload.aaa
[21/09/2008 13:14|--a------|1190] C:\rapport.txt
[15/08/2007 15:42|--a------|343] C:\rapport_clean.txt
[19/01/2007 20:46|---h-----|27] C:\TraFgFr.Tra
[23/12/2009 20:49|--a------|4442] C:\UsbFix.txt
[19/09/2008 12:11|--ahs----|6144] D:\Thumbs.db
[26/09/2009 13:27|---hs----|3220] K:\AlbumArtSmall.jpg
[26/09/2009 13:12|---hs----|9721] K:\AlbumArt_{7D4A6365-00B8-48CB-9F2C-C839D29A87F3}_Large.jpg
[26/09/2009 13:12|---hs----|2534] K:\AlbumArt_{7D4A6365-00B8-48CB-9F2C-C839D29A87F3}_Small.jpg
[26/09/2009 13:27|---hs----|16140] K:\AlbumArt_{9708207D-9EB9-4D11-8B2B-5B5EB5F2CE32}_Large.jpg
[26/09/2009 13:27|---hs----|3220] K:\AlbumArt_{9708207D-9EB9-4D11-8B2B-5B5EB5F2CE32}_Small.jpg
[26/09/2009 13:26|---hs----|14820] K:\AlbumArt_{AB657041-590F-40D7-963A-28338CD56769}_Large.jpg
[26/09/2009 13:26|---hs----|3336] K:\AlbumArt_{AB657041-590F-40D7-963A-28338CD56769}_Small.jpg
[26/09/2009 13:26|---hs----|346] K:\desktop.ini
[26/09/2009 13:27|---hs----|16140] K:\Folder.jpg
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# K:\autorun.inf -> Dossier créé par UsbFix.
################## | Cracks / Keygens / Serials |
"K:\A CLASSER\le plaisir de maigrir weight watcher robert laffont edition france loisir new crack 2009.zip"
-> Contain : Setup.exe 3238400 DFLT-N 1% 3192539 19-02-2009 10:53:18 484f53ad
"K:\BUREAU\musique 1\Musiques de DisneyLand Paris\MUSIQUE DE DESSIN-ANIME WALT DISNEY\Gagner de l'argent sur internet\La 2Šme triche Eurobarre quand vous ˆtes absent\Crack surfrobot.zip"
-> Contain : keygen.exe 59904 DFLT-N 5% 56702 18-11-2001 17:11:52 147bdc37
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf aggiornamento.exe
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf.exe
"K:\musique\planning pour maigrir docteur dukan (incl. KeyGen).rar"
-> contain : keygen\crack.exe
################## | Upload |
Veuillez envoyer le fichier : C:\DOCUME~1\BDA~1\Bureau\UsbFix_Upload_Me_ACER-FE8B363750.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.066 ! |
User : Béda (Administrateurs) # ACER-FE8B363750
Update on 20/12/2009 by Chiquitine29, C_XX & Chimay8
Start at: 20:42:41 | 23/12/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Contact : FindyKill.Contact@gmail.com
Intel(R) Celeron(R) CPU 3.06GHz
Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 7.0.5730.11
Windows Firewall Status : Disabled
AV : Malware Defense 1.0 [ Enabled | (!) Outdated ]
C:\ -> Disque fixe local # 113,76 Go (16,98 Go free) [ACER] # NTFS
D:\ -> Disque fixe local # 114,22 Go (114,22 Go free) [ACERDATA] # FAT32
E:\ -> Disque CD-ROM
F:\ -> Disque amovible
G:\ -> Disque amovible
H:\ -> Disque amovible
I:\ -> Disque amovible
J:\ -> Disque amovible
K:\ -> Disque fixe local # 931,51 Go (398,45 Go free) [Iomega ScreenPlay HD] # NTFS
############################## | Processus actifs |
C:\WINDOWS\System32\smss.exe 712
C:\WINDOWS\system32\csrss.exe 788
C:\WINDOWS\system32\winlogon.exe 812
C:\WINDOWS\system32\services.exe 868
C:\WINDOWS\system32\lsass.exe 888
C:\WINDOWS\system32\svchost.exe 1088
C:\WINDOWS\system32\svchost.exe 1192
C:\WINDOWS\System32\svchost.exe 1300
C:\WINDOWS\system32\svchost.exe 1356
C:\WINDOWS\system32\logonui.exe 1476
C:\WINDOWS\system32\svchost.exe 1492
C:\WINDOWS\system32\spoolsv.exe 1704
C:\WINDOWS\system32\svchost.exe 1848
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 1888
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe 1912
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe 1948
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 196
C:\WINDOWS\system32\bgsvcgen.exe 504
C:\Program Files\Bonjour\mDNSResponder.exe 540
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe 572
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe 648
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE 1260
C:\Program Files\CDBurnerXP\NMSAccessU.exe 1292
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 1488
C:\WINDOWS\system32\svchost.exe 828
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe 1308
C:\WINDOWS\system32\wbem\wmiapsrv.exe 704
C:\WINDOWS\System32\alg.exe 2140
C:\WINDOWS\system32\wbem\wmiprvse.exe 2168
C:\WINDOWS\system32\userinit.exe 2848
C:\Program Files\Google\Update\GoogleUpdate.exe 2856
C:\WINDOWS\Explorer.EXE 2924
C:\Program Files\Internet Explorer\Iexplore.exe 2984
C:\WINDOWS\system32\dwwin.exe 3012
C:\WINDOWS\system32\ctfmon.exe 3164
C:\Program Files\Windows Live\Toolbar\wltuser.exe 3224
C:\WINDOWS\system32\wbem\wmiprvse.exe 3568
################## | Fichiers # Dossiers infectieux |
Supprimé ! C:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1006
Supprimé ! C:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1007
Supprimé ! K:\$Recycle.Bin\S-1-5-21-3029813722-3470990763-3053855249-1000
Supprimé ! K:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1006
Supprimé ! K:\Recycler\S-1-5-21-4230083051-2267535012-2804231895-1007
################## | Registre # Clés infectieuses |
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
Supprimé ! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registre # Mountpoints2 |
Supprimé ! HKCU\...\Explorer\MountPoints2\{d7d3e8a6-aaa6-11db-9ead-0007cb0000ff}\Shell\AutoRun\Command
################## | Listing des fichiers présent |
[19/01/2007 20:46|--a------|153] C:\AUTOEXEC.BAT
[21/11/2006 10:54|-rahs----|216] C:\boot.ini
[05/08/2004 13:00|-rahs----|4952] C:\Bootfont.bin
[21/09/2008 13:18|--a------|14437] C:\ComboFix.txt
[02/11/2005 23:53|--a------|0] C:\CONFIG.SYS
[17/12/2007 21:02|--a------|319] C:\drmHeader.bin
[09/12/2006 11:18|--a------|0] C:\dump_dvd.vob
[?|?|?] C:\hiberfil.sys
[02/11/2005 23:53|-rahs----|0] C:\IO.SYS
[01/12/2006 10:23|--a------|183] C:\LogiSetup.log
[02/11/2005 23:53|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 13:00|-rahs----|47564] C:\NTDETECT.COM
[03/09/2008 18:14|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[03/11/2005 17:31|-rahs----|75] C:\Preload.aaa
[21/09/2008 13:14|--a------|1190] C:\rapport.txt
[15/08/2007 15:42|--a------|343] C:\rapport_clean.txt
[19/01/2007 20:46|---h-----|27] C:\TraFgFr.Tra
[23/12/2009 20:49|--a------|4442] C:\UsbFix.txt
[19/09/2008 12:11|--ahs----|6144] D:\Thumbs.db
[26/09/2009 13:27|---hs----|3220] K:\AlbumArtSmall.jpg
[26/09/2009 13:12|---hs----|9721] K:\AlbumArt_{7D4A6365-00B8-48CB-9F2C-C839D29A87F3}_Large.jpg
[26/09/2009 13:12|---hs----|2534] K:\AlbumArt_{7D4A6365-00B8-48CB-9F2C-C839D29A87F3}_Small.jpg
[26/09/2009 13:27|---hs----|16140] K:\AlbumArt_{9708207D-9EB9-4D11-8B2B-5B5EB5F2CE32}_Large.jpg
[26/09/2009 13:27|---hs----|3220] K:\AlbumArt_{9708207D-9EB9-4D11-8B2B-5B5EB5F2CE32}_Small.jpg
[26/09/2009 13:26|---hs----|14820] K:\AlbumArt_{AB657041-590F-40D7-963A-28338CD56769}_Large.jpg
[26/09/2009 13:26|---hs----|3336] K:\AlbumArt_{AB657041-590F-40D7-963A-28338CD56769}_Small.jpg
[26/09/2009 13:26|---hs----|346] K:\desktop.ini
[26/09/2009 13:27|---hs----|16140] K:\Folder.jpg
################## | Vaccination |
# C:\autorun.inf -> Dossier créé par UsbFix.
# D:\autorun.inf -> Dossier créé par UsbFix.
# K:\autorun.inf -> Dossier créé par UsbFix.
################## | Cracks / Keygens / Serials |
"K:\A CLASSER\le plaisir de maigrir weight watcher robert laffont edition france loisir new crack 2009.zip"
-> Contain : Setup.exe 3238400 DFLT-N 1% 3192539 19-02-2009 10:53:18 484f53ad
"K:\BUREAU\musique 1\Musiques de DisneyLand Paris\MUSIQUE DE DESSIN-ANIME WALT DISNEY\Gagner de l'argent sur internet\La 2Šme triche Eurobarre quand vous ˆtes absent\Crack surfrobot.zip"
-> Contain : keygen.exe 59904 DFLT-N 5% 56702 18-11-2001 17:11:52 147bdc37
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf aggiornamento.exe
"K:\BUREAU\musique 1\zip\[Pc App]-sygate personal firewall (il meglio firewall esistente) + serial.zip"
-> Contain : sygate personal firewall (il miglio firewall esistente) + serial\sygate personal firewall (il miglio firewall esistente) + serial\pspf.exe
"K:\musique\planning pour maigrir docteur dukan (incl. KeyGen).rar"
-> contain : keygen\crack.exe
################## | Upload |
Veuillez envoyer le fichier : C:\DOCUME~1\BDA~1\Bureau\UsbFix_Upload_Me_ACER-FE8B363750.zip : https://www.ionos.fr/?affiliate_id=77097
Merci pour votre contribution .
################## | ! Fin du rapport # UsbFix V6.066 ! |
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
23 déc. 2009 à 21:16
23 déc. 2009 à 21:16
As tu supprimé les cracks ?
Peux tu envoyer ce fichier comme décrit (cela fera avancé la recherhce anti-malware) ...Merci -;)
1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :
https://www.malwarebytes.com/
3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.
4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.
5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.
6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :
7) Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.
8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.
9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.
10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
12) Ferme MBAM en cliquant sur Quitter.
13) Poste le rapport dans ta réponse
Peux tu envoyer ce fichier comme décrit (cela fera avancé la recherhce anti-malware) ...Merci -;)
Veuillez envoyer le fichier : C:\DOCUME~1\BDA~1\Bureau\UsbFix_Upload_Me_ACER-FE8B363750.zip : https://www.ionos.fr/?affiliate_id=77097 Merci pour votre contribution .
1) Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.
2) Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau à partir de ce lien :
https://www.malwarebytes.com/
3) A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.
4) Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.
5) Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.
6) MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :
7) Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.
8) MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.
9) A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.
10) Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
11) MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)
12) Ferme MBAM en cliquant sur Quitter.
13) Poste le rapport dans ta réponse
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 21:38
23 déc. 2009 à 21:38
J'ai supprimé les cracks via la corbeille. Est-ce ce qu'il fallait faire ???
Je m'occupe du reste maintenant. A+ et encore merci !!
Je m'occupe du reste maintenant. A+ et encore merci !!
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 21:40
23 déc. 2009 à 21:40
P.S : j'ai déjà fait suivre le fichier pour la recherche
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
23 déc. 2009 à 22:07
23 déc. 2009 à 22:07
J'ai supprimé les cracks via la corbeille. Est-ce ce qu'il fallait faire ???
N'oubli pas de vider la corbeille -;)
P.S : j'ai déjà fait suivre le fichier pour la recherche
Merci .
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 23:14
23 déc. 2009 à 23:14
C'est là que commencent les problèmes. Impossible d'executer MBAM, il est bloquer par qlq chose !!!
J'ai viré spybot et kapersky (version démo). Mais toujours rien. Sur la session de mon mari, j'ai trouvé :
1/ un autre nuisible ( SECURITY CENTER ALERTS ) C'est peut-être lui qui bloque tout.
2/ une fenêtre qui s'ouvre seule (microsoft) avec trois fichiers (office live, search enhancement pack, et office live fichier zip)
3/ messages d'erreurs ( erreur d'application. 1 point d'arrêt a été atteint, etc.)
Que dois-je faire ??
J'ai viré spybot et kapersky (version démo). Mais toujours rien. Sur la session de mon mari, j'ai trouvé :
1/ un autre nuisible ( SECURITY CENTER ALERTS ) C'est peut-être lui qui bloque tout.
2/ une fenêtre qui s'ouvre seule (microsoft) avec trois fichiers (office live, search enhancement pack, et office live fichier zip)
3/ messages d'erreurs ( erreur d'application. 1 point d'arrêt a été atteint, etc.)
Que dois-je faire ??
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
23 déc. 2009 à 23:15
23 déc. 2009 à 23:15
N'oubli pas de vider la corbeille -;)
c'est fait
c'est fait
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 10:20
24 déc. 2009 à 10:20
Dans l'attente, joyeux Noël...
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
24 déc. 2009 à 10:36
24 déc. 2009 à 10:36
Re ;)
Il s'agit peut etre de Brontok ,on va voir ça de suite :
Télécharges ComboFix à partir d'un de ces liens :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/
Et important, enregistre le sur le bureau.
Avant d'utiliser ComboFix :
Clic droit sur le fichier combofix puis "renommer" en scan.exe
? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur scan.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)
? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.
? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
Il s'agit peut etre de Brontok ,on va voir ça de suite :
Télécharges ComboFix à partir d'un de ces liens :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
https://forospyware.com
http://www.geekstogo.com/forum/files/file/197-combofix-by-subs/
Et important, enregistre le sur le bureau.
Avant d'utiliser ComboFix :
Clic droit sur le fichier combofix puis "renommer" en scan.exe
? Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.
? Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
la protection en temps réel de ton Antivirus et de tes Antispywares,
qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
Une fois fait, sur ton bureau double-clic sur scan.exe.
- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.
- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.
- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt,.
est automatiquement sauvegardé et rangé à C:\Combofix.txt)
? Réactive la protection en temps réel de ton Antivirus et de tes Antispywares,
avant de te reconnecter à internet.
? Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 11:18
24 déc. 2009 à 11:18
C'est pareil ! Une fois l'enregistrement sur le bureau effectué, je lance l'execution, et là plus rien...
Deplus, je n'ai pas d'antivirus ou antispyware...
Deplus, je n'ai pas d'antivirus ou antispyware...
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
24 déc. 2009 à 12:18
24 déc. 2009 à 12:18
Ok ,tu va essayer comme ceci :
Mais assure toi avant d'avoir renommer combofix.exe en scan.exe /!\
• Télécharge DDO (de Anthony5151) sur ton Bureau
• Lance DDO
• Lis les informations données et appuie sur une touche pour continuer
• Quand DDO te le demandera, tape scan.exe et appuie sur la touche Entrée
Mais assure toi avant d'avoir renommer combofix.exe en scan.exe /!\
• Télécharge DDO (de Anthony5151) sur ton Bureau
• Lance DDO
• Lis les informations données et appuie sur une touche pour continuer
• Quand DDO te le demandera, tape scan.exe et appuie sur la touche Entrée
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 12:32
24 déc. 2009 à 12:32
Il me dit que scan.exe est introuvable, changement de nom impossible. ???
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 14:00
24 déc. 2009 à 14:00
As-tu une autre idée ???
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
24 déc. 2009 à 14:41
24 déc. 2009 à 14:41
Essaie avec combofix.exe si ça ne fonctionne pas ,télécharge combofix ici
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 14:55
24 déc. 2009 à 14:55
ça ne marche pas avec combofix.exe. Je télécharge l'autre. Faut-il supprimer le premier au préalable ??
