Virus Analyse Hijackthis

bonjour :

sauvegarde tes documents importants , puis :


/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\

__________________________________________________________
>Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.<
>>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<<
=====================================================

▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur

▶ On va utiliser ComboFix.exe. Rends toi sur cette page web pour obtenir les liens de téléchargement, ainsi que des instructions pour exécuter l'outil:

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Avant d'utiliser ComboFix :
________________________________________________________
>> referme les fenêtres de tous les programmes en cours.
>> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix,
>>la protection en temps réel de ton Antivirus et de tes Antispywares,
>>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!!

▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

bonjour,
merci pour les indications, désolée je n'ai pas pu le faire avant.
J'ai tenté de tout faire comme indiqué dans le lien mais j'ai un souci ça me fait redemarrer le pc et du coup je n'ai pas de log file.
J'ai retenté et impossible, je ne vois pas ce qui ne marche pas avec combofix

en fait il commence bien puis ensuite il redémarre tout seul, et ensuite ça lance une vérification des discs
et ce que je comprend pas c'est que quand je vais dans l'explorateur j ai plein de fois combofix et a l interieur j ai a nouveau tout :(
je comprend rien j ai reussi a desinstaller combofix mais du coup je sais pas si ca a servi q uelque chose.

j ai refais un hijack au cas ou
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:14:14, on 04/09/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ACEngSvr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Matu\LOCALS~1\Temp\Cdu.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.courrierinternational.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.asus.com/fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [gvrqkxwr] C:\Documents and Settings\Matu\Local Settings\Application Data\gbgeysiou\xlepgxxtssd.exe
O4 - HKLM\..\Run: [sesjhouq] C:\Documents and Settings\Matu\Local Settings\Application Data\lsmelomro\jwexcjttssd.exe
O4 - HKLM\..\Run: [brhnkutw] C:\Documents and Settings\NetworkService\Local Settings\Application Data\sejbbedsq\ufwiuuntssd.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [M5T8QL3YW3] C:\DOCUME~1\Matu\LOCALS~1\Temp\Cdu.exe
O4 - HKCU\..\Run: [gvrqkxwr] C:\Documents and Settings\Matu\Local Settings\Application Data\gbgeysiou\xlepgxxtssd.exe
O4 - HKCU\..\Run: [sesjhouq] C:\Documents and Settings\Matu\Local Settings\Application Data\lsmelomro\jwexcjttssd.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [brhnkutw] C:\Documents and Settings\NetworkService\Local Settings\Application Data\sejbbedsq\ufwiuuntssd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: MultiFrame.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.asus.com/fr/
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CC8263A-6315-4B1D-BEF5-5945CCD869FE}: NameServer = 93.188.163.178,93.188.166.173
O17 - HKLM\System\CCS\Services\Tcpip\..\{24C998FE-F699-4218-8DAC-DCAD9F4C5FEE}: NameServer = 93.188.163.178,93.188.166.173
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.163.178,93.188.166.173
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CC8263A-6315-4B1D-BEF5-5945CCD869FE}: NameServer = 93.188.163.178,93.188.166.173
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.163.178,93.188.166.173
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Windows MSI - Unknown owner - \\?\globalrootC:\WINDOWS\system32\msihost.exe (file missing)
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Matu/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg

End of file - 12051 bytes

salut tu n'as pas ceci :

C:\Combofix.txt ?

ben non c'est ça le souci, j'ai retenté en le re télechargeant et en ne changeant pas le nom, pareil il se met à redemarrer.
et pas de fichier .txt
donc j ai désinstallé et là je ne sais plus quoi faire :(

▶ Télécharge TDSSKiller

▶ Lance le ( Utilisateurs de vista/Seven -> Clic droit puis " Exécuter en tant que........... " )

L'outil va télécharger automatiquement la dernière version de TDSSKiller puis lancera une analyse.

Patiente pendant le scan. A la fin de l'analyse, appuies sur une touche. Un rapport va s'ouvrir.

▶ Copie/Colle son contenu dans ta prochaine réponse.

Note : Le rapport se trouve également sous C:\tdsskiller.txt.

