Virus Malware Defense - Page 2

  1. Alex2345
    Je viens d'en faire un autre

    18:36:08:781 3660 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
    18:36:08:781 3660 ================================================================================
    18:36:08:781 3660 SystemInfo:

    18:36:08:781 3660 OS Version: 5.1.2600 ServicePack: 3.0
    18:36:08:781 3660 Product type: Workstation
    18:36:08:781 3660 ComputerName: IBM-0D2F2C11BCC
    18:36:08:781 3660 UserName: Administrateur
    18:36:08:781 3660 Windows directory: C:\WINDOWS
    18:36:08:781 3660 Processor architecture: Intel x86
    18:36:08:781 3660 Number of processors: 2
    18:36:08:781 3660 Page size: 0x1000
    18:36:08:781 3660 Boot type: Normal boot
    18:36:08:781 3660 ================================================================================
    18:36:08:796 3660 UnloadDriverW: NtUnloadDriver error 2
    18:36:08:796 3660 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
    18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
    18:36:08:796 3660 UtilityInit: KLMD drop and load success
    18:36:08:796 3660 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
    18:36:08:796 3660 UtilityInit: KLMD open success
    18:36:08:796 3660 UtilityInit: Initialize success
    18:36:08:796 3660
    18:36:08:796 3660 Scanning Services ...
    18:36:08:796 3660 CreateRegParser: Registry parser init started
    18:36:08:796 3660 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
    18:36:08:796 3660 CreateRegParser: DisableWow64Redirection error
    18:36:08:796 3660 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
    18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
    18:36:08:796 3660 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
    18:36:08:796 3660 wfopen_ex: Trying to KLMD file open
    18:36:08:796 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
    18:36:08:796 3660 wfopen_ex: File opened ok (Flags 2)
    18:36:08:796 3660 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 384B40
    18:36:08:796 3660 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
    18:36:08:796 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
    18:36:08:796 3660 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
    18:36:08:796 3660 wfopen_ex: Trying to KLMD file open
    18:36:08:796 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
    18:36:08:796 3660 wfopen_ex: File opened ok (Flags 2)
    18:36:08:796 3660 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 384BA8
    18:36:08:796 3660 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
    18:36:08:796 3660 CreateRegParser: EnableWow64Redirection error
    18:36:08:796 3660 CreateRegParser: RegParser init completed
    18:36:09:156 3660 GetAdvancedServicesInfo: Raw services enum returned 335 services
    18:36:09:171 3660 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
    18:36:09:171 3660 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
    18:36:09:171 3660
    18:36:09:171 3660 Scanning Kernel memory ...
    18:36:09:171 3660 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
    18:36:09:171 3660 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8636CA08
    18:36:09:171 3660 DetectCureTDL3: KLMD_GetDeviceObjectList returned 2 DevObjects
    18:36:09:171 3660
    18:36:09:171 3660 DetectCureTDL3: DEVICE_OBJECT: 863D2A50
    18:36:09:171 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 863D2A50
    18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0x863D2A50[0x38]
    18:36:09:171 3660 DetectCureTDL3: DRIVER_OBJECT: 8636CA08
    18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0x8636CA08[0xA8]
    18:36:09:171 3660 KLMD_ReadMem: Trying to ReadMemory 0xE13F7968[0x18]
    18:36:09:171 3660 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (0) addr: F767DBB0
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (1) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (2) addr: F767DBB0
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (3) addr: F7677D1F
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (4) addr: F7677D1F
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (5) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (6) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (7) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (8) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (9) addr: F76782E2
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (10) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (11) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (12) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (13) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (14) addr: F76783BB
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (15) addr: F767BF28
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (16) addr: F76782E2
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (17) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (18) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (19) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (20) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (21) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (22) addr: F7679C82
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (23) addr: F767E99E
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (24) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (25) addr: 804F4562
    18:36:09:171 3660 DetectCureTDL3: IrpHandler (26) addr: 804F4562
    18:36:09:171 3660 TDL3_FileDetect: Processing driver: Disk
    18:36:09:171 3660 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
    18:36:09:171 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
    18:36:09:187 3660 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
    18:36:09:187 3660
    18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 86376AB8
    18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 86376AB8
    18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 8637DF18
    18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8637DF18
    18:36:09:187 3660 DetectCureTDL3: DEVICE_OBJECT: 863D5D98
    18:36:09:187 3660 KLMD_GetLowerDeviceObject: Trying to get lower device object for 863D5D98
    18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0x863D5D98[0x38]
    18:36:09:187 3660 DetectCureTDL3: DRIVER_OBJECT: 8637FAC0
    18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0x8637FAC0[0xA8]
    18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0xE1024260[0x1A]
    18:36:09:187 3660 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (0) addr: F74936F2
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (1) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (2) addr: F74936F2
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (3) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (4) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (5) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (6) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (7) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (8) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (9) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (10) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (11) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (12) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (13) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (14) addr: F7493712
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (15) addr: F748F852
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (16) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (17) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (18) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (19) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (20) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (21) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (22) addr: F749373C
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (23) addr: F749A336
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (24) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (25) addr: 804F4562
    18:36:09:187 3660 DetectCureTDL3: IrpHandler (26) addr: 804F4562
    18:36:09:187 3660 KLMD_ReadMem: Trying to ReadMemory 0xF7490864[0x400]
    18:36:09:187 3660 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
    18:36:09:187 3660 TDL3_FileDetect: Processing driver: atapi
    18:36:09:187 3660 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
    18:36:09:187 3660 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
    18:36:09:203 3660 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
    18:36:09:203 3660
    18:36:09:203 3660 Completed
    18:36:09:203 3660
    18:36:09:203 3660 Results:
    18:36:09:203 3660 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
    18:36:09:203 3660 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
    18:36:09:203 3660 File objects infected / cured / cured on reboot: 0 / 0 / 0
    18:36:09:203 3660
    18:36:09:203 3660 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
    18:36:09:203 3660 UtilityDeinit: KLMD(ARK) unloaded successfully
    0
    1. moment de grace Contributeur sécurité
      Rends toi sur ce site :