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
24 déc. 2009 à 15:47
24 déc. 2009 à 15:47
ça ne marche pas avec combofix.exe. Je télécharge l'autre. Faut-il supprimer le premier au préalable ??
Oui ,tu peux supprimer le premier (C:\combofix)
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 15:50
24 déc. 2009 à 15:50
Ok !
Voilà le rapport combokill
ComboFix 09-12-23.05 - Béda 24/12/2009 15:25:36.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.447.198 [GMT 1:00]
Lancé depuis: c:\documents and settings\Béda\Bureau\Combokill.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\H8SRTkpuwetdpjq.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\H8SRTmxbwkrtpyr.dll
c:\windows\system32\H8SRTmxvqvctyqj.dll
c:\windows\system32\H8SRTrkbtxehkut.dat
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\srcr.dat
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys
((((((((((((((((((((((((((((( Fichiers créés du 2009-11-24 au 2009-12-24 ))))))))))))))))))))))))))))))))))))
.
2009-12-23 22:49 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-23 22:49 . 2009-12-23 22:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-23 22:49 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-23 17:31 . 2009-12-23 19:50 -------- d-----w- C:\UsbFix
2009-12-22 21:01 . 2009-12-22 21:01 -------- d-----w- C:\rsit
2009-12-22 19:46 . 2009-12-22 20:02 -------- d-----w- c:\program files\SEAF
2009-12-20 19:44 . 2009-12-20 19:44 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-12-20 19:44 . 2009-12-20 19:44 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-12-20 19:44 . 2009-12-20 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-23 21:40 . 2007-08-14 09:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-20 19:41 . 2008-04-03 18:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-12-10 11:08 . 2006-05-14 06:19 90014 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-10 11:08 . 2006-05-14 06:19 523288 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-26 13:57 . 2006-11-22 09:50 -------- d-----w- c:\program files\Google
2009-11-26 13:53 . 2009-10-24 09:33 -------- d-----w- c:\program files\easyMule
2009-11-19 18:55 . 2007-01-06 07:35 92264 -c--a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 15:24 . 2009-11-07 15:24 -------- d-----w- c:\program files\Windows Mobile Device Handbook
2009-10-29 07:44 . 2006-01-09 18:02 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:44 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:44 . 2004-08-05 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-25 16:40 . 2006-12-31 14:36 -------- d-----w- c:\program files\adslTV
2009-10-25 16:37 . 2009-10-25 16:37 0 ----a-w- c:\windows\7zS1F.tmp
2009-10-25 15:47 . 2009-10-15 22:46 -------- d-----w- c:\program files\Microsoft
2009-10-21 05:39 . 2004-08-05 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-05 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-05 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2004-08-05 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2004-08-05 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2004-08-05 12:00 150528 ----a-w- c:\windows\system32\rastls.dll
2009-09-28 13:28 . 2007-08-15 15:27 1100 ----a-w- c:\windows\system32\d3d8caps.dat
2009-09-28 07:55 . 2009-09-28 07:55 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2007-01-19 19:46 . 2007-01-19 19:46 10987008 -c--a-w- c:\program files\fran-ang.exe
2006-12-31 14:35 . 2006-12-31 14:35 26346830 -c--a-w- c:\program files\setup-adsltv.exe
2006-12-17 11:22 . 2006-12-17 11:22 1935360 -c--a-w- c:\program files\vorbis-tools-1.0.tar.gz
2006-12-06 14:34 . 2006-12-06 14:34 1104734 -c--a-w- c:\program files\dvdshrink_3.2.0.16_fr.zip
2006-12-01 10:46 . 2006-12-01 10:46 263453 -c--a-w- c:\program files\deskbar.exe
2006-05-29 14:40 . 2006-12-31 15:19 7296000 -c--a-w- c:\program files\mozilla firefox\plugins\libvlc.dll
.
------- Sigcheck -------
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2004-08-05 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 68856]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-13 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SiSPower"="SiSPower.dll" [2005-07-13 49152]
"SoundMan"="SOUNDMAN.EXE" [2005-08-16 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
"MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
"PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2000-07-12 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2000-07-12 311350]
"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-08-04 28739]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-02 2327840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\B‚da\Menu D‚marrer\Programmes\D‚marrage\
Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-5-26 385024]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-21 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-12-4 303104]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-2-13 67128]
Rappels du Calendrier Microsoft Works.lnk - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-7-12 24633]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
"c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [15/10/2009 23:50 54752]
S2 gupdate1ca022f9f64b058;Service Google Update (gupdate1ca022f9f64b058);c:\program files\Google\Update\GoogleUpdate.exe [11/07/2009 14:58 133104]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [20/12/2009 20:44 30104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [20/12/2009 20:44 30104]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 14:23 21344]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = localhost
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - ORPHELINS SUPPRIMES - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-msnmsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 15:36
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(2992)
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Acer\Acer eConsole\MediaServerService.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
c:\program files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Acer TV-FM\Kernel\TV\CLSched.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\Brother\Brmfcmon\BrMfcmon.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-12-24 15:46:25 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-12-24 14:46
ComboFix2.txt 2008-09-21 12:18
ComboFix3.txt 2008-09-19 13:24
Avant-CF: 14 328 766 464 octets libres
Après-CF: 15 044 624 384 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
- - End Of File - - 4C3C9447B5D26EB280C62D6304FB1982
Que fait-on ensuite ?
Voilà le rapport combokill
ComboFix 09-12-23.05 - Béda 24/12/2009 15:25:36.3.1 - x86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.447.198 [GMT 1:00]
Lancé depuis: c:\documents and settings\Béda\Bureau\Combokill.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\H8SRTkpuwetdpjq.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\H8SRTmxbwkrtpyr.dll
c:\windows\system32\H8SRTmxvqvctyqj.dll
c:\windows\system32\H8SRTrkbtxehkut.dat
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\srcr.dat
c:\windows\system32\tmp.reg
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_H8SRTd.sys
-------\Legacy_H8SRTd.sys
((((((((((((((((((((((((((((( Fichiers créés du 2009-11-24 au 2009-12-24 ))))))))))))))))))))))))))))))))))))
.
2009-12-23 22:49 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-23 22:49 . 2009-12-23 22:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-23 22:49 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-23 17:31 . 2009-12-23 19:50 -------- d-----w- C:\UsbFix
2009-12-22 21:01 . 2009-12-22 21:01 -------- d-----w- C:\rsit
2009-12-22 19:46 . 2009-12-22 20:02 -------- d-----w- c:\program files\SEAF
2009-12-20 19:44 . 2009-12-20 19:44 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-12-20 19:44 . 2009-12-20 19:44 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-12-20 19:44 . 2009-12-20 19:46 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-23 21:40 . 2007-08-14 09:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-20 19:41 . 2008-04-03 18:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-12-10 11:08 . 2006-05-14 06:19 90014 ----a-w- c:\windows\system32\perfc00C.dat
2009-12-10 11:08 . 2006-05-14 06:19 523288 ----a-w- c:\windows\system32\perfh00C.dat
2009-11-26 13:57 . 2006-11-22 09:50 -------- d-----w- c:\program files\Google
2009-11-26 13:53 . 2009-10-24 09:33 -------- d-----w- c:\program files\easyMule
2009-11-19 18:55 . 2007-01-06 07:35 92264 -c--a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 15:24 . 2009-11-07 15:24 -------- d-----w- c:\program files\Windows Mobile Device Handbook
2009-10-29 07:44 . 2006-01-09 18:02 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:44 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:44 . 2004-08-05 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-10-25 16:40 . 2006-12-31 14:36 -------- d-----w- c:\program files\adslTV
2009-10-25 16:37 . 2009-10-25 16:37 0 ----a-w- c:\windows\7zS1F.tmp
2009-10-25 15:47 . 2009-10-15 22:46 -------- d-----w- c:\program files\Microsoft
2009-10-21 05:39 . 2004-08-05 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:39 . 2004-08-05 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-05 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:33 . 2004-08-05 12:00 271360 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:39 . 2004-08-05 12:00 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:39 . 2004-08-05 12:00 150528 ----a-w- c:\windows\system32\rastls.dll
2009-09-28 13:28 . 2007-08-15 15:27 1100 ----a-w- c:\windows\system32\d3d8caps.dat
2009-09-28 07:55 . 2009-09-28 07:55 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2007-01-19 19:46 . 2007-01-19 19:46 10987008 -c--a-w- c:\program files\fran-ang.exe
2006-12-31 14:35 . 2006-12-31 14:35 26346830 -c--a-w- c:\program files\setup-adsltv.exe
2006-12-17 11:22 . 2006-12-17 11:22 1935360 -c--a-w- c:\program files\vorbis-tools-1.0.tar.gz
2006-12-06 14:34 . 2006-12-06 14:34 1104734 -c--a-w- c:\program files\dvdshrink_3.2.0.16_fr.zip
2006-12-01 10:46 . 2006-12-01 10:46 263453 -c--a-w- c:\program files\deskbar.exe
2006-05-29 14:40 . 2006-12-31 15:19 7296000 -c--a-w- c:\program files\mozilla firefox\plugins\libvlc.dll
.