2010/09/04 22:20:58.0828 TDSS rootkit removing tool 2.4.2.0 Sep 3 2010 10:26:06
2010/09/04 22:20:58.0828 ================================================================================
2010/09/04 22:20:58.0828 SystemInfo:
2010/09/04 22:20:58.0828
2010/09/04 22:20:58.0828 OS Version: 5.1.2600 ServicePack: 2.0
2010/09/04 22:20:58.0828 Product type: Workstation
2010/09/04 22:20:58.0828 ComputerName: MATHILDE
2010/09/04 22:20:58.0828 UserName: Matu
2010/09/04 22:20:58.0828 Windows directory: C:\WINDOWS
2010/09/04 22:20:58.0828 System windows directory: C:\WINDOWS
2010/09/04 22:20:58.0828 Processor architecture: Intel x86
2010/09/04 22:20:58.0828 Number of processors: 2
2010/09/04 22:20:58.0828 Page size: 0x1000
2010/09/04 22:20:58.0828 Boot type: Normal boot
2010/09/04 22:20:58.0828 ================================================================================
2010/09/04 22:20:59.0171 Initialize success
2010/09/04 22:21:15.0406 ================================================================================
2010/09/04 22:21:15.0406 Scan started
2010/09/04 22:21:15.0406 Mode: Manual;
2010/09/04 22:21:15.0406 ================================================================================
2010/09/04 22:21:22.0281 ACPI (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/09/04 22:21:22.0343 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2010/09/04 22:21:23.0406 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2010/09/04 22:21:23.0531 AegisP (15e655baa989444f56787ef558a823643) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2010/09/04 22:21:23.0828 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2010/09/04 22:21:24.0796 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/09/04 22:21:25.0515 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/09/04 22:21:25.0796 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/09/04 22:21:26.0171 ati2mtag (86a7a22f3670465ef575614e001159c0) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/09/04 22:21:26.0359 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/09/04 22:21:26.0500 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/09/04 22:21:26.0593 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/09/04 22:21:26.0656 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/09/04 22:21:26.0781 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/09/04 22:21:26.0953 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/09/04 22:21:27.0062 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/09/04 22:21:27.0203 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/09/04 22:21:27.0609 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2010/09/04 22:21:27.0828 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2010/09/04 22:21:28.0296 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/09/04 22:21:28.0406 dmboot (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
2010/09/04 22:21:28.0593 dmio (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
2010/09/04 22:21:28.0671 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/09/04 22:21:28.0796 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2010/09/04 22:21:29.0031 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/09/04 22:21:29.0125 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/09/04 22:21:29.0218 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
2010/09/04 22:21:29.0265 Fips (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
2010/09/04 22:21:29.0437 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/09/04 22:21:29.0687 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/09/04 22:21:29.0906 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/09/04 22:21:29.0984 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/09/04 22:21:30.0265 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/09/04 22:21:30.0453 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/09/04 22:21:30.0609 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/09/04 22:21:30.0812 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/09/04 22:21:31.0031 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/09/04 22:21:31.0718 i8042prt (d1efcbd693b5ba21314d06368c471070) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/09/04 22:21:31.0875 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/09/04 22:21:33.0406 IntcAzAudAddService (284bcb80391783d328a8d8163e97fd58) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/09/04 22:21:34.0515 intelppm (dd5ad1e79ac26d3f8d8828ad4627f160) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/09/04 22:21:34.0625 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/09/04 22:21:34.0703 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/09/04 22:21:34.0796 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/09/04 22:21:34.0890 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/09/04 22:21:35.0000 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/09/04 22:21:35.0171 ipswuio (ee8cc26924a6f07972bbf04487ebd552) C:\WINDOWS\system32\DRIVERS\ipswuio.sys
2010/09/04 22:21:35.0390 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/09/04 22:21:35.0546 isapnp (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/09/04 22:21:35.0765 Kbdclass (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/09/04 22:21:36.0046 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2010/09/04 22:21:36.0156 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/09/04 22:21:36.0546 mfeapfk (1619082b1d7f731b11449f48e91cc84c) C:\WINDOWS\system32\drivers\mfeapfk.sys
2010/09/04 22:21:36.0625 mfeavfk (1fae237d343904e24b3a9eb04bbd8170) C:\WINDOWS\system32\drivers\mfeavfk.sys
2010/09/04 22:21:36.0718 mfebopk (8c324da46f9fcc5c107ceda4dbcfc7ae) C:\WINDOWS\system32\drivers\mfebopk.sys
2010/09/04 22:21:36.0812 mfehidk (d0123e113243bdd427611f265bbd21b8) C:\WINDOWS\system32\drivers\mfehidk.sys
2010/09/04 22:21:36.0921 mferkdet (d528f31cad4411d3ae3ce0c634232851) C:\WINDOWS\system32\drivers\mferkdet.sys
2010/09/04 22:21:37.0000 mfetdik (28a2f3c4ca8c2063087c9fcd963586c0) C:\WINDOWS\system32\drivers\mfetdik.sys
2010/09/04 22:21:37.0218 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/09/04 22:21:37.0296 Modem (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
2010/09/04 22:21:37.0437 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/09/04 22:21:37.0593 Mouclass (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/09/04 22:21:37.0765 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/09/04 22:21:37.0921 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/09/04 22:21:38.0109 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/09/04 22:21:38.0250 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/09/04 22:21:38.0500 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2010/09/04 22:21:38.0640 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/09/04 22:21:38.0796 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/09/04 22:21:38.0921 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/09/04 22:21:39.0031 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/09/04 22:21:39.0203 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/09/04 22:21:39.0312 MTsensor (e333010a50bf603acc350f6019e9ce02) C:\WINDOWS\system32\DRIVERS\ATKACPI.sys
2010/09/04 22:21:39.0421 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2010/09/04 22:21:39.0578 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/09/04 22:21:39.0671 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2010/09/04 22:21:39.0828 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/09/04 22:21:39.0906 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/09/04 22:21:40.0000 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/09/04 22:21:40.0046 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/09/04 22:21:40.0109 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/09/04 22:21:40.0203 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/09/04 22:21:40.0312 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/09/04 22:21:40.0531 NETw3x32 (50f5de54e1d1646c02078f3eddc15a8e) C:\WINDOWS\system32\DRIVERS\NETw3x32.sys
2010/09/04 22:21:40.0703 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/09/04 22:21:40.0781 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2010/09/04 22:21:40.0906 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/09/04 22:21:41.0015 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/09/04 22:21:41.0093 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/09/04 22:21:41.0140 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/09/04 22:21:41.0218 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/09/04 22:21:41.0312 Parport (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\drivers\Parport.sys
2010/09/04 22:21:41.0421 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/09/04 22:21:41.0484 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/09/04 22:21:41.0687 PCI (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/09/04 22:21:41.0921 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/09/04 22:21:42.0046 Pcmcia (037d2742d87fc9e58197300686f39b4e) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2010/09/04 22:21:42.0046 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pcmcia.sys. Real md5: 037d2742d87fc9e58197300686f39b4e, Fake md5: 641da274e163617ea7a33506bc6da8e3
2010/09/04 22:21:42.0046 Pcmcia - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/09/04 22:21:43.0562 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/09/04 22:21:43.0671 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/09/04 22:21:43.0703 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/09/04 22:21:44.0312 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/09/04 22:21:44.0390 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/09/04 22:21:44.0453 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/09/04 22:21:44.0500 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/09/04 22:21:44.0578 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/09/04 22:21:44.0640 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/09/04 22:21:44.0750 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/09/04 22:21:44.0875 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/09/04 22:21:45.0046 redbook (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/09/04 22:21:45.0250 rimsptsk (1bdba2d2d402415a78a4ba766dfe0f7b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
2010/09/04 22:21:45.0500 risdptsk (ace2ce73d7b04eac48fb80482e05e770) C:\WINDOWS\system32\DRIVERS\risdptsk.sys
2010/09/04 22:21:45.0750 RTL8023xp (d6e1b1bd04fad422af17fc4b810cb9af) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2010/09/04 22:21:45.0968 s24trans (2862adb14481ac28f98105ff33a99eb0) C:\WINDOWS\system32\DRIVERS\s24trans.sys
2010/09/04 22:21:46.0125 sdbus (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2010/09/04 22:21:46.0250 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/09/04 22:21:46.0359 Serial (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\drivers\Serial.sys
2010/09/04 22:21:46.0515 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/09/04 22:21:46.0781 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/09/04 22:21:46.0968 smserial (b8c571fbf5a4b341a95cdf0de74d7b11) C:\WINDOWS\system32\DRIVERS\smserial.sys
2010/09/04 22:21:47.0312 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2010/09/04 22:21:47.0421 sr (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/09/04 22:21:47.0515 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/09/04 22:21:47.0750 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/09/04 22:21:47.0843 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/09/04 22:21:48.0015 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2010/09/04 22:21:48.0750 SynMini (472b9e75ddab952f0cd37bd9aa3e81f8) C:\WINDOWS\system32\Drivers\SynMini.sys
2010/09/04 22:21:49.0000 SynScan (bed9a41e66e9f038af6d2e487a3f2757) C:\WINDOWS\system32\Drivers\SynScan.sys
2010/09/04 22:21:49.0187 SynTP (9c29e8e9c1c48e9c8bc38f031df4720f) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2010/09/04 22:21:49.0375 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/09/04 22:21:49.0531 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/09/04 22:21:49.0687 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/09/04 22:21:49.0796 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/09/04 22:21:49.0921 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/09/04 22:21:50.0203 Tosrfbd (0ec5206059d97a8dc785be73fb457ec7) C:\WINDOWS\system32\Drivers\tosrfbd.sys
2010/09/04 22:21:50.0390 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\WINDOWS\system32\drivers\Tosrfcom.sys
2010/09/04 22:21:50.0515 Tosrfhid (5dbf390aab62dd0d4d43a9278614e001) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
2010/09/04 22:21:50.0703 Tosrfusb (c582b7716f0be7e65505365f4f941587) C:\WINDOWS\system32\Drivers\tosrfusb.sys
2010/09/04 22:21:50.0953 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2010/09/04 22:21:51.0187 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2010/09/04 22:21:51.0296 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/09/04 22:21:51.0515 usbehci (b0d7020386c7187ef9c5a9643f289cd3) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/09/04 22:21:51.0796 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/09/04 22:21:51.0906 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/09/04 22:21:52.0078 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/09/04 22:21:52.0203 usbuhci (ff6e4fdeb82dc228efa490336409c6bd) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/09/04 22:21:52.0343 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2010/09/04 22:21:52.0515 VolSnap (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/09/04 22:21:52.0718 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/09/04 22:21:53.0000 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/09/04 22:21:53.0187 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/09/04 22:21:53.0250 ================================================================================
2010/09/04 22:21:53.0250 Scan finished
2010/09/04 22:21:53.0250 ================================================================================
2010/09/04 22:21:53.0265 Detected object count: 1
2010/09/04 22:22:04.0593 Pcmcia (037d2742d87fc9e58197300686f39b4e) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2010/09/04 22:22:04.0593 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\pcmcia.sys. Real md5: 037d2742d87fc9e58197300686f39b4e, Fake md5: 641da274e163617ea7a33506bc6da8e3
2010/09/04 22:22:05.0640 Backup copy found, using it..
2010/09/04 22:22:05.0843 C:\WINDOWS\system32\DRIVERS\pcmcia.sys - will be cured after reboot
2010/09/04 22:22:05.0843 Rootkit.Win32.TDSS.tdl3(Pcmcia) - User select action: Cure

relance tdsskiller stp

oui chef :)
2010/09/04 22:29:51.0078 TDSS rootkit removing tool 2.4.2.0 Sep 3 2010 10:26:06
2010/09/04 22:29:51.0078 ================================================================================
2010/09/04 22:29:51.0078 SystemInfo:
2010/09/04 22:29:51.0078
2010/09/04 22:29:51.0078 OS Version: 5.1.2600 ServicePack: 2.0
2010/09/04 22:29:51.0078 Product type: Workstation
2010/09/04 22:29:51.0078 ComputerName: MATHILDE
2010/09/04 22:29:51.0078 UserName: Matu
2010/09/04 22:29:51.0078 Windows directory: C:\WINDOWS
2010/09/04 22:29:51.0078 System windows directory: C:\WINDOWS
2010/09/04 22:29:51.0078 Processor architecture: Intel x86
2010/09/04 22:29:51.0078 Number of processors: 2
2010/09/04 22:29:51.0078 Page size: 0x1000
2010/09/04 22:29:51.0078 Boot type: Normal boot
2010/09/04 22:29:51.0078 ================================================================================
2010/09/04 22:29:51.0406 Initialize success
2010/09/04 22:29:56.0531 ================================================================================
2010/09/04 22:29:56.0531 Scan started
2010/09/04 22:29:56.0531 Mode: Manual;
2010/09/04 22:29:56.0531 ================================================================================
2010/09/04 22:29:57.0750 ACPI (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/09/04 22:29:57.0796 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2010/09/04 22:29:58.0031 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys
2010/09/04 22:29:58.0171 AegisP (15e655baa989444f56787ef558823643) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2010/09/04 22:29:58.0328 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2010/09/04 22:29:59.0125 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/09/04 22:29:59.0578 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/09/04 22:29:59.0718 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/09/04 22:30:00.0000 ati2mtag (86a7a22f3670465ef575614e001159c0) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2010/09/04 22:30:00.0234 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/09/04 22:30:00.0359 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/09/04 22:30:00.0453 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/09/04 22:30:00.0531 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/09/04 22:30:00.0656 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/09/04 22:30:00.0812 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/09/04 22:30:00.0890 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/09/04 22:30:01.0015 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/09/04 22:30:01.0375 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2010/09/04 22:30:01.0609 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2010/09/04 22:30:02.0046 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/09/04 22:30:02.0187 dmboot (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
2010/09/04 22:30:02.0421 dmio (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
2010/09/04 22:30:02.0546 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/09/04 22:30:02.0671 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2010/09/04 22:30:02.0890 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/09/04 22:30:02.0984 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/09/04 22:30:03.0078 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys
2010/09/04 22:30:03.0125 Fips (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
2010/09/04 22:30:03.0328 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys
2010/09/04 22:30:03.0453 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2010/09/04 22:30:03.0515 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/09/04 22:30:03.0546 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/09/04 22:30:03.0734 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2010/09/04 22:30:03.0890 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/09/04 22:30:04.0031 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2010/09/04 22:30:04.0171 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/09/04 22:30:04.0390 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/09/04 22:30:04.0734 i8042prt (d1efcbd693b5ba21314d06368c471070) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/09/04 22:30:04.0906 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/09/04 22:30:05.0765 IntcAzAudAddService (284bcb80391783d328a8d8163e97fd58) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2010/09/04 22:30:06.0078 intelppm (dd5ad1e79ac26d3f8d8828ad4627f160) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/09/04 22:30:06.0171 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2010/09/04 22:30:06.0234 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/09/04 22:30:06.0312 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/09/04 22:30:06.0406 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/09/04 22:30:06.0484 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/09/04 22:30:06.0640 ipswuio (ee8cc26924a6f07972bbf04487ebd552) C:\WINDOWS\system32\DRIVERS\ipswuio.sys
2010/09/04 22:30:06.0875 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/09/04 22:30:07.0015 isapnp (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/09/04 22:30:07.0203 Kbdclass (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/09/04 22:30:07.0390 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys
2010/09/04 22:30:07.0484 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/09/04 22:30:07.0796 mfeapfk (1619082b1d7f731b11449f48e91cc84c) C:\WINDOWS\system32\drivers\mfeapfk.sys
2010/09/04 22:30:07.0875 mfeavfk (1fae237d343904e24b3a9eb04bbd8170) C:\WINDOWS\system32\drivers\mfeavfk.sys
2010/09/04 22:30:07.0984 mfebopk (8c324da46f9fcc5c107ceda4dbcfc7ae) C:\WINDOWS\system32\drivers\mfebopk.sys
2010/09/04 22:30:08.0078 mfehidk (d0123e113243bdd427611f265bbd21b8) C:\WINDOWS\system32\drivers\mfehidk.sys
2010/09/04 22:30:08.0156 mferkdet (d528f31cad4411d3ae3ce0c634232851) C:\WINDOWS\system32\drivers\mferkdet.sys
2010/09/04 22:30:08.0203 mfetdik (28a2f3c4ca8c2063087c9fcd963586c0) C:\WINDOWS\system32\drivers\mfetdik.sys
2010/09/04 22:30:08.0359 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/09/04 22:30:08.0421 Modem (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
2010/09/04 22:30:08.0515 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/09/04 22:30:08.0703 Mouclass (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/09/04 22:30:08.0875 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/09/04 22:30:09.0046 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/09/04 22:30:09.0250 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/09/04 22:30:09.0359 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/09/04 22:30:09.0531 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2010/09/04 22:30:09.0656 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/09/04 22:30:09.0796 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/09/04 22:30:09.0953 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/09/04 22:30:10.0062 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/09/04 22:30:10.0187 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/09/04 22:30:10.0281 MTsensor (e333010a50bf603acc350f6019e9ce02) C:\WINDOWS\system32\DRIVERS\ATKACPI.sys
