Virus Malware Defense - Page 2

Précédent
  • 1
  • 2
Réponse 21 / 27
Alex2345
 
Je viens d'en faire un autre

18:36:08:781 3660 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
18:36:08:781 3660 ================================================================================
18:36:08:781 3660 SystemInfo:

18:36:08:781 3660 OS Version: 5.1.2600 ServicePack: 3.0
18:36:08:781 3660 Product type: Workstation
18:36:08:781 3660 ComputerName: IBM-0D2F2C11BCC
18:36:08:781 3660 UserName: Administrateur
18:36:08:781 3660 Windows directory: C:\WINDOWS
18:36:08:781 3660 Processor architecture: Intel x86
18:36:08:781 3660 Number of processors: 2
18:36:08:781 3660 Page size: 0x1000
18:36:08:781 3660 Boot type: Normal boot
18:36:08:781 3660 ================================================================================
18:36:08:796 3660 UnloadDriverW: NtUnloadDriver error 2
18:36:08:796 3660 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
18:36:08:796 3660 UtilityInit: KLMD drop and load success
18:36:08:796 3660 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
18:36:08:796 3660 UtilityInit: KLMD open success
18:36:08:796 3660 UtilityInit: Initialize success
18:36:08:796 3660
18:36:08:796 3660 Scanning Services ...
18:36:08:796 3660 CreateRegParser: Registry parser init started
18:36:08:796 3660 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
18:36:08:796 3660 CreateRegParser: DisableWow64Redirection error
18:36:08:796 3660 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
18:36:08:796 3660 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:36:08:796 3660 wfopen_ex: Trying to KLMD file open
18:36:08:796 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
18:36:08:796 3660 wfopen_ex: File opened ok (Flags 2)
18:36:08:796 3660 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 384B40
18:36:08:796 3660 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
18:36:08:796 3660 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:36:08:796 3660 wfopen_ex: Trying to KLMD file open
18:36:08:796 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
18:36:08:796 3660 wfopen_ex: File opened ok (Flags 2)
18:36:08:796 3660 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 384BA8
18:36:08:796 3660 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
18:36:08:796 3660 CreateRegParser: EnableWow64Redirection error
18:36:08:796 3660 CreateRegParser: RegParser init completed
18:36:09:156 3660 GetAdvancedServicesInfo: Raw services enum returned 335 services
18:36:09:171 3660 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
18:36:09:171 3660 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
18:36:09:171 3660
18:36:09:171 3660 Scanning Kernel memory ...
18:36:09:171 3660 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
18:36:09:171 3660 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8636CA08
18:36:09:171 3660 DetectCureTDL3: KLMD_GetDeviceObjectList returned 2 DevObjects
18:36:09:171 3660
18:36:09:171 3660 DetectCureTDL3: DEVICE_OBJECT: 863D2A50
18:36:09:171 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 863D2A50
18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0x863D2A50[0x38]
18:36:09:171 3660 DetectCureTDL3: DRIVER_OBJECT: 8636CA08
18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0x8636CA08[0xA8]
18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0xE13F7968[0x18]
18:36:09:171 3660 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:36:09:171 3660 DetectCureTDL3: IrpHandler (0) addr: F767DBB0
18:36:09:171 3660 DetectCureTDL3: IrpHandler (1) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (2) addr: F767DBB0
18:36:09:171 3660 DetectCureTDL3: IrpHandler (3) addr: F7677D1F
18:36:09:171 3660 DetectCureTDL3: IrpHandler (4) addr: F7677D1F
18:36:09:171 3660 DetectCureTDL3: IrpHandler (5) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (6) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (7) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (8) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (9) addr: F76782E2
18:36:09:171 3660 DetectCureTDL3: IrpHandler (10) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (11) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (12) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (13) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (14) addr: F76783BB
18:36:09:171 3660 DetectCureTDL3: IrpHandler (15) addr: F767BF28
18:36:09:171 3660 DetectCureTDL3: IrpHandler (16) addr: F76782E2
18:36:09:171 3660 DetectCureTDL3: IrpHandler (17) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (18) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (19) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (20) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (21) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (22) addr: F7679C82
18:36:09:171 3660 DetectCureTDL3: IrpHandler (23) addr: F767E99E
18:36:09:171 3660 DetectCureTDL3: IrpHandler (24) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (25) addr: 804F4562