------- Sigcheck -------
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2006-01-13 . 5562CC0A47B2AEF06D3417B733F3C195 . 360448 . . [5.1.2600.2827] . . c:\windows\$hf_mig$\KB913446\SP2QFE\tcpip.sys
[-] 2006-01-13 . 583E063FDC888CA30D05C2724B0D7EF4 . 359808 . . [5.1.2600.2827] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2004-08-05 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB913446$\tcpip.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 68856]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-13 67128]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-06-08 196608]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [BU]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"SiSPower"="SiSPower.dll" [2005-07-13 49152]
"SoundMan"="SOUNDMAN.EXE" [2005-08-16 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152]
"AspireService"="c:\program files\Acer\Acer eMode Management\AspireService.exe" [2006-06-09 110592]
"MediaSync"="c:\program files\Acer\Acer eConsole\MediaSync.exe" [2006-05-04 425984]
"PCMService"="c:\program files\Acer TV-FM\PCMService.exe" [2006-03-29 143360]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-06-08 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-06-08 217088]
"WorksFUD"="c:\program files\Microsoft Works\wkfud.exe" [2000-07-12 24576]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2000-07-12 311350]
"Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-08-04 28739]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"SSBkgdUpdate"="c:\program files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-02-19 1089536]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-02 2327840]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-04 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\B‚da\Menu D‚marrer\Programmes\D‚marrage\
Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-5-26 385024]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-11-21 45056]
Acer WLAN 11g USB Dongle.lnk - c:\program files\Acer WLAN 11g USB Dongle\ZDWlan.exe [2005-11-16 745472]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2008-12-4 303104]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-2-13 67128]
Rappels du Calendrier Microsoft Works.lnk - c:\program files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe [2000-7-12 24633]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Acer TV-FM\\PowerCinema.exe"=
"c:\\Program Files\\Acer TV-FM\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [15/10/2009 23:50 54752]
S2 gupdate1ca022f9f64b058;Service Google Update (gupdate1ca022f9f64b058);c:\program files\Google\Update\GoogleUpdate.exe [11/07/2009 14:58 133104]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [20/12/2009 20:44 30104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [20/12/2009 20:44 30104]
S3 fbxusb;Carte réseau virtuelle FreeBox USB;c:\windows\system32\drivers\fbxusb32.sys [20/10/2004 14:23 21344]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
.
------- Examen supplémentaire -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = localhost
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.
- - - - ORPHELINS SUPPRIMES - - - -
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-msnmsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 15:36
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs chargées dans les processus actifs ---------------------
- - - - - - - > 'explorer.exe'(2992)
c:\progra~1\WINDOW~1\wmpband.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Acer\Acer eConsole\MediaServerService.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
c:\program files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Acer TV-FM\Kernel\TV\CLSched.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\Brother\Brmfcmon\BrMfcmon.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-12-24 15:46:25 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-12-24 14:46
ComboFix2.txt 2008-09-21 12:18
ComboFix3.txt 2008-09-19 13:24
Avant-CF: 14 328 766 464 octets libres
Après-CF: 15 044 624 384 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect
- - End Of File - - 4C3C9447B5D26EB280C62D6304FB1982
Que fait-on ensuite ?
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
24 déc. 2009 à 17:47
24 déc. 2009 à 17:47
Maintenant essaie de lancer MBAM (Malware'sByte's) . Si tu n'y arrive pas ,fait ceci :
Télécharge TDSSKiller
Dézippe le sur ton bureau puis lance le .
Télécharge TDSSKiller
Dézippe le sur ton bureau puis lance le .
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
24 déc. 2009 à 21:24
24 déc. 2009 à 21:24
Ce coup ci MBAM a fonctionné, ci-joint le le rapport :
Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3425
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11
24/12/2009 21:07:14
mbam-log-2009-12-24 (21-07-14).txt
Type de recherche: Examen complet (C:\|D:\|K:\|)
Eléments examinés: 219826
Temps écoulé: 1 hour(s), 57 minute(s), 38 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\Ahmed\Local Settings\temp\install_flash_player.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ahmed\Local Settings\temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ahmed\Local Settings\temp\richtx64.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\H8SRTmxbwkrtpyr.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\H8SRTmxvqvctyqj.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\H8SRTkpuwetdpjq.sys.vir (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085017.sys (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085018.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085019.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Que fait-on après ???
Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3425
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11
24/12/2009 21:07:14
mbam-log-2009-12-24 (21-07-14).txt
Type de recherche: Examen complet (C:\|D:\|K:\|)
Eléments examinés: 219826
Temps écoulé: 1 hour(s), 57 minute(s), 38 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
Fichier(s) infecté(s):
C:\Documents and Settings\Ahmed\Local Settings\temp\install_flash_player.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ahmed\Local Settings\temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Ahmed\Local Settings\temp\richtx64.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\H8SRTmxbwkrtpyr.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\H8SRTmxvqvctyqj.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\H8SRTkpuwetdpjq.sys.vir (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085017.sys (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085018.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{EADA2B13-36AE-4518-A8C2-3D8B7D759571}\RP562\A0085019.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Que fait-on après ???
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
25 déc. 2009 à 02:59
25 déc. 2009 à 02:59
Il va falloir analyser un ou des fichier(s) suspect(s) !
Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.
Pour afficher les dossiers et fichiers cachés:
Panneau de configuration > Options des dossiers > onglet Affichage.
Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier : C:\WINDOWS\System32\DRIVERS\atapi.sys
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
Il se peut qu'il se trouvent dans les " dossiers cachés " du systeme.
Il faut donc les rendre visibles pour le scan.
Pour afficher les dossiers et fichiers cachés:
Panneau de configuration > Options des dossiers > onglet Affichage.
Coche Afficher les fichiers et dossiers cachés,
Décoche Masquer les extensions de fichiers connus
Décoche Masquer les fichiers protégés du Système.
Un message de mise en garde va apparaitre. Clique sur OK pour confirmer ton choix.
Les fichiers et dossiers cachés du système apparaitront alors dans l'explorateur Windows en transparence.
Rends toi sur ce site :
https://www.virustotal.com/gui/
Clique sur parcourir et cherche ce fichier : C:\WINDOWS\System32\DRIVERS\atapi.sys
Clique sur Send File.
Un rapport va s'élaborer ligne à ligne.
Attends la fin. Il doit comprendre la taille du fichier envoyé.
Sauvegarde le rapport avec le bloc-note.
Copie le dans ta réponse.
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
25 déc. 2009 à 11:46
25 déc. 2009 à 11:46
Voici le rapport :
Fichier atapi.sys reçu le 2009.12.25 10:41:36 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 1/40 (2.5%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 40 et 57 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.25 -
AhnLab-V3 5.0.0.2 2009.12.24 -
AntiVir 7.9.1.122 2009.12.24 -
Antiy-AVL 2.0.3.7 2009.12.25 -
Authentium 5.2.0.5 2009.12.25 -
Avast 4.8.1351.0 2009.12.25 -
AVG 8.5.0.430 2009.12.24 -
BitDefender 7.2 2009.12.25 -
CAT-QuickHeal 10.00 2009.12.24 -
ClamAV 0.94.1 2009.12.25 -
Comodo 3361 2009.12.25 -
DrWeb 5.0.1.12222 2009.12.25 -
eSafe 7.0.17.0 2009.12.24 Win32.Rootkit
eTrust-Vet 35.1.7197 2009.12.25 -
F-Prot 4.5.1.85 2009.12.25 -
F-Secure 9.0.15370.0 2009.12.24 -
Fortinet 4.0.14.0 2009.12.25 -
GData 19 2009.12.25 -
Ikarus T3.1.1.79.0 2009.12.25 -
K7AntiVirus 7.10.929 2009.12.24 -
Kaspersky 7.0.0.125 2009.12.25 -
McAfee 5842 2009.12.24 -
McAfee+Artemis 5842 2009.12.24 -
McAfee-GW-Edition 6.8.5 2009.12.25 -
Microsoft 1.5302 2009.12.25 -
NOD32 4715 2009.12.24 -
Norman 6.04.03 2009.12.24 -
nProtect 2009.1.8.0 2009.12.24 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.25 -
Prevx 3.0 2009.12.25 -
Rising 22.27.04.04 2009.12.25 -
Sophos 4.49.0 2009.12.25 -
Sunbelt 3.2.1858.2 2009.12.24 -
Symantec 1.4.4.12 2009.12.25 -
TheHacker 6.5.0.3.110 2009.12.24 -
TrendMicro 9.120.0.1004 2009.12.25 -
VBA32 3.12.12.0 2009.12.25 -
ViRobot 2009.12.24.2107 2009.12.24 -
VirusBuster 5.0.21.0 2009.12.25 -
Information additionnelle
File size: 96512 bytes
MD5...: 9f3a2f5aa6875c72bf062c712cfa2674
SHA1..: a719156e8ad67456556a02c34e762944234e7a44
SHA256: b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9
ssdeep: 1536:MwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb
DD0uu:MQ+N74vkEZIxMohjsimBoDTRMBwFktZu
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x159f7
timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)
machinetype.......: 0x14c (I386)
( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29
.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708
.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9
PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863
INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3
.rsrc 0x16780 0x3e0 0x400 3.36 8fd2d82e745b289c28bc056d3a0d62ab
.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45
( 3 imports )
> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
packers (Kaspersky): PE_Patch
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IDE/ATAPI Port Driver
original name: atapi.sys
internal name: atapi.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Fichier atapi.sys reçu le 2009.12.25 10:41:36 (UTC)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 1/40 (2.5%)
en train de charger les informations du serveur...
Votre fichier est dans la file d'attente, en position: 1.
L'heure estimée de démarrage est entre 40 et 57 secondes.
Ne fermez pas la fenêtre avant la fin de l'analyse.
L'analyseur qui traitait votre fichier est actuellement stoppé, nous allons attendre quelques secondes pour tenter de récupérer vos résultats.
Si vous attendez depuis plus de cinq minutes, vous devez renvoyer votre fichier.
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération.
Formaté Impression des résultats
Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée.
Email:
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.25 -
AhnLab-V3 5.0.0.2 2009.12.24 -
AntiVir 7.9.1.122 2009.12.24 -
Antiy-AVL 2.0.3.7 2009.12.25 -
Authentium 5.2.0.5 2009.12.25 -
Avast 4.8.1351.0 2009.12.25 -
AVG 8.5.0.430 2009.12.24 -
BitDefender 7.2 2009.12.25 -
CAT-QuickHeal 10.00 2009.12.24 -
ClamAV 0.94.1 2009.12.25 -
Comodo 3361 2009.12.25 -
DrWeb 5.0.1.12222 2009.12.25 -
eSafe 7.0.17.0 2009.12.24 Win32.Rootkit
eTrust-Vet 35.1.7197 2009.12.25 -
F-Prot 4.5.1.85 2009.12.25 -
F-Secure 9.0.15370.0 2009.12.24 -
Fortinet 4.0.14.0 2009.12.25 -
GData 19 2009.12.25 -
Ikarus T3.1.1.79.0 2009.12.25 -
K7AntiVirus 7.10.929 2009.12.24 -
Kaspersky 7.0.0.125 2009.12.25 -
McAfee 5842 2009.12.24 -
McAfee+Artemis 5842 2009.12.24 -
McAfee-GW-Edition 6.8.5 2009.12.25 -
Microsoft 1.5302 2009.12.25 -
NOD32 4715 2009.12.24 -
Norman 6.04.03 2009.12.24 -
nProtect 2009.1.8.0 2009.12.24 -
Panda 10.0.2.2 2009.12.15 -
PCTools 7.0.3.5 2009.12.25 -
Prevx 3.0 2009.12.25 -
Rising 22.27.04.04 2009.12.25 -
Sophos 4.49.0 2009.12.25 -
Sunbelt 3.2.1858.2 2009.12.24 -
Symantec 1.4.4.12 2009.12.25 -
TheHacker 6.5.0.3.110 2009.12.24 -
TrendMicro 9.120.0.1004 2009.12.25 -
VBA32 3.12.12.0 2009.12.25 -
ViRobot 2009.12.24.2107 2009.12.24 -
VirusBuster 5.0.21.0 2009.12.25 -
Information additionnelle
File size: 96512 bytes
MD5...: 9f3a2f5aa6875c72bf062c712cfa2674
SHA1..: a719156e8ad67456556a02c34e762944234e7a44
SHA256: b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9
ssdeep: 1536:MwXpkfV74F1D7yNEZIHRRJMohmus27G1j/XBoDQi7oaRMJfYHFktprll1Kb
DD0uu:MQ+N74vkEZIxMohjsimBoDTRMBwFktZu
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x159f7
timedatestamp.....: 0x4802539d (Sun Apr 13 18:40:29 2008)
machinetype.......: 0x14c (I386)
( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x380 0x97ba 0x9800 6.45 0d7d81391f33c6450a81be1e3ac8c7b7
NONPAGE 0x9b80 0x18e8 0x1900 6.48 c74a833abd81cc5d037de168e055ad29
.rdata 0xb480 0xa64 0xa80 4.31 8523651899e28819a14bf9415af25708
.data 0xbf00 0xd94 0xe00 0.45 3575b51634ae7a56f55f1ee0a6213834
PAGESCAN 0xcd00 0x157f 0x1580 6.20 dc4c309c4db9576daa752fdd125fccf9
PAGE 0xe280 0x61da 0x6200 6.46 40b83d4d552384e58a03517a98eb4863
INIT 0x14480 0x22be 0x2300 6.47 906462abc478368424ea462d5868d2e3
.rsrc 0x16780 0x3e0 0x400 3.36 8fd2d82e745b289c28bc056d3a0d62ab
.reloc 0x16b80 0xd20 0xd80 6.39 ce2b0898cc0e40b618e5df9099f6be45
( 3 imports )
> ntoskrnl.exe: RtlInitUnicodeString, swprintf, KeSetEvent, IoCreateSymbolicLink, IoGetConfigurationInformation, IoDeleteSymbolicLink, MmFreeMappingAddress, IoFreeErrorLogEntry, IoDisconnectInterrupt, MmUnmapIoSpace, ObReferenceObjectByPointer, IofCompleteRequest, RtlCompareUnicodeString, IofCallDriver, MmAllocateMappingAddress, IoAllocateErrorLogEntry, IoConnectInterrupt, IoDetachDevice, KeWaitForSingleObject, KeInitializeEvent, KeCancelTimer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, IoBuildDeviceIoControlRequest, IoQueueWorkItem, MmMapIoSpace, IoInvalidateDeviceRelations, IoReportDetectedDevice, IoReportResourceForDetection, RtlxAnsiStringToUnicodeSize, NlsMbCodePageTag, PoRequestPowerIrp, KeInsertByKeyDeviceQueue, PoRegisterDeviceForIdleDetection, sprintf, MmMapLockedPagesSpecifyCache, ObfDereferenceObject, IoGetAttachedDeviceReference, IoInvalidateDeviceState, ZwClose, ObReferenceObjectByHandle, ZwCreateDirectoryObject, IoBuildSynchronousFsdRequest, PoStartNextPowerIrp, IoCreateDevice, RtlCopyUnicodeString, IoAllocateDriverObjectExtension, RtlQueryRegistryValues, ZwOpenKey, RtlFreeUnicodeString, IoStartTimer, KeInitializeTimer, IoInitializeTimer, KeInitializeDpc, KeInitializeSpinLock, IoInitializeIrp, ZwCreateKey, RtlAppendUnicodeStringToString, RtlIntegerToUnicodeString, ZwSetValueKey, KeInsertQueueDpc, KefAcquireSpinLockAtDpcLevel, IoStartPacket, KefReleaseSpinLockFromDpcLevel, IoBuildAsynchronousFsdRequest, IoFreeMdl, MmUnlockPages, IoWriteErrorLogEntry, KeRemoveByKeyDeviceQueue, MmMapLockedPagesWithReservedMapping, MmUnmapReservedMapping, KeSynchronizeExecution, IoStartNextPacket, KeBugCheckEx, KeRemoveDeviceQueue, KeSetTimer, _allmul, MmProbeAndLockPages, _except_handler3, PoSetPowerState, IoOpenDeviceRegistryKey, RtlWriteRegistryValue, RtlDeleteRegistryValue, _aulldiv, strstr, _strupr, KeQuerySystemTime, IoWMIRegistrationControl, KeTickCount, IoAttachDeviceToDeviceStack, IoDeleteDevice, ExAllocatePoolWithTag, IoAllocateWorkItem, IoAllocateIrp, IoAllocateMdl, MmBuildMdlForNonPagedPool, MmLockPagableDataSection, IoGetDriverObjectExtension, MmUnlockPagableImageSection, ExFreePoolWithTag, IoFreeIrp, IoFreeWorkItem, InitSafeBootMode, RtlCompareMemory, PoCallDriver, memmove, MmHighestUserAddress
> HAL.dll: KfAcquireSpinLock, READ_PORT_UCHAR, KeGetCurrentIrql, KfRaiseIrql, KfLowerIrql, HalGetInterruptVector, HalTranslateBusAddress, KeStallExecutionProcessor, KfReleaseSpinLock, READ_PORT_BUFFER_USHORT, READ_PORT_USHORT, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_UCHAR
> WMILIB.SYS: WmiSystemControl, WmiCompleteRequest
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
packers (Kaspersky): PE_Patch
sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: IDE/ATAPI Port Driver
original name: atapi.sys
internal name: atapi.sys
file version.: 5.1.2600.5512 (xpsp.080413-2108)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
26 déc. 2009 à 11:27
26 déc. 2009 à 11:27
Télécharge ZhpDiag en cliquant sur ce lien : https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html
Une fois le téléchargement achevé, double clique sur ZHPDiag.exe(clic droit ,"éxécuter en tant qu'administrateur" pour Vista).
Une fois installé le programme s'ouvre automatiquement .
Clique sur "options"(icone petit tournevis) puis cocher toutes les cases mis a part les 045 et 061 (décoché par défaut).
Clique sur la loupe pour lancer l'analyse.
A la fin de l'analyse, clique sur la "disquette" (enregistrer sous..) .
Rend toi sur ce site : http://www.cijoint.fr/index.php
Clique sur parcourir et sélectionne le fichier ZhpDiag.txt .
Un lien va etre créer ,poste ce lien dans ta prochaine réponse.
Une fois le téléchargement achevé, double clique sur ZHPDiag.exe(clic droit ,"éxécuter en tant qu'administrateur" pour Vista).
Une fois installé le programme s'ouvre automatiquement .
Clique sur "options"(icone petit tournevis) puis cocher toutes les cases mis a part les 045 et 061 (décoché par défaut).
Clique sur la loupe pour lancer l'analyse.
A la fin de l'analyse, clique sur la "disquette" (enregistrer sous..) .
Rend toi sur ce site : http://www.cijoint.fr/index.php
Clique sur parcourir et sélectionne le fichier ZhpDiag.txt .
Un lien va etre créer ,poste ce lien dans ta prochaine réponse.
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
26 déc. 2009 à 12:37
26 déc. 2009 à 12:37
Bonjour JFK President,
Voici le lien :
http://www.cijoint.fr/cjlink.php?file=cj200912/cijFzsNC8f.txt
Voici le lien :
http://www.cijoint.fr/cjlink.php?file=cj200912/cijFzsNC8f.txt
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
26 déc. 2009 à 12:53
26 déc. 2009 à 12:53
Tu as utilisé TDSSKiller ,peut tu me collé le rapport qui se trouve ici : C:\TDSSKiller (log.txt)
Tu va passer également ce fichier sur VirusTotal (comme indiqué post#33) : C:\WINDOWS\PEV.exe
Dis moi si ton pc va mieux ?
Tu va passer également ce fichier sur VirusTotal (comme indiqué post#33) : C:\WINDOWS\PEV.exe
Dis moi si ton pc va mieux ?
jeunenovice
Messages postés
37
Date d'inscription
mardi 22 décembre 2009
Statut
Membre
Dernière intervention
4 janvier 2010
26 déc. 2009 à 14:06
26 déc. 2009 à 14:06
Le PC va mieux d'une manière générale. J'ai toujours une fenêtre microsoft qui s'ouvre à chaque démarrage de l'ordi. J'ai également un fichier texte nommé EULA sur le bureau (???)
Dois je garder tous les programmes téléchargés sur le bureau : usbfix, combo, seaf, rsit, mbam,..;
Comment protéger efficament mon PC ? Quel antivirus ou antispyware, parefeu dois-je installer ???
Merci
VOici le rapport TDSSKILLER
22:45:21:109 3548 TDSSKiller 2.1.1 Dec 20 2009 02:40:02
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 SystemInfo:
22:45:21:109 3548 OS Version: 5.1.2600 ServicePack: 3.0
22:45:21:109 3548 Product type: Workstation
22:45:21:109 3548 ComputerName: ACER-FE8B363750
22:45:21:109 3548 UserName: Béda
22:45:21:109 3548 Windows directory: C:\WINDOWS
22:45:21:109 3548 Processor architecture: Intel x86
22:45:21:109 3548 Number of processors: 1
22:45:21:109 3548 Page size: 0x1000
22:45:21:109 3548 Boot type: Normal boot
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\Drivers\KLMD.sys) returned status 0
22:45:21:125 3548 main: Driver KLMD successfully dropped
22:45:21:125 3548 main: Driver KLMD successfully loaded
22:45:21:125 3548
Scanning Registry ...
22:45:21:125 3548 ScanServices: Searching service UACd.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service TDSSserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gaopdxserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gxvxcserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service MSIVXserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 UnhookRegistry: Kernel module file name: C:\windows\system32\ntoskrnl.exe, base addr: 804D7000
22:45:21:140 3548 UnhookRegistry: Kernel local addr: A40000
22:45:21:140 3548 UnhookRegistry: KeServiceDescriptorTable addr: ACB520
22:45:21:140 3548 UnhookRegistry: KiServiceTable addr: A4D8B0
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (local): 47
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey local addr: AE1E14
22:45:21:140 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:140 3548 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E380F[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (kernel): 47
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E49CC[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey real addr: 80578E14
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey calc addr: 80578E14
22:45:21:140 3548 UnhookRegistry: No SDT hooks found on NtEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x80578E14[0xA]
22:45:21:140 3548 UnhookRegistry: No splicing found on NtEnumerateKey
22:45:21:140 3548
Scanning Kernel memory ...
22:45:21:156 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 84F98F38
22:45:21:156 3548 DetectCureTDL3: KLMD_GetDeviceObjectList returned 16 DevObjects
22:45:21:156 3548 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 84D8BC68
22:45:21:156 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D8BC68
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D8BC68[0x38]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:156 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:156 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:156 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:156 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:156 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:156 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:156 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:156 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:156 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:156 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:156 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:171 3548 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 84D63130
22:45:21:171 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D63130
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D63130[0x38]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:171 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:171 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:171 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:187 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:187 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:187 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:187 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:187 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:187 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:187 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:187 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:187 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:187 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:187 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84D95510
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D95510
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84CF1030
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CF1030
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CF1030[0x38]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:203 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:203 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:203 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:203 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:203 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:203 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:203 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:203 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:203 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:203 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:218 3548 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 84D96C68
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D96C68
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D96C68[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:218 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:218 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:218 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:218 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:218 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 84DF6170
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84DF6170
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84DF6170[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 84D7EA08
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D7EA08
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D7EA08[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:234 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:234 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:234 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:234 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 6 Curr stack PDEVICE_OBJECT: 84D44988
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D44988
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D44988[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:250 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:250 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:250 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CD1AB8
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CD1AB8
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CBC030
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CBC030
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CBC030[0x38]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:250 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:250 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:250 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84D3EAB8
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D3EAB8
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84F5F540
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F540
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F540[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:265 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:265 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:265 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:265 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:265 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:265 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84A0F3E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A0F3E0
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84CB38E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CB38E0
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CB38E0[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84D40030
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D40030
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84F5F1D8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F1D8
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F1D8[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:281 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:281 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84A127F8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A127F8
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84CA5748
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CA5748
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CA5748[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:296 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:296 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 DetectCureTDL3: 12 Curr stack PDEVICE_OBJECT: 84F48C68
22:45:21:296 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48C68
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48C68[0x38]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:296 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:296 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:296 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:296 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 13 Curr stack PDEVICE_OBJECT: 84F48030
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48030
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48030[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:312 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 14 Curr stack PDEVICE_OBJECT: 84F977E8
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F977E8
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F977E8[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F98810
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F98810
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F8C580
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F8C580
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8C580[0x38]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F8CF38
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8CF38[0xA8]
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xE163A8E8[0x208]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
22:45:21:328 3548 DetectCureTDL3: IrpHandler (0) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (2) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (3) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (4) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (14) addr: F76AB712
22:45:21:328 3548 DetectCureTDL3: IrpHandler (15) addr: F76A7852
22:45:21:328 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (22) addr: F76AB73C
22:45:21:328 3548 DetectCureTDL3: IrpHandler (23) addr: F76B2336
22:45:21:328 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xF76A8864[0x400]
22:45:21:328 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 316, 0
22:45:21:328 3548 TDL3_FileDetect: Processing driver: atapi
22:45:21:328 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\atapi.sys, C:\WINDOWS\system32\Drivers\atapi.tsk, SYSTEM\CurrentControlSet\Services\atapi, system32\Drivers\atapi.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:343 3548
Completed
Results:
22:45:21:343 3548 Infected objects in memory: 0
22:45:21:343 3548 Cured objects in memory: 0
22:45:21:343 3548 Infected objects on disk: 0
22:45:21:343 3548 Objects on disk cured on reboot: 0
22:45:21:343 3548 Objects on disk deleted on reboot: 0
22:45:21:343 3548 Registry nodes deleted on reboot: 0
22:45:21:343 3548
VOICI LE RAPPORT VIRUS TOTAL
Fichier PEV.exe reçu le 2009.12.26 12:56:34 (UTC)
Situation actuelle: terminé
Résultat: 4/41 (9.76%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.26 -
AhnLab-V3 5.0.0.2 2009.12.26 -
AntiVir 7.9.1.122 2009.12.25 -
Antiy-AVL 2.0.3.7 2009.12.25 -
Authentium 5.2.0.5 2009.12.26 -
Avast 4.8.1351.0 2009.12.26 -
AVG 8.5.0.430 2009.12.26 -
BitDefender 7.2 2009.12.26 -
CAT-QuickHeal 10.00 2009.12.26 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.12.26 -
Comodo 3375 2009.12.26 -
DrWeb 5.0.1.12222 2009.12.26 -
eSafe 7.0.17.0 2009.12.24 Suspicious File
eTrust-Vet 35.1.7198 2009.12.25 -
F-Prot 4.5.1.85 2009.12.26 -
F-Secure 9.0.15370.0 2009.12.26 -
Fortinet 4.0.14.0 2009.12.26 -
GData 19 2009.12.26 -
Ikarus T3.1.1.79.0 2009.12.26 -
Jiangmin 13.0.900 2009.12.26 -
K7AntiVirus 7.10.931 2009.12.26 -
Kaspersky 7.0.0.125 2009.12.26 -
McAfee 5842 2009.12.24 -
McAfee+Artemis 5842 2009.12.24 -
McAfee-GW-Edition 6.8.5 2009.12.26 Heuristic.LooksLike.Win32.Suspicious.C
Microsoft 1.5302 2009.12.26 -
NOD32 4716 2009.12.25 -
Norman 6.04.03 2009.12.26 -
nProtect 2009.1.8.0 2009.12.26 -
Panda 10.0.2.2 2009.12.15 Suspicious file
PCTools 7.0.3.5 2009.12.26 -
Prevx 3.0 2009.12.26 -
Rising 22.27.05.04 2009.12.26 -
Sophos 4.49.0 2009.12.25 -
Sunbelt 3.2.1858.2 2009.12.26 -
Symantec 1.4.4.12 2009.12.26 -
TheHacker 6.5.0.3.111 2009.12.25 -
TrendMicro 9.120.0.1004 2009.12.26 -
VBA32 3.12.12.0 2009.12.26 -
ViRobot 2009.12.26.2109 2009.12.26 -
VirusBuster 5.0.21.0 2009.12.25 -
Information additionnelle
File size: 261632 bytes
MD5 : 4e20f3b27b334e9273fc3890b7948bd8
SHA1 : ff937b7eb12048f227d35d42efe3375dc5d7d1a0
SHA256: afb212b270e325888c330e97ef93fe5399e0ab6b0870c624ab28231fc8ee8c72
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x4B1FB9AD (Wed Dec 9 15:52:29 2009)
machinetype.......: 0x14C (Intel I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xD1000 0x3E600 8.00 aa60f3c16e3b0fab6e082459c3701555
.rsrc 0xD2000 0x2000 0x1200 7.23 7dd9c5b051360dcd9867eb9ac7e54706
.reloc 0xD4000 0x200 0x200 0.22 b2653d9ffb17cc053523a34099297f53
( 1 imports )
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
( 0 exports )
TrID : File type identification
Win32 EXE PECompact compressed (v2.x) (48.9%)
Win32 EXE PECompact compressed (generic) (34.4%)
Win32 Executable Generic (7.0%)
Win32 Dynamic Link Library (generic) (6.2%)
Generic Win/DOS Executable (1.6%)
ssdeep: 6144:Lb0Cz2tkTv92ga9kLs9VCmm+9ah0jdWWG6tLoack7Z1Q:LbzitE92kLP9+98Iw6tTT1Q
PEiD : -
packers (Kaspersky): PE_Patch.PECompact, PecBundle
packers (F-Prot): PecBundle, PECompact
RDS : NSRL Reference Data Set
-
Dois je garder tous les programmes téléchargés sur le bureau : usbfix, combo, seaf, rsit, mbam,..;
Comment protéger efficament mon PC ? Quel antivirus ou antispyware, parefeu dois-je installer ???
Merci
VOici le rapport TDSSKILLER
22:45:21:109 3548 TDSSKiller 2.1.1 Dec 20 2009 02:40:02
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 SystemInfo:
22:45:21:109 3548 OS Version: 5.1.2600 ServicePack: 3.0
22:45:21:109 3548 Product type: Workstation
22:45:21:109 3548 ComputerName: ACER-FE8B363750
22:45:21:109 3548 UserName: Béda
22:45:21:109 3548 Windows directory: C:\WINDOWS
22:45:21:109 3548 Processor architecture: Intel x86
22:45:21:109 3548 Number of processors: 1
22:45:21:109 3548 Page size: 0x1000
22:45:21:109 3548 Boot type: Normal boot
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\Drivers\KLMD.sys) returned status 0
22:45:21:125 3548 main: Driver KLMD successfully dropped
22:45:21:125 3548 main: Driver KLMD successfully loaded
22:45:21:125 3548
Scanning Registry ...
22:45:21:125 3548 ScanServices: Searching service UACd.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service TDSSserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gaopdxserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gxvxcserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service MSIVXserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 UnhookRegistry: Kernel module file name: C:\windows\system32\ntoskrnl.exe, base addr: 804D7000
22:45:21:140 3548 UnhookRegistry: Kernel local addr: A40000
22:45:21:140 3548 UnhookRegistry: KeServiceDescriptorTable addr: ACB520
22:45:21:140 3548 UnhookRegistry: KiServiceTable addr: A4D8B0
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (local): 47
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey local addr: AE1E14
22:45:21:140 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:140 3548 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E380F[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (kernel): 47
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E49CC[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey real addr: 80578E14
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey calc addr: 80578E14
22:45:21:140 3548 UnhookRegistry: No SDT hooks found on NtEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x80578E14[0xA]
22:45:21:140 3548 UnhookRegistry: No splicing found on NtEnumerateKey
22:45:21:140 3548
Scanning Kernel memory ...
22:45:21:156 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 84F98F38
22:45:21:156 3548 DetectCureTDL3: KLMD_GetDeviceObjectList returned 16 DevObjects
22:45:21:156 3548 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 84D8BC68
22:45:21:156 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D8BC68
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D8BC68[0x38]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:156 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:156 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:156 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:156 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:156 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:156 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:156 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:156 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:156 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:156 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:156 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:171 3548 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 84D63130
22:45:21:171 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D63130
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D63130[0x38]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:171 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:171 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:171 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:187 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:187 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:187 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:187 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:187 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:187 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:187 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:187 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:187 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:187 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:187 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84D95510
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D95510
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84CF1030
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CF1030
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CF1030[0x38]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:203 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:203 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:203 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:203 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:203 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:203 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:203 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:203 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:203 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:203 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:218 3548 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 84D96C68
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D96C68
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D96C68[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:218 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:218 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:218 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:218 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:218 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 84DF6170
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84DF6170
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84DF6170[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 84D7EA08
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D7EA08
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D7EA08[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:234 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:234 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:234 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:234 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 6 Curr stack PDEVICE_OBJECT: 84D44988
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D44988
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D44988[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:250 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:250 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:250 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CD1AB8
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CD1AB8
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CBC030
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CBC030
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CBC030[0x38]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:250 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:250 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:250 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84D3EAB8
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D3EAB8
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84F5F540
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F540
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F540[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:265 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:265 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:265 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:265 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:265 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:265 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84A0F3E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A0F3E0
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84CB38E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CB38E0
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CB38E0[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84D40030
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D40030
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84F5F1D8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F1D8
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F1D8[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:281 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:281 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84A127F8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A127F8
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84CA5748
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CA5748
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CA5748[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:296 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:296 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 DetectCureTDL3: 12 Curr stack PDEVICE_OBJECT: 84F48C68
22:45:21:296 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48C68
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48C68[0x38]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:296 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:296 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:296 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:296 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 13 Curr stack PDEVICE_OBJECT: 84F48030
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48030
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48030[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:312 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 14 Curr stack PDEVICE_OBJECT: 84F977E8
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F977E8
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F977E8[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F98810
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F98810
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F8C580
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F8C580
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8C580[0x38]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F8CF38
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8CF38[0xA8]
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xE163A8E8[0x208]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
22:45:21:328 3548 DetectCureTDL3: IrpHandler (0) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (2) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (3) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (4) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (14) addr: F76AB712
22:45:21:328 3548 DetectCureTDL3: IrpHandler (15) addr: F76A7852
22:45:21:328 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (22) addr: F76AB73C
22:45:21:328 3548 DetectCureTDL3: IrpHandler (23) addr: F76B2336
22:45:21:328 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xF76A8864[0x400]
22:45:21:328 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 316, 0
22:45:21:328 3548 TDL3_FileDetect: Processing driver: atapi
22:45:21:328 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\atapi.sys, C:\WINDOWS\system32\Drivers\atapi.tsk, SYSTEM\CurrentControlSet\Services\atapi, system32\Drivers\atapi.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:343 3548
Completed
Results:
22:45:21:343 3548 Infected objects in memory: 0
22:45:21:343 3548 Cured objects in memory: 0
22:45:21:343 3548 Infected objects on disk: 0
22:45:21:343 3548 Objects on disk cured on reboot: 0
22:45:21:343 3548 Objects on disk deleted on reboot: 0
22:45:21:343 3548 Registry nodes deleted on reboot: 0
22:45:21:343 3548
VOICI LE RAPPORT VIRUS TOTAL
Fichier PEV.exe reçu le 2009.12.26 12:56:34 (UTC)
Situation actuelle: terminé
Résultat: 4/41 (9.76%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.26 -
AhnLab-V3 5.0.0.2 2009.12.26 -
AntiVir 7.9.1.122 2009.12.25 -
Antiy-AVL 2.0.3.7 2009.12.25 -
Authentium 5.2.0.5 2009.12.26 -
Avast 4.8.1351.0 2009.12.26 -
AVG 8.5.0.430 2009.12.26 -
BitDefender 7.2 2009.12.26 -
CAT-QuickHeal 10.00 2009.12.26 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.12.26 -
Comodo 3375 2009.12.26 -
DrWeb 5.0.1.12222 2009.12.26 -
eSafe 7.0.17.0 2009.12.24 Suspicious File
eTrust-Vet 35.1.7198 2009.12.25 -
F-Prot 4.5.1.85 2009.12.26 -
F-Secure 9.0.15370.0 2009.12.26 -
Fortinet 4.0.14.0 2009.12.26 -
GData 19 2009.12.26 -
Ikarus T3.1.1.79.0 2009.12.26 -
Jiangmin 13.0.900 2009.12.26 -
K7AntiVirus 7.10.931 2009.12.26 -
Kaspersky 7.0.0.125 2009.12.26 -
McAfee 5842 2009.12.24 -
McAfee+Artemis 5842 2009.12.24 -
McAfee-GW-Edition 6.8.5 2009.12.26 Heuristic.LooksLike.Win32.Suspicious.C
Microsoft 1.5302 2009.12.26 -
NOD32 4716 2009.12.25 -
Norman 6.04.03 2009.12.26 -
nProtect 2009.1.8.0 2009.12.26 -
Panda 10.0.2.2 2009.12.15 Suspicious file
PCTools 7.0.3.5 2009.12.26 -
Prevx 3.0 2009.12.26 -
Rising 22.27.05.04 2009.12.26 -
Sophos 4.49.0 2009.12.25 -
Sunbelt 3.2.1858.2 2009.12.26 -
Symantec 1.4.4.12 2009.12.26 -
TheHacker 6.5.0.3.111 2009.12.25 -
TrendMicro 9.120.0.1004 2009.12.26 -
VBA32 3.12.12.0 2009.12.26 -
ViRobot 2009.12.26.2109 2009.12.26 -
VirusBuster 5.0.21.0 2009.12.25 -
Information additionnelle
File size: 261632 bytes
MD5 : 4e20f3b27b334e9273fc3890b7948bd8
SHA1 : ff937b7eb12048f227d35d42efe3375dc5d7d1a0
SHA256: afb212b270e325888c330e97ef93fe5399e0ab6b0870c624ab28231fc8ee8c72
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x4B1FB9AD (Wed Dec 9 15:52:29 2009)
machinetype.......: 0x14C (Intel I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xD1000 0x3E600 8.00 aa60f3c16e3b0fab6e082459c3701555
.rsrc 0xD2000 0x2000 0x1200 7.23 7dd9c5b051360dcd9867eb9ac7e54706
.reloc 0xD4000 0x200 0x200 0.22 b2653d9ffb17cc053523a34099297f53
( 1 imports )
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
( 0 exports )
TrID : File type identification
Win32 EXE PECompact compressed (v2.x) (48.9%)
Win32 EXE PECompact compressed (generic) (34.4%)
Win32 Executable Generic (7.0%)
Win32 Dynamic Link Library (generic) (6.2%)
Generic Win/DOS Executable (1.6%)
ssdeep: 6144:Lb0Cz2tkTv92ga9kLs9VCmm+9ah0jdWWG6tLoack7Z1Q:LbzitE92kLP9+98Iw6tTT1Q
PEiD : -
packers (Kaspersky): PE_Patch.PECompact, PecBundle
packers (F-Prot): PecBundle, PECompact
RDS : NSRL Reference Data Set
-
jfkpresident
Messages postés
13408
Date d'inscription
lundi 3 septembre 2007
Statut
Contributeur sécurité
Dernière intervention
5 janvier 2015
1 175
26 déc. 2009 à 15:10
26 déc. 2009 à 15:10
J'ai toujours une fenêtre microsoft qui s'ouvre à chaque démarrage de l'ordi.
C'est a dire ?
J'ai également un fichier texte nommé EULA sur le bureau (???)
Tu peux le supprimer si il t'est inconnu .
Tu as toujours AVG antivirus d'actif ?