      https://www.virustotal.com/gui/

      Clique sur parcourir et cherche ce fichier : C:\WINDOWS\system32\drivers\klmd.sys

      Clique sur Send File.

      Un rapport va s'élaborer ligne à ligne.

      Attends la fin. Il doit comprendre la taille du fichier envoyé.

      Sauvegarde le rapport avec le bloc-note.

      Copie le dans ta réponse.

      Si tu ne trouves pas le fichier alors

      Affiche tous les fichiers et dossiers :

      Pour cela :
      Clique sur démarrer/panneau de configuration/option des dossiers/affichage

      Cocher afficher les dossiers cachés

      Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

      Décocher masquer les extensions dont le type est connu

      Puis fais «appliquer» pour valider les changements.

      Et OK
      0
      1. alex2345
        Je ne pourrais pas le faire pour le moments puisqu'il ne sagisssait pas de mon ordi...

        Je posterais dès que ce sera fait...

        Merci de ton aide et de ton temps
        0
        1. alex2345
          Je ne trouve pas le fichier klmd.sys
          0
          2. moment de grace Contributeur sécurité
            as tu affiché les dossiers et fichiers cachés
            0
            1. alex2345
              Oui, mais je ne le trouve pas quand même
              0
              1. moment de grace Contributeur sécurité
                ok

                comment va le pc ?
                0
                Précédent
                • 1
                • 2

                Discussions similaires

                urldefense.com : Kézaco?
                Tessel75

                4 réponses
                supprimer tor.jack android
                sabinelouisonbruno

                4 réponses
                Win64 malware gen
                jules555

                1 réponse
                Softonic,est-ce un virus ?
                techmel1

                6 réponses
                Win64:Malware-gen
                ptb35

                3 réponses