2010/09/04 22:30:10.0375 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2010/09/04 22:30:10.0531 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/09/04 22:30:10.0609 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2010/09/04 22:30:10.0718 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/09/04 22:30:10.0781 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/09/04 22:30:10.0875 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/09/04 22:30:10.0968 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/09/04 22:30:11.0015 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/09/04 22:30:11.0125 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/09/04 22:30:11.0203 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/09/04 22:30:11.0406 NETw3x32 (50f5de54e1d1646c02078f3eddc15a8e) C:\WINDOWS\system32\DRIVERS\NETw3x32.sys
2010/09/04 22:30:11.0609 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/09/04 22:30:11.0687 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2010/09/04 22:30:11.0796 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/09/04 22:30:11.0906 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/09/04 22:30:11.0968 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/09/04 22:30:12.0015 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/09/04 22:30:12.0093 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/09/04 22:30:12.0171 Parport (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\drivers\Parport.sys
2010/09/04 22:30:12.0281 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/09/04 22:30:12.0328 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/09/04 22:30:12.0531 PCI (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/09/04 22:30:12.0796 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/09/04 22:30:12.0906 Pcmcia (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2010/09/04 22:30:13.0687 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/09/04 22:30:13.0765 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/09/04 22:30:13.0796 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/09/04 22:30:14.0375 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/09/04 22:30:14.0437 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/09/04 22:30:14.0546 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/09/04 22:30:14.0562 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/09/04 22:30:14.0640 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/09/04 22:30:14.0687 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/09/04 22:30:14.0781 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/09/04 22:30:14.0890 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/09/04 22:30:15.0015 redbook (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/09/04 22:30:15.0218 rimsptsk (1bdba2d2d402415a78a4ba766dfe0f7b) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
2010/09/04 22:30:15.0484 risdptsk (ace2ce73d7b04eac48fb80482e05e770) C:\WINDOWS\system32\DRIVERS\risdptsk.sys
2010/09/04 22:30:15.0718 RTL8023xp (d6e1b1bd04fad422af17fc4b810cb9af) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2010/09/04 22:30:15.0937 s24trans (2862adb14481ac28f98105ff33a99eb0) C:\WINDOWS\system32\DRIVERS\s24trans.sys
2010/09/04 22:30:16.0125 sdbus (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2010/09/04 22:30:16.0218 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/09/04 22:30:16.0296 Serial (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\drivers\Serial.sys
2010/09/04 22:30:16.0468 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/09/04 22:30:16.0734 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/09/04 22:30:16.0906 smserial (b8c571fbf5a4b341a95cdf0de74d7b11) C:\WINDOWS\system32\DRIVERS\smserial.sys
2010/09/04 22:30:17.0250 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys
2010/09/04 22:30:17.0375 sr (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/09/04 22:30:17.0484 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/09/04 22:30:17.0687 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/09/04 22:30:17.0765 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/09/04 22:30:17.0859 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2010/09/04 22:30:18.0593 SynMini (472b9e75ddab952f0cd37bd9aa3e81f8) C:\WINDOWS\system32\Drivers\SynMini.sys
2010/09/04 22:30:18.0890 SynScan (bed9a41e66e9f038af6d2e487a3f2757) C:\WINDOWS\system32\Drivers\SynScan.sys
2010/09/04 22:30:19.0062 SynTP (9c29e8e9c1c48e9c8bc38f031df4720f) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2010/09/04 22:30:19.0234 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/09/04 22:30:19.0390 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/09/04 22:30:19.0546 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/09/04 22:30:19.0640 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/09/04 22:30:19.0750 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/09/04 22:30:20.0000 Tosrfbd (0ec5206059d97a8dc785be73fb457ec7) C:\WINDOWS\system32\Drivers\tosrfbd.sys
2010/09/04 22:30:20.0171 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\WINDOWS\system32\drivers\Tosrfcom.sys
2010/09/04 22:30:20.0296 Tosrfhid (5dbf390aab62dd0d4d43a9278614e001) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
2010/09/04 22:30:20.0468 Tosrfusb (c582b7716f0be7e65505365f4f941587) C:\WINDOWS\system32\Drivers\tosrfusb.sys
2010/09/04 22:30:20.0734 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2010/09/04 22:30:20.0953 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
2010/09/04 22:30:21.0062 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/09/04 22:30:21.0265 usbehci (b0d7020386c7187ef9c5a9643f289cd3) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/09/04 22:30:21.0515 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/09/04 22:30:21.0625 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/09/04 22:30:21.0765 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/09/04 22:30:21.0875 usbuhci (ff6e4fdeb82dc228efa490336409c6bd) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/09/04 22:30:22.0031 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2010/09/04 22:30:22.0203 VolSnap (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/09/04 22:30:22.0390 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/09/04 22:30:22.0625 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/09/04 22:30:22.0812 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/09/04 22:30:22.0875 ================================================================================
2010/09/04 22:30:22.0875 Scan finished
2010/09/04 22:30:22.0875 ================================================================================

Télécharge MBRCheck sur ton Bureau.

* Désactive tes programmes de sécurité avant de lancer le scan. (antispyware/antivirus)
* Double clique sur le fichier pour lancer le programme. (Note: Si tu utilises Vista/7, fais un clic droit sur le fichier puis choisir Exécuter en tant qu'administrateur).
* Une fenêtre va s'ouvrir sur ton Bureau: Patiente une dizaine de secondes pour permettre à l'outil de compléter l'analyse.
* Si un code de démarrage inconnu est détecté, des options s'afficheront
* Si c'est le cas, appuie alors sur la touche N puis [Entrée] deux fois.
* Si rien de particulier n'est détecté, presse juste sur la touche [Entrée]
* Un fichier texte nommé MBRCheck_mois/jour/année/_heure.minutes.secondes devrait apparaitre sur ton Bureau.
* Poste stp son contenu dans ton prochain message.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 138):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E3000 \WINDOWS\system32\hal.dll
0xF7ADB000 \WINDOWS\system32\KDCOM.DLL
0xF79EB000 \WINDOWS\system32\BOOTVID.dll
0xF75DB000 klmdb.sys
0xF74AB000 ACPI.sys
0xF7ADD000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF749A000 pci.sys
0xF75EB000 isapnp.sys
0xF75FB000 ohci1394.sys
0xF760B000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF79EF000 compbatt.sys
0xF79F3000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7BA3000 pciide.sys
0xF785B000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF747C000 tsk9.tmp
0xF761B000 MountMgr.sysa
0xF745D000 ftdisk.sys
0xF7ADF000 dmload.sys
0xF7437000 dmio.sys
0xF79F7000 ACPIEC.sys
0xF7BA4000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7863000 PartMgr.sys
0xF762B000 VolSnap.sys
0xF741F000 atapi.sys
0xF763B000 disk.sys
0xF764B000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7400000 fltMgr.sys
0xF73DD000 Fastfat.sys
0xF73C6000 KSecDD.sys
0xF7399000 NDIS.sys
0xF786B000 risdptsk.sys
0xF737E000 Mup.sys
0xF732C000 mfehidk.sys
0xF7AE3000 \SystemRoot\system32\DRIVERS\ATKACPI.sys
0xF767B000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF7112000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF70FE000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF70D9000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF70C5000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xF6F24000 \SystemRoot\system32\DRIVERS\NETw3x32.sys
0xF789B000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF6F01000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78A3000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF768B000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF769B000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0xF76AB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78AB000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF6ED2000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7AE5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF78B3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF76BB000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF76CB000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76DB000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6EAF000 \SystemRoot\system32\DRIVERS\ks.sys
0xF78BB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF7A9B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7CA2000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF76EB000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7A9F000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF6E98000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76FB000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF770B000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78C3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF6E87000 \SystemRoot\system32\DRIVERS\psched.sys
0xF771B000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78CB000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78D3000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF6DB6000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF772B000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7AE7000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF6D5A000 \SystemRoot\system32\DRIVERS\update.sys
0xF7AB7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF773B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xEE8E9000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xEE8C7000 \SystemRoot\system32\drivers\portcls.sys
0xF776B000 \SystemRoot\system32\drivers\drmk.sys
0xEE7ED000 \SystemRoot\system32\DRIVERS\smserial.sys
0xF78DB000 \SystemRoot\System32\Drivers\Modem.SYS
0xF72F4000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF777B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7AEB000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7CDE000 \SystemRoot\System32\Drivers\Null.SYS
0xF7AED000 \SystemRoot\System32\Drivers\Beep.SYS
0xF78FB000 \SystemRoot\System32\drivers\vga.sys
0xF7AEF000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7AF1000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7903000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF790B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF72D0000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xEE76A000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xEE712000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF778B000 \SystemRoot\system32\drivers\mfetdik.sys
0xEE6F1000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xEE6C9000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF779B000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xEE6A7000 \SystemRoot\System32\drivers\afd.sys
0xF77AB000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xF77BB000 \SystemRoot\system32\DRIVERS\netbios.sys
0xEE5B3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xEE544000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF77DB000 \SystemRoot\System32\Drivers\Fips.SYS
0xEE442000 \SystemRoot\System32\Drivers\SynMini.sys
0xF77FB000 \SystemRoot\System32\Drivers\STREAM.SYS
0xF6D9E000 \SystemRoot\System32\Drivers\SYNSAM.SYS
0xF7913000 \SystemRoot\System32\Drivers\SynCamd.sys
0xEE3C8000 \SystemRoot\System32\Drivers\SynPin.sys
0xED807000 \SystemRoot\System32\Drivers\SynPipe.sys
0xF7AF3000 \SystemRoot\System32\Drivers\SynScan.sys
0xF780B000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF781B000 \SystemRoot\System32\Drivers\tosrfusb.sys
0xED7EC000 \SystemRoot\System32\Drivers\tosrfbd.sys
0xF782B000 \SystemRoot\system32\DRIVERS\Tosrfhid.sys
0xED784000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7AF5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xEE5EF000 \SystemRoot\System32\drivers\Dxapi.sys
0xF791B000 \SystemRoot\System32\watchdog.sys
0xBF9C4000 \SystemRoot\System32\drivers\dxg.sys
0xF7BFA000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF9D6000 \SystemRoot\System32\ati2dvag.dll
0xBFA19000 \SystemRoot\System32\ati2cqag.dll
0xBFA5F000 \SystemRoot\System32\atikvmag.dll
0xBFAA3000 \SystemRoot\System32\ati3duag.dll
0xBFCE7000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF792B000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xEB660000 \SystemRoot\system32\DRIVERS\s24trans.sys
0xEB540000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEB22F000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xEB12A000 \SystemRoot\system32\drivers\wdmaud.sys
0xEB2F4000 \SystemRoot\system32\drivers\sysaudio.sys
0xBAD9F000 \SystemRoot\system32\DRIVERS\srv.sys
0xEB464000 \SystemRoot\system32\drivers\mfebopk.sys
0xBA90C000 \SystemRoot\system32\drivers\mfeapfk.sys
0xBA8F7000 \SystemRoot\system32\drivers\mfeavfk.sys
0xBA6AE000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C910000 \WINDOWS\System32\ntdll.dll

Processes (total 72):
0 System Idle Process
4 System
872 C:\WINDOWS\system32\SMSS.EXE
1052 csrss.exe
1084 C:\WINDOWS\system32\winlogon.exe
1128 C:\WINDOWS\system32\services.exe
1140 C:\WINDOWS\system32\lsass.exe
1284 C:\WINDOWS\system32\Ati2evxx.exe
1324 C:\WINDOWS\system32\svchost.exe
1404 svchost.exe
1444 C:\WINDOWS\system32\svchost.exe
1520 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1556 C:\WINDOWS\system32\Ati2evxx.exe
1760 C:\WINDOWS\Explorer.EXE
1836 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1944 svchost.exe
1984 svchost.exe
420 C:\WINDOWS\system32\spoolsv.exe
520 svchost.exe
568 C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
580 C:\Program Files\Bonjour\mDNSResponder.exe
824 C:\Program Files\Java\jre6\bin\jqs.exe
1344 C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
1612 C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
1604 C:\WINDOWS\system32\rundll32.exe
1652 C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
124 C:\Program Files\McAfee\Common Framework\FrameworkService.exe
608 C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
1720 C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
1756 C:\WINDOWS\system32\mfevtps.exe
1900 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
1920 naPrdMgr.exe
2064 C:\WINDOWS\system32\svchost.exe
2184 C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
2448 mfeann.exe
3464 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3632 alg.exe
672 C:\WINDOWS\ATK0100\HControl.exe
812 C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe
2292 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
2160 C:\WINDOWS\system32\svchost.exe
2480 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
468 C:\Program Files\Wireless Console 2\wcourier.exe
2700 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
2828 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
2968 C:\Program Files\ASUS\ASUS Live Update\ALU.exe
3008 C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
3060 C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe
3368 C:\WINDOWS\ATK0100\ATKOSD.exe
3824 C:\Program Files\ASUS\Splendid\ACMON.exe
1040 C:\WINDOWS\sm56hlpr.exe
2664 C:\WINDOWS\system32\ACEngSvr.exe
2692 C:\Program Files\Google\Gmail Notifier\gnotify.exe
2420 C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
2712 C:\Program Files\Java\jre6\bin\jusched.exe
2732 C:\Program Files\iTunes\iTunesHelper.exe
2752 C:\Program Files\McAfee\Common Framework\UdaterUI.exe
2760 C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
1744 C:\WINDOWS\RTHDCPL.EXE
2908 C:\WINDOWS\system32\ctfmon.exe
3064 C:\Documents and Settings\Matu\Local Settings\Temp\Cdu.exe
3300 C:\Program Files\McAfee\Common Framework\McTray.exe
4020 C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
4068 C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
128 C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
2052 C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
3472 C:\Program Files\iPod\BIN\iPodService.exe
1704 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
3852 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
3096 C:\WINDOWS\system32\NOTEPAD.EXE
2608 C:\Program Files\Mozilla Firefox\firefox.exe
1856 C:\Documents and Settings\Matu\Bureau\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000'77226600 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000010'f9383c00 (FAT32)

PhysicalDrive0 Model Number: HitachiHTS541612J9SA00, Rev: SBDOC70P

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: 8637A6CD1F8DC55758E12C0B860CDE1133CA5719

Done!

supprime MBRChek , on est bons de ce coté-là

retente combofix renommé

bon et ben j ai retenté, je l'ai renommé "test
et tout avait l'air de marché
etape 50 ...
Puis il redémarre et toujours pas de fichier .txt
ou alors je sais pas le trouver :(
quand je vais dans C, j ai test avec une icone de poste de travail et a linterieur j ai c d et ainsi de suite... j ai compté et ya environ 10 fois ça comme les poupées russes.
Donc je sais toujours pas quoi faire avec ça et comment trouver ce fameux fichier, j ai fais des recherches et tout.

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

▶ Télécharge ici :List_Kill'em

et enregistre le sur ton bureau

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

sur le raccourci sur ton bureau pour lancer l'installation

Laisse coché :

♦ Executer List_Kill'em

une fois terminée , clic sur "terminer" et le programme se lancera seul

Il commencera par telecharger et installer ses mises à jour , puis te donnera son menu

choisis l'option Search

▶ laisse travailler l'outil

il se peut qu'une boite de dialogue s'ouvre , dans ce cas clique sur "ok" ou "Agree"

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal ,c'est une recherche supplementaire de fichiers cachés , le programme n'est pas bloqué.

▶ Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

▶▶▶ NE LE POSTE PAS SUR LE FORUM

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

▶ Clique sur Parcourir et cherche le fichier C:\List'em.txt

▶ Clique sur Ouvrir.

▶ Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=265368/cijSKAP5fU.txt

est ajouté dans la page.

▶ Copie ce lien dans ta réponse.

▶ Fais de même avec more.txt qui se trouve sur ton bureau

Merci c'est en cours je poste dès que c'est prêt

ok bien matinale pour un dimanche ! :)

je suis en Australie :)
bon j avais oublié d enlever l anti virus j espere que ca ira
le premier
http://www.cijoint.fr/cjlink.php?file=cj201009/cijlVIq2zr.txt

more
http://www.cijoint.fr/cjlink.php?file=cj201009/cijSxbk9zM.txt

en attendant j installe les mises à jour de xp et firefox
ça ne devrait pas faire de mal;)

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...."

▶ Relance List_Kill'em,avec le raccourci sur ton bureau.

mais cette fois-ci :

▶ choisis l'Option Clean

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

▶ colle le contenu dans ta reponse

voila
¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.0.3 ¤¤¤¤¤¤¤¤¤¤

User : Matu (Administrateurs)
Update on 03/09/2010 by g3n-h@ckm@n ::::: 14.30
Start at: 16:21:27 | 05/09/2010

Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz
Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
Internet Explorer 6.0.2900.5512
Windows Firewall Status : Disabled
AV : McAfee VirusScan Enterprise 8.7.0.570 [ Enabled | Updated ]
FW : Norton Internet Worm Protection[ (!) Disabled ]2006

C:\ -> Disque fixe local | 66 Go (18,82 Go free) | FAT32
D:\ -> Disque fixe local | 43,85 Go (21,27 Go free) | FAT32
E:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes ------- Memory(Ko)

C:\WINDOWS\System32\smss.exe ----512 Ko
C:\WINDOWS\system32\csrss.exe ----4436 Ko
C:\WINDOWS\system32\winlogon.exe ----3252 Ko
C:\WINDOWS\system32\services.exe ----3568 Ko
C:\WINDOWS\system32\lsass.exe ----6744 Ko
C:\WINDOWS\system32\Ati2evxx.exe ----2948 Ko
C:\WINDOWS\system32\svchost.exe ----4992 Ko
C:\WINDOWS\system32\svchost.exe ----4580 Ko
C:\WINDOWS\System32\svchost.exe ----35132 Ko
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe ----11780 Ko
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe ----12160 Ko
C:\WINDOWS\system32\svchost.exe ----3608 Ko
C:\WINDOWS\system32\svchost.exe ----9408 Ko
C:\WINDOWS\system32\spoolsv.exe ----6592 Ko
C:\WINDOWS\system32\svchost.exe ----3504 Ko
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe ----3308 Ko
C:\Program Files\Bonjour\mDNSResponder.exe ----3744 Ko
C:\Program Files\Java\jre6\bin\jqs.exe ----8664 Ko
c:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe ----2220 Ko
C:\WINDOWS\system32\rundll32.exe ----2660 Ko
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe ----260 Ko
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe ----228 Ko
C:\Program Files\McAfee\Common Framework\FrameworkService.exe ----6504 Ko
C:\WINDOWS\system32\Ati2evxx.exe ----3732 Ko
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe ----1404 Ko
C:\WINDOWS\system32\mfevtps.exe ----532 Ko
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe ----844 Ko
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe ----3012 Ko
C:\WINDOWS\system32\svchost.exe ----4576 Ko
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe ----34644 Ko
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe ----1056 Ko
C:\WINDOWS\system32\wuauclt.exe ----16652 Ko
C:\WINDOWS\Explorer.EXE ----20188 Ko
C:\WINDOWS\system32\wbem\wmiapsrv.exe ----4624 Ko
C:\WINDOWS\system32\wbem\wmiprvse.exe ----7628 Ko
C:\WINDOWS\system32\wbem\wmiprvse.exe ----7944 Ko
C:\WINDOWS\system32\msiexec.exe ----5660 Ko
C:\WINDOWS\System32\alg.exe ----3624 Ko
C:\WINDOWS\System32\svchost.exe ----3568 Ko
C:\WINDOWS\ATK0100\HControl.exe ----8000 Ko
C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe ----3124 Ko
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE ----2708 Ko
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ----4812 Ko
C:\Program Files\Wireless Console 2\wcourier.exe ----3216 Ko
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe ----13204 Ko
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe ----16140 Ko
C:\Program Files\ASUS\ASUS Live Update\ALU.exe ----3260 Ko
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe ----2488 Ko
C:\Program Files\PowerForPhone\PowerForPhone\PowerForPhone.exe ----7544 Ko
C:\Program Files\ASUS\Splendid\ACMON.exe ----3716 Ko
C:\WINDOWS\sm56hlpr.exe ----3232 Ko
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe ----192 Ko
C:\Program Files\Java\jre6\bin\jusched.exe ----2388 Ko
C:\WINDOWS\ATK0100\ATKOSD.exe ----3876 Ko
C:\Program Files\iTunes\iTunesHelper.exe ----12920 Ko
C:\Program Files\McAfee\Common Framework\udaterui.exe ----1236 Ko
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE ----892 Ko
C:\WINDOWS\RTHDCPL.EXE ----21576 Ko
C:\WINDOWS\system32\ctfmon.exe ----3320 Ko
C:\WINDOWS\system32\ACEngSvr.exe ----3692 Ko
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe ----1672 Ko
C:\Program Files\McAfee\Common Framework\McTray.exe ----2432 Ko
C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe ----10268 Ko
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe ----2404 Ko
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe ----14196 Ko
C:\Program Files\iPod\bin\iPodService.exe ----3956 Ko
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe ----2056 Ko
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe ----2400 Ko
C:\WINDOWS\system32\cmd.exe ----2956 Ko
C:\Program Files\List_Kill'em\pv.exe ----2752 Ko

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\WINDOWS\002783_.tmp

Quarantined & Deleted !! : C:\WINDOWS\System32\SynSvc_.exe
Quarantined & Deleted !! : C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
Quarantined & Deleted !! : C:\Documents and Settings\Matu\Local Settings\Application Data\Install.exe
Quarantined & Deleted !! : C:\Documents and Settings\Matu\LOCAL Settings\Temp\catchme.dll

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1 localhost

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableRegistryTools
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe"
Deleted : "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe"
Deleted : HKCU\Software\M5T8QL3YW3
Deleted : HKCU\SOFTWARE\V71IQL7HI7
Deleted : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7}
Deleted : HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6}

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

Ndisuio : Start = 3
EapHost : Start = 2
Ip6Fw : Start = 2
SharedAccess : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

FEATURE_BROWSER_EMULATION | svchost :
====================================

Deleted : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION : svchost.exe

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