18:36:09:171 3660 DetectCureTDL3: IrpHandler (26) addr: 804F4562
18:36:09:171 3660 TDL3_FileDetect: Processing driver: Disk
18:36:09:171 3660 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:36:09:171 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:36:09:187 3660 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:36:09:187 3660
18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 86376AB8
18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 86376AB8
18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 8637DF18
18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8637DF18
18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 863D5D98
18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 863D5D98
18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0x863D5D98[0x38]
18:36:09:187 3660 DetectCureTDL3: DRIVER_OBJECT: 8637FAC0
18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0x8637FAC0[0xA8]
18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0xE1024260[0x1A]
18:36:09:187 3660 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
18:36:09:187 3660 DetectCureTDL3: IrpHandler (0) addr: F74936F2
18:36:09:187 3660 DetectCureTDL3: IrpHandler (1) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (2) addr: F74936F2
18:36:09:187 3660 DetectCureTDL3: IrpHandler (3) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (4) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (5) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (6) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (7) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (8) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (9) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (10) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (11) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (12) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (13) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (14) addr: F7493712
18:36:09:187 3660 DetectCureTDL3: IrpHandler (15) addr: F748F852
18:36:09:187 3660 DetectCureTDL3: IrpHandler (16) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (17) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (18) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (19) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (20) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (21) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (22) addr: F749373C
18:36:09:187 3660 DetectCureTDL3: IrpHandler (23) addr: F749A336
18:36:09:187 3660 DetectCureTDL3: IrpHandler (24) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (25) addr: 804F4562
18:36:09:187 3660 DetectCureTDL3: IrpHandler (26) addr: 804F4562
18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0xF7490864[0x400]
18:36:09:187 3660 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:36:09:187 3660 TDL3_FileDetect: Processing driver: atapi
18:36:09:187 3660 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
18:36:09:187 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
18:36:09:203 3660 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
18:36:09:203 3660
18:36:09:203 3660 Completed
18:36:09:203 3660
18:36:09:203 3660 Results:
18:36:09:203 3660 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
18:36:09:203 3660 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
18:36:09:203 3660 File objects infected / cured / cured on reboot: 0 / 0 / 0
18:36:09:203 3660
18:36:09:203 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
18:36:09:203 3660 UtilityDeinit: KLMD(ARK) unloaded successfully
0
Réponse 22 / 27
moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
 
Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\drivers\klmd.sys

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

Copie le dans ta réponse.

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers :

Pour cela :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu

Puis fais «appliquer» pour valider les changements.

Et OK
0
Réponse 23 / 27
alex2345
 
Je ne pourrais pas le faire pour le moments puisqu'il ne sagisssait pas de mon ordi...

Je posterais dès que ce sera fait...

Merci de ton aide et de ton temps
0
Réponse 24 / 27
alex2345
 
Je ne trouve pas le fichier klmd.sys
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 25 / 27
moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
 
as tu affiché les dossiers et fichiers cachés
0
Réponse 26 / 27
alex2345
 
Oui, mais je ne le trouve pas quand même
0
Réponse 27 / 27
moment de grace Messages postés 29099 Date d'inscription   Statut Contributeur sécurité Dernière intervention   2 274
 
ok

comment va le pc ?
0
Précédent
  • 1
  • 2

Discussions similaires

urldefense.com : Kézaco?
Tessel75 -
Tessel75 -

4 réponses
Tor.Jack.Malware
Camille -
bazfile -

1 réponse
supprimer tor.jack android
sabinelouisonbruno -
akaloupile -

4 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses