csrss.exe et spoolsv.exe infectés ! Résolu/Fermé

Question

Bonjour à tous !

Décidement, j'ai la poisse avec mon pc de bureau ! Je suis de nouveau infecté par je ne sais pas. Tout allait bien jusqu'à ce que Avira m'envoie une alerte ! Virussss ! Alors je passe avec coup de malbyte ! Puis tout va bien...mais quand je vais dans le gestionnaire de tache, je vois des processus bizarres dont un "processus d'executtion client" et bien avec 2 t ! Ce qui m'a alerté ! Bon comme chaque fois, j'aurai besoin de votre aide pour m'en débarasser.

Je vous remercie d'avance ! 

Voilà mon rapport Hijackthis au cas ou !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:10:29, on 27/08/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Safe mode

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Users\CalliWeb\Desktop\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DebugBar - {3E1201F4-1707-409F-BB45-A5F192381DA0} - C:\Program Files\Core Services\DebugBar\DebugToolBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Google Update] "C:\Users\CalliWeb\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMPere.tmp\svchost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SunJavaUpdateSched] C:\Windows\system32\config\systemprofile\AppData\Roaming\jusched.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [cbssreg] C:\Windows\TEMPere.tmp\svchost.exe (User 'Default user')
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O15 - Trusted Zone: *.chat-land.org
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.32\bin\mysqld.exe

Xplode · Answer

Bonjour,

[x] Suis la procédure jusqu'au bout. Même si le PC semble aller mieux, ce n'est pas pour autant qu'il est totalement désinfecté !

[x] Si tu as des difficultés pour effectuer une procédure ou bien une simple question, n'hésite pas à me demander.

-+-+-+-+-> ZHPDiag <-+-+-+-+-


[x] Nous allons effectuer un diagnostic de ton ordinateur, pour ce faire, télécharge ZHPDiag ( de Nicolas Coolman ).

[x] Exécute l'installateur -> /!\ Coche la case " créer une icône sur le bureau " /!\ 

[x] Lance le en double cliquant sur l'icône ZHPDiag qui se trouve sur ton bureau ( Sous Vista/Seven : Clic droit sur l'icône -> " Exécuter en tant qu'administrateur " )

[x] Clique sur l'icône en forme de loupe en haut à gauche ( Lancer le diagnostic ).

[x] Une fois l'analyse terminée, clique sur l'icône en forme de disquette bleue puis sauvegarde le fichier sur ton bureau.

[x] Rend toi sur cjoint puis clique sur " Parcourir ".

[x] Sélectionne le fichier ZHPDiag.txt présent sur ton bureau, puis clique sur " Ouvrir ".

[x] Clique ensuite sur " Créer le lien cjoint " puis copie/colle dans ta prochaine réponse le lien créé.

gen-hackman · Answer

salut :

bonjour

ok je vais t'aider mais dans ces conditions :

*tu ne fais que ce que je te dis , tu ignores les autres propositions sauf accord de ma part

*si je ne te demande pas d'utiliser un logiciel de desinfection , tu ne l'utilises pas

*si je te demande un rapport , tu me le donnes  (si existant)

*et tu n'utilises rien d'autre que ce que je te demande

*tu ne prends pas d'initiatives sans mon accord car ca chamboulerait la desinfection

*tu ne postes pas sur d'autres forums et si tu t'y fais deja aider ailleurs , signale-le

*si tu n arrives pas à faire quelque chose ou telecharger un programme , ne le cherche pas ailleurs je le chercherai pour toi ou te donnerai une solution

*tu lis bien toute la procedure donnée avant de commencer , pour chaque outil utilisé , et execute exactement ce qui est demandé afin que :

*le topic soit comprehensible 
*l'on ne passe pas 4h sur un outil

es-tu prêt(e) à commencer ?

miss-crystal · Answer

voici le lien http://cjoint.com/data/iBpCpaWvYA.htm

miss-crystal · Answer

Allo ? :(

Xplode · Answer

Plouf :)

-+-+-+-+-> TDSSKiller <-+-+-+-+-


[x] Télécharge TDSSKiller ( de Kaspersky Labs ) sur ton bureau.

[x] Lance le ( Utilisateurs de vista/Seven -> Clic droit puis " Exécuter en tant qu'administrateur " )

[x] Clique sur [Start Scan] pour démarrer l'analyse.

[x] Si des élements sont trouvés, cliques sur [Continue] puis sur [Reboot Now]

[x]  Un rapport s'ouvrira au redémarrage du PC.

[x] Copie/Colle son contenu dans ta prochaine réponse.

[x] Note : Le rapport se trouve également sous C:\TDSSKiller.N°deversion_Date_Heure_log.txt.

miss-crystal · Answer

2010/08/27 16:31:47.0556	TDSS rootkit removing tool 2.4.1.3 Aug 27 2010 08:53:42
2010/08/27 16:31:47.0556	================================================================================
2010/08/27 16:31:47.0556	SystemInfo:
2010/08/27 16:31:47.0556	
2010/08/27 16:31:47.0556	OS Version: 6.0.6001 ServicePack: 1.0
2010/08/27 16:31:47.0557	Product type: Workstation
2010/08/27 16:31:47.0557	ComputerName: PC-DE-CALLIWEB
2010/08/27 16:31:47.0557	UserName: CalliWeb
2010/08/27 16:31:47.0557	Windows directory: C:\Windows
2010/08/27 16:31:47.0557	System windows directory: C:\Windows
2010/08/27 16:31:47.0557	Processor architecture: Intel x86
2010/08/27 16:31:47.0557	Number of processors: 2
2010/08/27 16:31:47.0557	Page size: 0x1000
2010/08/27 16:31:47.0557	Boot type: Normal boot
2010/08/27 16:31:47.0557	================================================================================
2010/08/27 16:31:47.0990	Initialize success
2010/08/27 16:31:57.0814	================================================================================
2010/08/27 16:31:57.0814	Scan started
2010/08/27 16:31:57.0814	Mode: Manual;
2010/08/27 16:31:57.0814	================================================================================
2010/08/27 16:31:58.0464	ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2010/08/27 16:31:58.0506	adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2010/08/27 16:31:58.0539	adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2010/08/27 16:31:58.0570	adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2010/08/27 16:31:58.0596	adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2010/08/27 16:31:58.0673	AFD             (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2010/08/27 16:31:58.0749	agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2010/08/27 16:31:58.0774	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2010/08/27 16:31:58.0824	aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2010/08/27 16:31:58.0850	amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2010/08/27 16:31:58.0875	amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2010/08/27 16:31:58.0901	AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2010/08/27 16:31:58.0927	AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
2010/08/27 16:31:59.0033	arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2010/08/27 16:31:59.0080	arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2010/08/27 16:31:59.0126	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/27 16:31:59.0154	atapi           (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2010/08/27 16:31:59.0246	avgio           (f1d43170fdd7399ee17ea32d4f868b0c) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2010/08/27 16:31:59.0317	avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2010/08/27 16:31:59.0370	avipbb          (ad9bd66a862116e79cb45bb6be46055f) C:\Windows\system32\DRIVERS\avipbb.sys
2010/08/27 16:31:59.0414	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2010/08/27 16:31:59.0468	blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2010/08/27 16:31:59.0518	bowser          (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2010/08/27 16:31:59.0544	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2010/08/27 16:31:59.0569	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2010/08/27 16:31:59.0601	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2010/08/27 16:31:59.0627	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2010/08/27 16:31:59.0644	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2010/08/27 16:31:59.0659	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2010/08/27 16:31:59.0679	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2010/08/27 16:31:59.0694	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/08/27 16:31:59.0723	cdrom           (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2010/08/27 16:31:59.0749	circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2010/08/27 16:31:59.0785	CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2010/08/27 16:31:59.0815	cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2010/08/27 16:31:59.0841	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys
2010/08/27 16:31:59.0872	crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2010/08/27 16:31:59.0901	Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2010/08/27 16:31:59.0938	DfsC            (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2010/08/27 16:31:59.0989	disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2010/08/27 16:32:00.0102	driverhardwarev2 (c0bf8cd94c88b34fb324f4bd6dae544d) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
2010/08/27 16:32:00.0200	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2010/08/27 16:32:00.0256	DXGKrnl         (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2010/08/27 16:32:00.0301	E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2010/08/27 16:32:00.0339	Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2010/08/27 16:32:00.0367	elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2010/08/27 16:32:00.0400	ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2010/08/27 16:32:00.0441	exfat           (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2010/08/27 16:32:00.0465	fastfat         (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2010/08/27 16:32:00.0485	fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2010/08/27 16:32:00.0523	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2010/08/27 16:32:00.0545	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2010/08/27 16:32:00.0582	flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/27 16:32:00.0613	FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2010/08/27 16:32:00.0639	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2010/08/27 16:32:00.0665	gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2010/08/27 16:32:00.0740	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2010/08/27 16:32:00.0761	HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/27 16:32:00.0784	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2010/08/27 16:32:00.0802	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2010/08/27 16:32:00.0832	HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2010/08/27 16:32:00.0861	HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2010/08/27 16:32:00.0929	HTTP            (33b02459e86d0a2b86a6b9fe19139390) C:\Windows\system32\drivers\HTTP.sys
2010/08/27 16:32:00.0956	i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2010/08/27 16:32:00.0985	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/27 16:32:01.0012	iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2010/08/27 16:32:01.0042	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2010/08/27 16:32:01.0076	int15           (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2010/08/27 16:32:01.0147	IntcAzAudAddService (58628f232a00a3149d7cc7708c521499) C:\Windows\system32\drivers\RTKVHDA.sys
2010/08/27 16:32:01.0272	intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2010/08/27 16:32:01.0323	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2010/08/27 16:32:01.0365	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/27 16:32:01.0431	IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2010/08/27 16:32:01.0452	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2010/08/27 16:32:01.0472	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2010/08/27 16:32:01.0496	isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2010/08/27 16:32:01.0522	iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/27 16:32:01.0546	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2010/08/27 16:32:01.0561	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2010/08/27 16:32:01.0594	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/27 16:32:01.0622	kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/27 16:32:01.0654	KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2010/08/27 16:32:01.0703	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/08/27 16:32:01.0750	LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2010/08/27 16:32:01.0773	LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2010/08/27 16:32:01.0809	LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2010/08/27 16:32:01.0841	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2010/08/27 16:32:01.0896	megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2010/08/27 16:32:01.0920	MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2010/08/27 16:32:01.0954	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2010/08/27 16:32:01.0983	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2010/08/27 16:32:02.0018	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2010/08/27 16:32:02.0151	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2010/08/27 16:32:02.0199	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2010/08/27 16:32:02.0225	mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2010/08/27 16:32:02.0271	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2010/08/27 16:32:02.0294	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2010/08/27 16:32:02.0310	MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2010/08/27 16:32:02.0348	mrxsmb          (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/27 16:32:02.0386	mrxsmb10        (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/27 16:32:02.0404	mrxsmb20        (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/27 16:32:02.0431	msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2010/08/27 16:32:02.0460	msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2010/08/27 16:32:02.0505	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2010/08/27 16:32:02.0537	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2010/08/27 16:32:02.0580	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2010/08/27 16:32:02.0606	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/27 16:32:02.0643	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2010/08/27 16:32:02.0669	MsRPC           (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2010/08/27 16:32:02.0691	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/27 16:32:02.0728	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2010/08/27 16:32:02.0749	Mup             (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2010/08/27 16:32:02.0804	NativeWifiP     (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS
wifi.sys
2010/08/27 16:32:02.0840	NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers
dis.sys
2010/08/27 16:32:02.0870	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS
distapi.sys
2010/08/27 16:32:02.0895	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS
disuio.sys
2010/08/27 16:32:02.0940	NdisWan         (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS
diswan.sys
2010/08/27 16:32:02.0989	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2010/08/27 16:32:03.0032	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS
etbios.sys
2010/08/27 16:32:03.0052	netbt           (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS
etbt.sys
2010/08/27 16:32:03.0094	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers
frd960.sys
2010/08/27 16:32:03.0118	Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2010/08/27 16:32:03.0150	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers
siproxy.sys
2010/08/27 16:32:03.0202	Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2010/08/27 16:32:03.0234	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers
trigdigi.sys
2010/08/27 16:32:03.0255	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2010/08/27 16:32:03.0301	NVENETFD        (c39ad3b818502edfa4b819148b72a0e3) C:\Windows\system32\DRIVERS
vmfdx32.sys
2010/08/27 16:32:03.0492	nvlddmkm        (00832a21237ba36901b5a3e499f2e197) C:\Windows\system32\DRIVERS
vlddmkm.sys
2010/08/27 16:32:03.0557	nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers
vraid.sys
2010/08/27 16:32:03.0583	nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers
vstor.sys
2010/08/27 16:32:03.0613	nvstor32        (d05f6e26ac960474494356fe703d61be) C:\Windows\system32\DRIVERS
vstor32.sys
2010/08/27 16:32:03.0645	nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers
v_agp.sys
2010/08/27 16:32:03.0701	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2010/08/27 16:32:03.0748	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2010/08/27 16:32:03.0783	partmgr         (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2010/08/27 16:32:03.0802	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2010/08/27 16:32:03.0831	pci             (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2010/08/27 16:32:03.0851	pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2010/08/27 16:32:03.0881	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2010/08/27 16:32:03.0923	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2010/08/27 16:32:04.0020	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERSaspptp.sys
2010/08/27 16:32:04.0041	Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2010/08/27 16:32:04.0083	PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2010/08/27 16:32:04.0130	ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2010/08/27 16:32:04.0193	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2010/08/27 16:32:04.0237	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2010/08/27 16:32:04.0264	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERSasacd.sys
2010/08/27 16:32:04.0292	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERSasl2tp.sys
2010/08/27 16:32:04.0313	RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERSaspppoe.sys
2010/08/27 16:32:04.0334	RasSstp         (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERSassstp.sys
2010/08/27 16:32:04.0353	rdbss           (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERSdbss.sys
2010/08/27 16:32:04.0382	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/27 16:32:04.0416	rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\driversdpdr.sys
2010/08/27 16:32:04.0437	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\driversdpencdd.sys
2010/08/27 16:32:04.0466	RDPWD           (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2010/08/27 16:32:04.0512	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERSspndr.sys
2010/08/27 16:32:04.0543	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2010/08/27 16:32:04.0582	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/08/27 16:32:04.0620	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2010/08/27 16:32:04.0640	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2010/08/27 16:32:04.0663	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2010/08/27 16:32:04.0703	sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2010/08/27 16:32:04.0726	sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2010/08/27 16:32:04.0746	sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2010/08/27 16:32:04.0766	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2010/08/27 16:32:04.0794	sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2010/08/27 16:32:04.0812	SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2010/08/27 16:32:04.0835	SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2010/08/27 16:32:04.0873	Smb             (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2010/08/27 16:32:04.0908	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2010/08/27 16:32:04.0978	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2010/08/27 16:32:05.0066	srv             (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
2010/08/27 16:32:05.0110	srv2            (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
2010/08/27 16:32:05.0166	srvnet          (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
2010/08/27 16:32:05.0219	ssmdrv          (3ad0362cf68de3ac500e981700242cca) C:\Windows\system32\DRIVERS\ssmdrv.sys
2010/08/27 16:32:05.0270	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2010/08/27 16:32:05.0300	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2010/08/27 16:32:05.0319	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2010/08/27 16:32:05.0342	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2010/08/27 16:32:05.0401	Tcpip           (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers	cpip.sys
2010/08/27 16:32:05.0448	Tcpip6          (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS	cpip.sys
2010/08/27 16:32:05.0484	tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers	cpipreg.sys
2010/08/27 16:32:05.0501	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers	dpipe.sys
2010/08/27 16:32:05.0521	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers	dtcp.sys
2010/08/27 16:32:05.0546	tdx             (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS	dx.sys
2010/08/27 16:32:05.0567	TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS	ermdd.sys
2010/08/27 16:32:05.0627	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS	ssecsrv.sys
2010/08/27 16:32:05.0650	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS	unmp.sys
2010/08/27 16:32:05.0681	tunnel          (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS	unnel.sys
2010/08/27 16:32:05.0698	uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2010/08/27 16:32:05.0722	udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2010/08/27 16:32:05.0734	Suspicious service (NoAccess): ufngede
2010/08/27 16:32:05.0792	ufngede         (62d5eacc8781103456891954b52f3ff4) C:\Windows\system32\drivers\ufngede.sys
2010/08/27 16:32:05.0792	Suspicious file (NoAccess): C:\Windows\system32\drivers\ufngede.sys. md5: 62d5eacc8781103456891954b52f3ff4
2010/08/27 16:32:05.0798	ufngede - detected Locked service (1)
2010/08/27 16:32:05.0840	uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2010/08/27 16:32:05.0865	uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2010/08/27 16:32:05.0893	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2010/08/27 16:32:05.0918	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2010/08/27 16:32:05.0942	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2010/08/27 16:32:05.0985	USBAAPL         (60a68a5ea173a97971ee9f1ff49eb2b3) C:\Windows\system32\Drivers\usbaapl.sys
2010/08/27 16:32:06.0009	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/27 16:32:06.0037	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2010/08/27 16:32:06.0062	usbehci         (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2010/08/27 16:32:06.0090	usbhub          (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2010/08/27 16:32:06.0111	usbohci         (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2010/08/27 16:32:06.0131	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2010/08/27 16:32:06.0163	USBSTOR         (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/27 16:32:06.0214	usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/27 16:32:06.0241	vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/27 16:32:06.0276	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2010/08/27 16:32:06.0300	viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2010/08/27 16:32:06.0321	ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2010/08/27 16:32:06.0344	viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2010/08/27 16:32:06.0367	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2010/08/27 16:32:06.0401	volmgrx         (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2010/08/27 16:32:06.0425	volsnap         (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2010/08/27 16:32:06.0452	vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2010/08/27 16:32:06.0497	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2010/08/27 16:32:06.0547	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 16:32:06.0560	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 16:32:06.0592	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2010/08/27 16:32:06.0625	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2010/08/27 16:32:06.0729	WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/27 16:32:06.0773	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/08/27 16:32:06.0828	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/27 16:32:06.0863	\HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/08/27 16:32:06.0868	================================================================================
2010/08/27 16:32:06.0868	Scan finished
2010/08/27 16:32:06.0868	================================================================================
2010/08/27 16:32:06.0882	Detected object count: 2
2010/08/27 16:32:32.0653	ufngede         (62d5eacc8781103456891954b52f3ff4) C:\Windows\system32\drivers\ufngede.sys
2010/08/27 16:32:32.0653	Suspicious file (NoAccess): C:\Windows\system32\drivers\ufngede.sys. md5: 62d5eacc8781103456891954b52f3ff4
2010/08/27 16:32:32.0660	C:\Windows\system32\drivers\ufngede.sys - quarantined
2010/08/27 16:32:32.0661	Locked service(ufngede) - User select action: Quarantine
2010/08/27 16:32:32.0668	\HardDisk0\MBR - quarantined
2010/08/27 16:32:32.0671	Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Quarantine
2010/08/27 16:32:51.0197	Deinitialize success

Xplode · Answer

Ok.

Redémarre ton PC puis relance TDSSKiller une seconde fois et poste moi le rapport stp.

miss-crystal · Answer

2010/08/27 16:51:52.0012	TDSS rootkit removing tool 2.4.1.3 Aug 27 2010 08:53:42
2010/08/27 16:51:52.0012	================================================================================
2010/08/27 16:51:52.0012	SystemInfo:
2010/08/27 16:51:52.0012	
2010/08/27 16:51:52.0012	OS Version: 6.0.6001 ServicePack: 1.0
2010/08/27 16:51:52.0012	Product type: Workstation
2010/08/27 16:51:52.0012	ComputerName: PC-DE-CALLIWEB
2010/08/27 16:51:52.0012	UserName: CalliWeb
2010/08/27 16:51:52.0012	Windows directory: C:\Windows
2010/08/27 16:51:52.0012	System windows directory: C:\Windows
2010/08/27 16:51:52.0012	Processor architecture: Intel x86
2010/08/27 16:51:52.0012	Number of processors: 2
2010/08/27 16:51:52.0012	Page size: 0x1000
2010/08/27 16:51:52.0012	Boot type: Normal boot
2010/08/27 16:51:52.0012	================================================================================
2010/08/27 16:51:52.0386	Initialize success
2010/08/27 16:51:56.0832	================================================================================
2010/08/27 16:51:56.0832	Scan started
2010/08/27 16:51:56.0832	Mode: Manual;
2010/08/27 16:51:56.0832	================================================================================
2010/08/27 16:51:58.0158	ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2010/08/27 16:51:58.0252	adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2010/08/27 16:51:58.0392	adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2010/08/27 16:51:58.0501	adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2010/08/27 16:51:58.0595	adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2010/08/27 16:51:58.0735	AFD             (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2010/08/27 16:51:58.0876	agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2010/08/27 16:51:58.0969	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2010/08/27 16:51:59.0079	aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2010/08/27 16:51:59.0188	amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2010/08/27 16:51:59.0297	amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2010/08/27 16:51:59.0344	AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2010/08/27 16:51:59.0391	AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
2010/08/27 16:51:59.0593	arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2010/08/27 16:51:59.0640	arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2010/08/27 16:51:59.0687	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/27 16:51:59.0734	atapi           (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2010/08/27 16:51:59.0827	avgio           (f1d43170fdd7399ee17ea32d4f868b0c) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2010/08/27 16:51:59.0937	avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2010/08/27 16:52:00.0015	avipbb          (ad9bd66a862116e79cb45bb6be46055f) C:\Windows\system32\DRIVERS\avipbb.sys
2010/08/27 16:52:00.0093	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2010/08/27 16:52:00.0139	blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2010/08/27 16:52:00.0233	bowser          (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2010/08/27 16:52:00.0264	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2010/08/27 16:52:00.0327	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2010/08/27 16:52:00.0358	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2010/08/27 16:52:00.0405	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2010/08/27 16:52:00.0451	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2010/08/27 16:52:00.0467	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2010/08/27 16:52:00.0529	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2010/08/27 16:52:00.0545	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/08/27 16:52:00.0592	cdrom           (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2010/08/27 16:52:00.0654	circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2010/08/27 16:52:00.0732	CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2010/08/27 16:52:00.0810	cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2010/08/27 16:52:00.0888	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys
2010/08/27 16:52:00.0919	crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2010/08/27 16:52:00.0935	Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2010/08/27 16:52:01.0013	DfsC            (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2010/08/27 16:52:01.0107	disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2010/08/27 16:52:01.0263	driverhardwarev2 (c0bf8cd94c88b34fb324f4bd6dae544d) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
2010/08/27 16:52:01.0387	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2010/08/27 16:52:01.0434	DXGKrnl         (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2010/08/27 16:52:01.0497	E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2010/08/27 16:52:01.0528	Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2010/08/27 16:52:01.0575	elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2010/08/27 16:52:01.0653	ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2010/08/27 16:52:01.0731	exfat           (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2010/08/27 16:52:01.0762	fastfat         (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2010/08/27 16:52:01.0793	fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2010/08/27 16:52:01.0840	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2010/08/27 16:52:01.0871	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2010/08/27 16:52:01.0918	flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/27 16:52:01.0949	FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2010/08/27 16:52:01.0980	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2010/08/27 16:52:02.0011	gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2010/08/27 16:52:02.0089	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2010/08/27 16:52:02.0136	HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/27 16:52:02.0167	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2010/08/27 16:52:02.0214	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2010/08/27 16:52:02.0277	HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2010/08/27 16:52:02.0308	HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2010/08/27 16:52:02.0401	HTTP            (33b02459e86d0a2b86a6b9fe19139390) C:\Windows\system32\drivers\HTTP.sys
2010/08/27 16:52:02.0448	i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2010/08/27 16:52:02.0495	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/27 16:52:02.0542	iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2010/08/27 16:52:02.0604	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2010/08/27 16:52:02.0651	int15           (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2010/08/27 16:52:02.0713	IntcAzAudAddService (58628f232a00a3149d7cc7708c521499) C:\Windows\system32\drivers\RTKVHDA.sys
2010/08/27 16:52:02.0791	intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2010/08/27 16:52:02.0823	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2010/08/27 16:52:02.0854	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/27 16:52:02.0916	IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2010/08/27 16:52:02.0947	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2010/08/27 16:52:02.0979	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2010/08/27 16:52:03.0025	isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2010/08/27 16:52:03.0057	iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/27 16:52:03.0088	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2010/08/27 16:52:03.0119	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2010/08/27 16:52:03.0166	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/27 16:52:03.0197	kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/27 16:52:03.0244	KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2010/08/27 16:52:03.0322	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/08/27 16:52:03.0384	LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2010/08/27 16:52:03.0431	LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2010/08/27 16:52:03.0478	LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2010/08/27 16:52:03.0509	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2010/08/27 16:52:03.0587	megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2010/08/27 16:52:03.0634	MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2010/08/27 16:52:03.0696	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2010/08/27 16:52:03.0727	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2010/08/27 16:52:03.0759	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2010/08/27 16:52:03.0821	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2010/08/27 16:52:03.0915	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2010/08/27 16:52:03.0961	mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2010/08/27 16:52:03.0993	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2010/08/27 16:52:04.0039	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2010/08/27 16:52:04.0086	MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2010/08/27 16:52:04.0117	mrxsmb          (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/27 16:52:04.0180	mrxsmb10        (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/27 16:52:04.0242	mrxsmb20        (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/27 16:52:04.0336	msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2010/08/27 16:52:04.0383	msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2010/08/27 16:52:04.0429	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2010/08/27 16:52:04.0461	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2010/08/27 16:52:04.0507	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2010/08/27 16:52:04.0523	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/27 16:52:04.0554	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2010/08/27 16:52:04.0570	MsRPC           (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2010/08/27 16:52:04.0617	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/27 16:52:04.0648	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2010/08/27 16:52:04.0679	Mup             (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2010/08/27 16:52:04.0726	NativeWifiP     (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS
wifi.sys
2010/08/27 16:52:04.0773	NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers
dis.sys
2010/08/27 16:52:04.0835	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS
distapi.sys
2010/08/27 16:52:04.0897	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS
disuio.sys
2010/08/27 16:52:04.0944	NdisWan         (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS
diswan.sys
2010/08/27 16:52:04.0975	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2010/08/27 16:52:05.0007	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS
etbios.sys
2010/08/27 16:52:05.0069	netbt           (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS
etbt.sys
2010/08/27 16:52:05.0319	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers
frd960.sys
2010/08/27 16:52:05.0459	Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2010/08/27 16:52:05.0506	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers
siproxy.sys
2010/08/27 16:52:05.0631	Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2010/08/27 16:52:05.0740	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers
trigdigi.sys
2010/08/27 16:52:05.0802	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2010/08/27 16:52:06.0130	NVENETFD        (c39ad3b818502edfa4b819148b72a0e3) C:\Windows\system32\DRIVERS
vmfdx32.sys
2010/08/27 16:52:07.0191	nvlddmkm        (00832a21237ba36901b5a3e499f2e197) C:\Windows\system32\DRIVERS
vlddmkm.sys
2010/08/27 16:52:07.0643	nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers
vraid.sys
2010/08/27 16:52:07.0955	nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers
vstor.sys
2010/08/27 16:52:08.0251	nvstor32        (d05f6e26ac960474494356fe703d61be) C:\Windows\system32\DRIVERS
vstor32.sys
2010/08/27 16:52:08.0423	nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers
v_agp.sys
2010/08/27 16:52:08.0860	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2010/08/27 16:52:09.0094	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2010/08/27 16:52:09.0328	partmgr         (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2010/08/27 16:52:09.0718	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2010/08/27 16:52:09.0843	pci             (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2010/08/27 16:52:09.0952	pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2010/08/27 16:52:09.0999	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2010/08/27 16:52:10.0186	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2010/08/27 16:52:10.0732	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERSaspptp.sys
2010/08/27 16:52:10.0903	Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2010/08/27 16:52:10.0966	PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2010/08/27 16:52:11.0059	ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2010/08/27 16:52:11.0262	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2010/08/27 16:52:11.0481	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2010/08/27 16:52:11.0683	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERSasacd.sys
2010/08/27 16:52:11.0933	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERSasl2tp.sys
2010/08/27 16:52:12.0151	RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERSaspppoe.sys
2010/08/27 16:52:12.0401	RasSstp         (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERSassstp.sys
2010/08/27 16:52:12.0666	rdbss           (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERSdbss.sys
2010/08/27 16:52:12.0978	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/27 16:52:13.0150	rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\driversdpdr.sys
2010/08/27 16:52:13.0290	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\driversdpencdd.sys
2010/08/27 16:52:13.0415	RDPWD           (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2010/08/27 16:52:13.0555	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERSspndr.sys
2010/08/27 16:52:13.0727	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2010/08/27 16:52:13.0945	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/08/27 16:52:14.0179	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2010/08/27 16:52:14.0382	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2010/08/27 16:52:14.0601	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2010/08/27 16:52:14.0835	sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2010/08/27 16:52:14.0975	sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2010/08/27 16:52:15.0209	sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2010/08/27 16:52:15.0521	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2010/08/27 16:52:15.0864	sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2010/08/27 16:52:16.0270	SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2010/08/27 16:52:16.0551	SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2010/08/27 16:52:16.0707	Smb             (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2010/08/27 16:52:17.0190	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2010/08/27 16:52:17.0939	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2010/08/27 16:52:19.0000	srv             (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
2010/08/27 16:52:19.0405	srv2            (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
2010/08/27 16:52:19.0686	srvnet          (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
2010/08/27 16:52:20.0061	ssmdrv          (3ad0362cf68de3ac500e981700242cca) C:\Windows\system32\DRIVERS\ssmdrv.sys
2010/08/27 16:52:20.0232	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2010/08/27 16:52:20.0435	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2010/08/27 16:52:20.0544	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2010/08/27 16:52:20.0669	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2010/08/27 16:52:20.0887	Tcpip           (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers	cpip.sys
2010/08/27 16:52:20.0965	Tcpip6          (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS	cpip.sys
2010/08/27 16:52:21.0028	tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers	cpipreg.sys
2010/08/27 16:52:21.0215	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers	dpipe.sys
2010/08/27 16:52:21.0605	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers	dtcp.sys
2010/08/27 16:52:21.0730	tdx             (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS	dx.sys
2010/08/27 16:52:21.0901	TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS	ermdd.sys
2010/08/27 16:52:22.0572	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS	ssecsrv.sys
2010/08/27 16:52:22.0697	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS	unmp.sys
2010/08/27 16:52:22.0947	tunnel          (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS	unnel.sys
2010/08/27 16:52:23.0165	uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2010/08/27 16:52:23.0305	udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2010/08/27 16:52:23.0352	Suspicious service (NoAccess): ufngede
2010/08/27 16:52:23.0617	ufngede         (62d5eacc8781103456891954b52f3ff4) C:\Windows\system32\drivers\ufngede.sys
2010/08/27 16:52:23.0617	Suspicious file (NoAccess): C:\Windows\system32\drivers\ufngede.sys. md5: 62d5eacc8781103456891954b52f3ff4
2010/08/27 16:52:23.0633	ufngede - detected Locked service (1)
2010/08/27 16:52:23.0742	uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2010/08/27 16:52:23.0789	uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2010/08/27 16:52:23.0836	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2010/08/27 16:52:23.0883	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2010/08/27 16:52:23.0914	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2010/08/27 16:52:23.0992	USBAAPL         (60a68a5ea173a97971ee9f1ff49eb2b3) C:\Windows\system32\Drivers\usbaapl.sys
2010/08/27 16:52:24.0023	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/27 16:52:24.0054	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2010/08/27 16:52:24.0085	usbehci         (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2010/08/27 16:52:24.0132	usbhub          (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2010/08/27 16:52:24.0163	usbohci         (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2010/08/27 16:52:24.0210	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2010/08/27 16:52:24.0257	USBSTOR         (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/27 16:52:24.0288	usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/27 16:52:24.0397	vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/27 16:52:25.0068	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2010/08/27 16:52:25.0240	viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2010/08/27 16:52:25.0333	ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2010/08/27 16:52:25.0365	viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2010/08/27 16:52:25.0443	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2010/08/27 16:52:25.0521	volmgrx         (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2010/08/27 16:52:25.0567	volsnap         (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2010/08/27 16:52:25.0739	vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2010/08/27 16:52:26.0176	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2010/08/27 16:52:26.0581	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 16:52:26.0613	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 16:52:26.0737	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2010/08/27 16:52:26.0831	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2010/08/27 16:52:27.0127	WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/27 16:52:27.0299	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/08/27 16:52:27.0424	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/27 16:52:27.0517	\HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/08/27 16:52:27.0533	================================================================================
2010/08/27 16:52:27.0533	Scan finished
2010/08/27 16:52:27.0533	================================================================================
2010/08/27 16:52:27.0549	Detected object count: 2
2010/08/27 16:53:00.0870	HKLM\SYSTEM\ControlSet001\services\ufngede - will be deleted after reboot
2010/08/27 16:53:00.0870	HKLM\SYSTEM\ControlSet003\services\ufngede - will be deleted after reboot
2010/08/27 16:53:00.0886	C:\Windows\system32\drivers\ufngede.sys - will be deleted after reboot
2010/08/27 16:53:00.0886	Locked service(ufngede) - User select action: Delete
2010/08/27 16:53:00.0901	\HardDisk0\MBR - quarantined
2010/08/27 16:53:00.0901	Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Quarantine

Xplode · Answer

Hm.. bizarre ça :)

On va faire autrement :

-+-+-+-+-> MBRCheck - Scan <-+-+-+-+-


[x] Télécharge MBRCheck et enregistre le sur ton bureau.

/!\ Ferme toutes les applications en cours d'exécution /!\

[x] Lance le, puis patiente pendant l'analyse. 

[x] Un rapport sera automatiquement créé sur le bureau ( MBRCheck_AA.JJ.MM_hh.mm.ss.txt )

[x] Copie/Colle le contenu de ce rapport dans ta prochaine réponse.

miss-crystal · Answer

Euh je n'ai pas l'option scan j'ai une fenetre qui s'ouvre et me demande d'entrer mon choix...

miss-crystal · Answer

ah d'accord pardon !


MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Basic Edition
Windows Information:		Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:	eMachines
BIOS Manufacturer:		Phoenix Technologies, LTD
System Manufacturer:		eMachines
System Product Name:		EL1200
Logical Drives Mask:		0x000000fc

Kernel Drivers (total 138):
  0x81E44000 \SystemRoot\system32
tkrnlpa.exe
  0x81E11000 \SystemRoot\system32\hal.dll
  0x86B9C000 \SystemRoot\system32\kdcom.dll
  0x80409000 \SystemRoot\system32\PSHED.dll
  0x8041A000 \SystemRoot\system32\BOOTVID.dll
  0x80422000 \SystemRoot\system32\CLFS.SYS
  0x80463000 \SystemRoot\system32\CI.dll
  0x80543000 \SystemRoot\system32\drivers\klmdb.sys
  0x80553000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x805CF000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8060A000 \SystemRoot\system32\drivers\acpi.sys
  0x80650000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x80659000 \SystemRoot\system32\drivers\msisadrv.sys
  0x80661000 \SystemRoot\system32\drivers\pci.sys
  0x80688000 \SystemRoot\System32\drivers\partmgr.sys
  0x80697000 \SystemRoot\System32\Drivers\ufngede.sys
  0x80759000 \SystemRoot\system32\drivers\volmgr.sys
  0x80768000 \SystemRoot\System32\drivers\volmgrx.sys
  0x807B2000 \SystemRoot\system32\drivers\pciide.sys
  0x807B9000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x807C7000 \SystemRoot\System32\drivers\mountmgr.sys
  0x807D7000 \SystemRoot\system32\drivers\atapi.sys
  0x807DF000 \SystemRoot\system32\drivers\ataport.SYS
  0x8240F000 \SystemRoot\system32\DRIVERS
vstor32.sys
  0x82434000 \SystemRoot\system32\DRIVERS\storport.sys
  0x82475000 \SystemRoot\system32\drivers\fltmgr.sys
  0x824A7000 \SystemRoot\system32\drivers\fileinfo.sys
  0x824B7000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x82605000 \SystemRoot\system32\drivers
dis.sys
  0x82710000 \SystemRoot\system32\drivers\msrpc.sys
  0x8273B000 \SystemRoot\system32\drivers\NETIO.SYS
  0x89A08000 \SystemRoot\System32\drivers	cpip.sys
  0x89AF1000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x89C0D000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x89D1C000 \SystemRoot\system32\drivers\volsnap.sys
  0x89D55000 \SystemRoot\System32\Drivers\spldr.sys
  0x89D5D000 \SystemRoot\System32\Drivers\mup.sys
  0x89D6C000 \SystemRoot\System32\drivers\ecache.sys
  0x89D93000 \SystemRoot\system32\drivers\disk.sys
  0x89DA4000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x89DC5000 \SystemRoot\system32\drivers\crcdisk.sys
  0x89DE5000 \SystemRoot\system32\DRIVERS	unnel.sys
  0x89DF0000 \SystemRoot\system32\DRIVERS	unmp.sys
  0x89B31000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0x89C00000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x89B41000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x89B4B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x89B89000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x89B98000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8D40B000 \SystemRoot\system32\DRIVERS
vmfdx32.sys
  0x8D50A000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8DA0F000 \SystemRoot\system32\DRIVERS
vlddmkm.sys
  0x8E119000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8E1B8000 \SystemRoot\System32\drivers\watchdog.sys
  0x8E1C5000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8E1F3000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8D522000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0x8DA00000 \SystemRoot\system32\DRIVERS
distapi.sys
  0x8D539000 \SystemRoot\system32\DRIVERS
diswan.sys
  0x8D55C000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0x8D56B000 \SystemRoot\system32\DRIVERSaspptp.sys
  0x8D57F000 \SystemRoot\system32\DRIVERSassstp.sys
  0x8D594000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0x8D5A4000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8D5AF000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8DA0B000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8D5BA000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8D5E4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8D5EE000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x89BAA000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x89BDE000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8E60A000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8E814000 \SystemRoot\system32\drivers\portcls.sys
  0x8E841000 \SystemRoot\system32\drivers\drmk.sys
  0x8E866000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8E86F000 \SystemRoot\System32\Drivers\Null.SYS
  0x8E876000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8E899000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8E8A0000 \SystemRoot\System32\drivers\vga.sys
  0x8E8AC000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8E8CD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8E8D5000 \SystemRoot\system32\driversdpencdd.sys
  0x8E8DD000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8E8E8000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8E8F6000 \SystemRoot\System32\DRIVERSasacd.sys
  0x8E8FF000 \SystemRoot\system32\DRIVERS	dx.sys
  0x8E915000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8E929000 \SystemRoot\system32\drivers\afd.sys
  0x8E971000 \SystemRoot\System32\DRIVERS
etbt.sys
  0x8E9A3000 \SystemRoot\system32\drivers\ws2ifsl.sys
  0x8E9AC000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8E9C2000 \SystemRoot\system32\DRIVERS
etbios.sys
  0x8E9D0000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8E9E3000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x82775000 \SystemRoot\system32\DRIVERSdbss.sys
  0x8E9E9000 \SystemRoot\system32\drivers
siproxy.sys
  0x8E87D000 \SystemRoot\System32\Drivers\dfsc.sys
  0x827B1000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x827CD000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8E894000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8E896000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8E9F3000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x89BEF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8E600000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8D400000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x827E4000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x89DCE000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x89DDB000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0x89B0C000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
  0x934E0000 \SystemRoot\System32\win32k.sys
  0x827F6000 \SystemRoot\System32\drivers\Dxapi.sys
  0x82528000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x93700000 \SystemRoot\System32\TSDDD.dll
  0x93720000 \SystemRoot\System32\cdd.dll
  0x93730000 \SystemRoot\System32\ATMFD.DLL
  0x82537000 \SystemRoot\system32\drivers\luafv.sys
  0x82552000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x9C609000 \SystemRoot\system32\drivers\spsys.sys
  0x9C6B8000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9C6C8000 \SystemRoot\system32\DRIVERSspndr.sys
  0x9C6DB000 \SystemRoot\system32\drivers\HTTP.sys
  0x9C748000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9C765000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9C77E000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9C793000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9C7B3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x82566000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9C7D2000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x8259F000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9E60A000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9E658000 \??\C:\Windows\system32\drivers\int15.sys
  0x9E65F000 \SystemRoot\system32\drivers\peauth.sys
  0x9E73D000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9E747000 \SystemRoot\System32\drivers	cpipreg.sys
  0x9E753000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x9E768000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x9E77A000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x771A0000 \Windows\System32
tdll.dll

Processes (total 52):
       0 System Idle Process
       4 System
     452 C:\Windows\System32\smss.exe
     564 csrss.exe
     616 C:\Windows\System32\wininit.exe
     624 csrss.exe
     664 C:\Windows\System32\services.exe
     676 C:\Windows\System32\lsass.exe
     684 C:\Windows\System32\lsm.exe
     708 C:\Windows\System32\winlogon.exe
     884 C:\Windows\System32\svchost.exe
     948 C:\Windows\System32
vvsvc.exe
     976 C:\Windows\System32\svchost.exe
    1016 C:\Windows\System32\svchost.exe
    1108 C:\Windows\System32\svchost.exe
    1192 C:\Windows\System32\svchost.exe
    1224 C:\Windows\System32\svchost.exe
    1292 C:\Windows\System32\audiodg.exe
    1360 C:\Windows\System32\svchost.exe
    1388 C:\Windows\System32\SLsvc.exe
    1448 C:\Windows\System32\svchost.exe
    1508 C:\Windows\System32undll32.exe
    1584 C:\Windows\System32\svchost.exe
    1884 C:\Windows\System32\spoolsv.exe
    1928 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1952 C:\Windows\System32\svchost.exe
    2044 C:\Windows\System32	askeng.exe
     816 C:\Windows\System32\dwm.exe
    1684 C:\Windows\explorer.exe
    1732 C:\Windows\System32	askeng.exe
    2156 C:\Windows\RtHDVCpl.exe
    2164 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2600 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2632 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2668 C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe
    2824 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2952 C:\Windows\System32\svchost.exe
    3004 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    3048 C:\Program Files\EMACHINES\eMachines Recovery Management\eRecovery\HidChk.exe
    3072 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    3124 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    3144 C:\Windows\System32\svchost.exe
    3204 C:\Windows\System32\svchost.exe
    3280 C:\Windows\System32\SearchIndexer.exe
    3392 WUDFHost.exe
    3924 C:\Windows\System32\mobsync.exe
    2208 C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
    1344 C:\Windows\System32\SearchProtocolHost.exe
     572 C:\Windows\System32\SearchFilterHost.exe
    1408 C:\Windows\System32\dllhost.exe
    1132 C:\Users\CalliWeb\Downloads\MBRCheck.exe
    1484 C:\Windows\System32\conime.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000005'00100000  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000027'47305200  (NTFS)

PhysicalDrive0 Model Number: WDC WD3200AAJS-22L7A, Rev: 01.0

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!
            SHA1: AE8A2D972741A4CF0A40B2C5E6A6A17665C62B80


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice:

Xplode · Answer

Relance MBRCheck.

Tape 2 et appuie sur entrée
Tape 0 et appuie sur entrée
Tape 0 et appuie sur entrée

Ensuite tu devras taper YES et appuyer sur entrée.

Une fois ceci fais, redémarre le PC, relance MBRCheck et poste moi le rapport qui sera créé sur ton bureau ( le plus récent )

miss-crystal · Answer

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Basic Edition
Windows Information:		Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:	eMachines
BIOS Manufacturer:		Phoenix Technologies, LTD
System Manufacturer:		eMachines
System Product Name:		EL1200
Logical Drives Mask:		0x000000fc

Kernel Drivers (total 136):
  0x81E3D000 \SystemRoot\system32
tkrnlpa.exe
  0x81E0A000 \SystemRoot\system32\hal.dll
  0x869A7000 \SystemRoot\system32\kdcom.dll
  0x80409000 \SystemRoot\system32\PSHED.dll
  0x8041A000 \SystemRoot\system32\BOOTVID.dll
  0x80422000 \SystemRoot\system32\CLFS.SYS
  0x80463000 \SystemRoot\system32\CI.dll
  0x80543000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x805BF000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8060E000 \SystemRoot\system32\drivers\acpi.sys
  0x80654000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x8065D000 \SystemRoot\system32\drivers\msisadrv.sys
  0x80665000 \SystemRoot\system32\drivers\pci.sys
  0x8068C000 \SystemRoot\System32\drivers\partmgr.sys
  0x8069B000 \SystemRoot\system32\drivers\volmgr.sys
  0x806AA000 \SystemRoot\System32\drivers\volmgrx.sys
  0x806F4000 \SystemRoot\system32\drivers\pciide.sys
  0x806FB000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x80709000 \SystemRoot\System32\drivers\mountmgr.sys
  0x80719000 \SystemRoot\system32\drivers\atapi.sys
  0x80721000 \SystemRoot\system32\drivers\ataport.SYS
  0x8073F000 \SystemRoot\system32\DRIVERS
vstor32.sys
  0x80764000 \SystemRoot\system32\DRIVERS\storport.sys
  0x807A5000 \SystemRoot\system32\drivers\fltmgr.sys
  0x807D7000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8240E000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8247F000 \SystemRoot\system32\drivers
dis.sys
  0x8258A000 \SystemRoot\system32\drivers\msrpc.sys
  0x825B5000 \SystemRoot\system32\drivers\NETIO.SYS
  0x82607000 \SystemRoot\System32\drivers	cpip.sys
  0x826F0000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x89801000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x89910000 \SystemRoot\system32\drivers\volsnap.sys
  0x89949000 \SystemRoot\System32\Drivers\spldr.sys
  0x89951000 \SystemRoot\System32\Drivers\mup.sys
  0x89960000 \SystemRoot\System32\drivers\ecache.sys
  0x89987000 \SystemRoot\system32\drivers\disk.sys
  0x89998000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x899B9000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8270B000 \SystemRoot\system32\DRIVERS	unnel.sys
  0x82716000 \SystemRoot\system32\DRIVERS	unmp.sys
  0x8271F000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0x8272F000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x82738000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x82742000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x82780000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8278F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8D009000 \SystemRoot\system32\DRIVERS
vmfdx32.sys
  0x8D108000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8D204000 \SystemRoot\system32\DRIVERS
vlddmkm.sys
  0x8D90E000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8D9AD000 \SystemRoot\System32\drivers\watchdog.sys
  0x8D9BA000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8D9E8000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8D120000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0x8D9F3000 \SystemRoot\system32\DRIVERS
distapi.sys
  0x8D137000 \SystemRoot\system32\DRIVERS
diswan.sys
  0x8D15A000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0x8D169000 \SystemRoot\system32\DRIVERSaspptp.sys
  0x8D17D000 \SystemRoot\system32\DRIVERSassstp.sys
  0x8D192000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0x8D1A2000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8D1AD000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8D9FE000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8D1B8000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8D1E2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8D1EC000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x827A1000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x827D5000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8DA06000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8DC10000 \SystemRoot\system32\drivers\portcls.sys
  0x8DC3D000 \SystemRoot\system32\drivers\drmk.sys
  0x8DC62000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8DC6B000 \SystemRoot\System32\Drivers\Null.SYS
  0x8DC72000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8DC95000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8DC9C000 \SystemRoot\System32\drivers\vga.sys
  0x8DCA8000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8DCC9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8DCD1000 \SystemRoot\system32\driversdpencdd.sys
  0x8DCD9000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8DCE4000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8DCF2000 \SystemRoot\System32\DRIVERSasacd.sys
  0x8DCFB000 \SystemRoot\system32\DRIVERS	dx.sys
  0x8DD11000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8DD25000 \SystemRoot\system32\drivers\afd.sys
  0x8DD6D000 \SystemRoot\System32\DRIVERS
etbt.sys
  0x8DD9F000 \SystemRoot\system32\drivers\ws2ifsl.sys
  0x8DDA8000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8DDBE000 \SystemRoot\system32\DRIVERS
etbios.sys
  0x8DDCC000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8DDDF000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8E00A000 \SystemRoot\system32\DRIVERSdbss.sys
  0x8E046000 \SystemRoot\system32\drivers
siproxy.sys
  0x8E050000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8E067000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8E083000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8E085000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8E092000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0x8E09C000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
  0x8E0C1000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8E0CA000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8E0DA000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8E0DC000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8E0E4000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8E0FB000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0x93CA0000 \SystemRoot\System32\win32k.sys
  0x8E10D000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8E117000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x8E120000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x93EC0000 \SystemRoot\System32\TSDDD.dll
  0x93EE0000 \SystemRoot\System32\cdd.dll
  0x93EF0000 \SystemRoot\System32\ATMFD.DLL
  0x8E12F000 \SystemRoot\system32\drivers\luafv.sys
  0x8E14A000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x9C00D000 \SystemRoot\system32\drivers\spsys.sys
  0x9C0BC000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9C0CC000 \SystemRoot\system32\DRIVERSspndr.sys
  0x9C0DF000 \SystemRoot\system32\drivers\HTTP.sys
  0x9C14C000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9C169000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9C182000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9C197000 \SystemRoot\system32\drivers\mrxdav.sys
  0x9C1B7000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x8E15E000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9C1D6000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x8E197000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9E401000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9E44F000 \??\C:\Windows\system32\drivers\int15.sys
  0x9E456000 \SystemRoot\system32\drivers\peauth.sys
  0x9E534000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9E53E000 \SystemRoot\System32\drivers	cpipreg.sys
  0x9E54A000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x9E55F000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x9E571000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x775F0000 \Windows\System32
tdll.dll

Processes (total 50):
       0 System Idle Process
       4 System
     428 C:\Windows\System32\smss.exe
     496 csrss.exe
     548 csrss.exe
     556 C:\Windows\System32\wininit.exe
     592 C:\Windows\System32\services.exe
     612 C:\Windows\System32\lsass.exe
     620 C:\Windows\System32\lsm.exe
     644 C:\Windows\System32\winlogon.exe
     792 C:\Windows\System32\svchost.exe
     860 C:\Windows\System32
vvsvc.exe
     888 C:\Windows\System32\svchost.exe
     932 C:\Windows\System32\svchost.exe
    1020 C:\Windows\System32\svchost.exe
    1056 C:\Windows\System32\svchost.exe
    1092 C:\Windows\System32\svchost.exe
    1196 C:\Windows\System32\audiodg.exe
    1264 C:\Windows\System32\svchost.exe
    1340 C:\Windows\System32\SLsvc.exe
    1380 C:\Windows\System32\svchost.exe
    1416 C:\Windows\System32undll32.exe
    1524 C:\Windows\System32\svchost.exe
    1808 C:\Windows\System32\spoolsv.exe
    1848 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1860 C:\Windows\System32\svchost.exe
    1944 C:\Windows\System32	askeng.exe
     124 C:\Windows\System32\dwm.exe
     308 C:\Windows\System32	askeng.exe
    1000 C:\Windows\explorer.exe
     444 C:\Windows\RtHDVCpl.exe
    1816 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2384 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2400 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2432 C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe
    2612 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    2688 C:\Windows\System32\svchost.exe
    2764 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2836 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2916 C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    2928 C:\Windows\System32\svchost.exe
    2984 C:\Windows\System32\svchost.exe
    3020 C:\Windows\System32\SearchIndexer.exe
    3156 C:\Program Files\EMACHINES\eMachines Recovery Management\eRecovery\HidChk.exe
    3364 WmiPrvSE.exe
    3372 WUDFHost.exe
    3760 C:\Windows\System32\mobsync.exe
    2108 C:\Windows\System32\dllhost.exe
    3952 C:\Users\CalliWeb\Downloads\MBRCheck.exe
    4028 C:\Windows\System32\conime.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000005'00100000  (NTFS)
\.\D: --> \.\PhysicalDrive0 at offset 0x00000027'47305200  (NTFS)

PhysicalDrive0 Model Number: WDC WD3200AAJS-22L7A, Rev: 01.0

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \.\PhysicalDrive0   Known-bad MBR code detected (Whistler / Black Internet)!
            SHA1: AE8A2D972741A4CF0A40B2C5E6A6A17665C62B80


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Xplode · Answer

TDSSKiller n'arrive pas à supprimer le bootkit.
MBRCheck non plus.

Décidément.. on a pas de chance..
J'ai l'impression que tu as une nouvelle variante d'un rootkit très connu nommé TDSS. Apparemment cette variante toucherais le MBR du disque dur.

J'ai vu que tu avais sur ton PC des fichiers relatifs à combofix. L'as tu utilisé ? Si oui, as tu encore le rapport ? poste le moi si tu l'as encore.

miss-crystal · Answer

Euh malheureusement je l'ai désinstallé, il emet un moment une alarme impossible à baisser...et il s'agit de mon pc de bureau avec mon employeur pas loin...je préfère ne pas lui faire de topo sinon il va penser que je fais nptkoi or je ne sais pas comment j'attrape ces virus ! Alors s'il te plait, je peux utiliser nptkel logiciel mais qu'il soit discret. :s

Xplode · Answer

On va peut être devoir l'utiliser quand même...

Avant je tiens à essayer un autre outil :

Télécharge Bootkit Remover et dézippe le sur ton bureau.

Télécharge BTKR_Runbox sur le bureau également.

-> Tu dois donc avoir remover.exe ainsi que BTKR_Runbox.exe sur le bureau.

Lance BTKR_Runbox et choisis l'option 1

Suis les instructions et poste moi le rapport qui s'ouvrira.

miss-crystal · Answer

.\debug.cpp(238) : Debug log started at 27.08.2010 - 15:32:32 .\boot_cleaner.cpp(675) : Bootkit Remover .\boot_cleaner.cpp(676) : (c) 2009 eSage Lab .\boot_cleaner.cpp(677) : www.esagelab.com .\boot_cleaner.cpp(681) : Program version: 1.1.0.0 .\boot_cleaner.cpp(688) : OS Version: Microsoft Windows Vista Home Basic Edition Service Pack 1 (build 6001), 32-bit .\debug.cpp(248) : ********************************************** .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] *********** .\debug.cpp(250) : ********************************************** .\debug.cpp(256) : 0x81e3d000 0x003b9000 "\SystemRoot\system32 tkrnlpa.exe" .\debug.cpp(256) : 0x81e0a000 0x00033000 "\SystemRoot\system32\hal.dll" .\debug.cpp(256) : 0x869a7000 0x00008000 "\SystemRoot\system32\kdcom.dll" .\debug.cpp(256) : 0x80409000 0x00011000 "\SystemRoot\system32\PSHED.dll" .\debug.cpp(256) : 0x8041a000 0x00008000 "\SystemRoot\system32\BOOTVID.dll" .\debug.cpp(256) : 0x80422000 0x00041000 "\SystemRoot\system32\CLFS.SYS" .\debug.cpp(256) : 0x80463000 0x000e0000 "\SystemRoot\system32\CI.dll" .\debug.cpp(256) : 0x80543000 0x0007c000 "\SystemRoot\system32\drivers\Wdf01000.sys" .\debug.cpp(256) : 0x805bf000 0x0000d000 "\SystemRoot\system32\drivers\WDFLDR.SYS" .\debug.cpp(256) : 0x8060e000 0x00046000 "\SystemRoot\system32\drivers\acpi.sys" .\debug.cpp(256) : 0x80654000 0x00009000 "\SystemRoot\system32\drivers\WMILIB.SYS" .\debug.cpp(256) : 0x8065d000 0x00008000 "\SystemRoot\system32\drivers\msisadrv.sys" .\debug.cpp(256) : 0x80665000 0x00027000 "\SystemRoot\system32\drivers\pci.sys" .\debug.cpp(256) : 0x8068c000 0x0000f000 "\SystemRoot\System32\drivers\partmgr.sys" .\debug.cpp(256) : 0x8069b000 0x0000f000 "\SystemRoot\system32\drivers\volmgr.sys" .\debug.cpp(256) : 0x806aa000 0x0004a000 "\SystemRoot\System32\drivers\volmgrx.sys" .\debug.cpp(256) : 0x806f4000 0x00007000 "\SystemRoot\system32\drivers\pciide.sys" .\debug.cpp(256) : 0x806fb000 0x0000e000 "\SystemRoot\system32\drivers\PCIIDEX.SYS" .\debug.cpp(256) : 0x80709000 0x00010000 "\SystemRoot\System32\drivers\mountmgr.sys" .\debug.cpp(256) : 0x80719000 0x00008000 "\SystemRoot\system32\drivers\atapi.sys" .\debug.cpp(256) : 0x80721000 0x0001e000 "\SystemRoot\system32\drivers\ataport.SYS" .\debug.cpp(256) : 0x8073f000 0x00025000 "\SystemRoot\system32\DRIVERS vstor32.sys" .\debug.cpp(256) : 0x80764000 0x00041000 "\SystemRoot\system32\DRIVERS\storport.sys" .\debug.cpp(256) : 0x807a5000 0x00032000 "\SystemRoot\system32\drivers\fltmgr.sys" .\debug.cpp(256) : 0x807d7000 0x00010000 "\SystemRoot\system32\drivers\fileinfo.sys" .\debug.cpp(256) : 0x8240e000 0x00071000 "\SystemRoot\System32\Drivers\ksecdd.sys" .\debug.cpp(256) : 0x8247f000 0x0010b000 "\SystemRoot\system32\drivers dis.sys" .\debug.cpp(256) : 0x8258a000 0x0002b000 "\SystemRoot\system32\drivers\msrpc.sys" .\debug.cpp(256) : 0x825b5000 0x0003a000 "\SystemRoot\system32\drivers\NETIO.SYS" .\debug.cpp(256) : 0x82607000 0x000e9000 "\SystemRoot\System32\drivers cpip.sys" .\debug.cpp(256) : 0x826f0000 0x0001b000 "\SystemRoot\System32\drivers\fwpkclnt.sys" .\debug.cpp(256) : 0x89801000 0x0010f000 "\SystemRoot\System32\Drivers\Ntfs.sys" .\debug.cpp(256) : 0x89910000 0x00039000 "\SystemRoot\system32\drivers\volsnap.sys" .\debug.cpp(256) : 0x89949000 0x00008000 "\SystemRoot\System32\Drivers\spldr.sys" .\debug.cpp(256) : 0x89951000 0x0000f000 "\SystemRoot\System32\Drivers\mup.sys" .\debug.cpp(256) : 0x89960000 0x00027000 "\SystemRoot\System32\drivers\ecache.sys" .\debug.cpp(256) : 0x89987000 0x00011000 "\SystemRoot\system32\drivers\disk.sys" .\debug.cpp(256) : 0x89998000 0x00021000 "\SystemRoot\system32\drivers\CLASSPNP.SYS" .\debug.cpp(256) : 0x899b9000 0x00009000 "\SystemRoot\system32\drivers\crcdisk.sys" .\debug.cpp(256) : 0x8270b000 0x0000b000 "\SystemRoot\system32\DRIVERS unnel.sys" .\debug.cpp(256) : 0x82716000 0x00009000 "\SystemRoot\system32\DRIVERS unmp.sys" .\debug.cpp(256) : 0x8271f000 0x00010000 "\SystemRoot\system32\DRIVERS\amdk8.sys" .\debug.cpp(256) : 0x8272f000 0x00009000 "\SystemRoot\system32\DRIVERS\wmiacpi.sys" .\debug.cpp(256) : 0x82738000 0x0000a000 "\SystemRoot\system32\DRIVERS\usbohci.sys" .\debug.cpp(256) : 0x82742000 0x0003e000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS" .\debug.cpp(256) : 0x82780000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbehci.sys" .\debug.cpp(256) : 0x8278f000 0x00012000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys" .\debug.cpp(256) : 0x8d009000 0x000ff000 "\SystemRoot\system32\DRIVERS vmfdx32.sys" .\debug.cpp(256) : 0x8d108000 0x00018000 "\SystemRoot\system32\DRIVERS\cdrom.sys" .\debug.cpp(256) : 0x8d204000 0x0070a000 "\SystemRoot\system32\DRIVERS vlddmkm.sys" .\debug.cpp(256) : 0x8d90e000 0x0009f000 "\SystemRoot\System32\drivers\dxgkrnl.sys" .\debug.cpp(256) : 0x8d9ad000 0x0000d000 "\SystemRoot\System32\drivers\watchdog.sys" .\debug.cpp(256) : 0x8d9ba000 0x0002e000 "\SystemRoot\system32\DRIVERS\msiscsi.sys" .\debug.cpp(256) : 0x8d9e8000 0x0000b000 "\SystemRoot\system32\DRIVERS\TDI.SYS" .\debug.cpp(256) : 0x8d120000 0x00017000 "\SystemRoot\system32\DRIVERS asl2tp.sys" .\debug.cpp(256) : 0x8d9f3000 0x0000b000 "\SystemRoot\system32\DRIVERS distapi.sys" .\debug.cpp(256) : 0x8d137000 0x00023000 "\SystemRoot\system32\DRIVERS diswan.sys" .\debug.cpp(256) : 0x8d15a000 0x0000f000 "\SystemRoot\system32\DRIVERS aspppoe.sys" .\debug.cpp(256) : 0x8d169000 0x00014000 "\SystemRoot\system32\DRIVERS aspptp.sys" .\debug.cpp(256) : 0x8d17d000 0x00015000 "\SystemRoot\system32\DRIVERS assstp.sys" .\debug.cpp(256) : 0x8d192000 0x00010000 "\SystemRoot\system32\DRIVERS ermdd.sys" .\debug.cpp(256) : 0x8d1a2000 0x0000b000 "\SystemRoot\system32\DRIVERS\kbdclass.sys" .\debug.cpp(256) : 0x8d1ad000 0x0000b000 "\SystemRoot\system32\DRIVERS\mouclass.sys" .\debug.cpp(256) : 0x8d9fe000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys" .\debug.cpp(256) : 0x8d1b8000 0x0002a000 "\SystemRoot\system32\DRIVERS\ks.sys" .\debug.cpp(256) : 0x8d1e2000 0x0000a000 "\SystemRoot\system32\DRIVERS\mssmbios.sys" .\debug.cpp(256) : 0x8d1ec000 0x0000d000 "\SystemRoot\system32\DRIVERS\umbus.sys" .\debug.cpp(256) : 0x827a1000 0x00034000 "\SystemRoot\system32\DRIVERS\usbhub.sys" .\debug.cpp(256) : 0x827d5000 0x00011000 "\SystemRoot\System32\Drivers\NDProxy.SYS" .\debug.cpp(256) : 0x8da06000 0x0020a000 "\SystemRoot\system32\drivers\RTKVHDA.sys" .\debug.cpp(256) : 0x8dc10000 0x0002d000 "\SystemRoot\system32\drivers\portcls.sys" .\debug.cpp(256) : 0x8dc3d000 0x00025000 "\SystemRoot\system32\drivers\drmk.sys" .\debug.cpp(256) : 0x8dc62000 0x00009000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS" .\debug.cpp(256) : 0x8dc6b000 0x00007000 "\SystemRoot\System32\Drivers\Null.SYS" .\debug.cpp(256) : 0x8dc72000 0x00007000 "\SystemRoot\System32\Drivers\Beep.SYS" .\debug.cpp(256) : 0x8dc95000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS" .\debug.cpp(256) : 0x8dc9c000 0x0000c000 "\SystemRoot\System32\drivers\vga.sys" .\debug.cpp(256) : 0x8dca8000 0x00021000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS" .\debug.cpp(256) : 0x8dcc9000 0x00008000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys" .\debug.cpp(256) : 0x8dcd1000 0x00008000 "\SystemRoot\system32\drivers dpencdd.sys" .\debug.cpp(256) : 0x8dcd9000 0x0000b000 "\SystemRoot\System32\Drivers\Msfs.SYS" .\debug.cpp(256) : 0x8dce4000 0x0000e000 "\SystemRoot\System32\Drivers\Npfs.SYS" .\debug.cpp(256) : 0x8dcf2000 0x00009000 "\SystemRoot\System32\DRIVERS asacd.sys" .\debug.cpp(256) : 0x8dcfb000 0x00016000 "\SystemRoot\system32\DRIVERS dx.sys" .\debug.cpp(256) : 0x8dd11000 0x00014000 "\SystemRoot\system32\DRIVERS\smb.sys" .\debug.cpp(256) : 0x8dd25000 0x00048000 "\SystemRoot\system32\drivers\afd.sys" .\debug.cpp(256) : 0x8dd6d000 0x00032000 "\SystemRoot\System32\DRIVERS etbt.sys" .\debug.cpp(256) : 0x8dd9f000 0x00009000 "\SystemRoot\system32\drivers\ws2ifsl.sys" .\debug.cpp(256) : 0x8dda8000 0x00016000 "\SystemRoot\system32\DRIVERS\pacer.sys" .\debug.cpp(256) : 0x8ddbe000 0x0000e000 "\SystemRoot\system32\DRIVERS etbios.sys" .\debug.cpp(256) : 0x8ddcc000 0x00013000 "\SystemRoot\system32\DRIVERS\wanarp.sys" .\debug.cpp(256) : 0x8dddf000 0x00006000 "\SystemRoot\system32\DRIVERS\ssmdrv.sys" .\debug.cpp(256) : 0x8e00a000 0x0003c000 "\SystemRoot\system32\DRIVERS dbss.sys" .\debug.cpp(256) : 0x8e046000 0x0000a000 "\SystemRoot\system32\drivers siproxy.sys" .\debug.cpp(256) : 0x8e050000 0x00017000 "\SystemRoot\System32\Drivers\dfsc.sys" .\debug.cpp(256) : 0x8e067000 0x0001c000 "\SystemRoot\system32\DRIVERS\avipbb.sys" .\debug.cpp(256) : 0x8e083000 0x00002000 "\??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys" .\debug.cpp(256) : 0x8e085000 0x0000d000 "\SystemRoot\System32\Drivers\crashdmp.sys" .\debug.cpp(256) : 0x8e092000 0x0000a000 "\SystemRoot\System32\Drivers\dump_diskdump.sys" .\debug.cpp(256) : 0x8e09c000 0x00025000 "\SystemRoot\System32\Drivers\dump_nvstor32.sys" .\debug.cpp(256) : 0x8e0c1000 0x00009000 "\SystemRoot\system32\DRIVERS\hidusb.sys" .\debug.cpp(256) : 0x8e0ca000 0x00010000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS" .\debug.cpp(256) : 0x8e0da000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS" .\debug.cpp(256) : 0x8e0dc000 0x00008000 "\SystemRoot\system32\DRIVERS\mouhid.sys" .\debug.cpp(256) : 0x8e0e4000 0x00017000 "\SystemRoot\system32\DRIVERS\usbccgp.sys" .\debug.cpp(256) : 0x8e0fb000 0x00012000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS" .\debug.cpp(256) : 0x93ca0000 0x00202000 "\SystemRoot\System32\win32k.sys" .\debug.cpp(256) : 0x8e10d000 0x0000a000 "\SystemRoot\System32\drivers\Dxapi.sys" .\debug.cpp(256) : 0x8e117000 0x00009000 "\SystemRoot\system32\DRIVERS\kbdhid.sys" .\debug.cpp(256) : 0x8e120000 0x0000f000 "\SystemRoot\system32\DRIVERS\monitor.sys" .\debug.cpp(256) : 0x93ec0000 0x00009000 "\SystemRoot\System32\TSDDD.dll" .\debug.cpp(256) : 0x93ee0000 0x0000e000 "\SystemRoot\System32\cdd.dll" .\debug.cpp(256) : 0x93ef0000 0x0004c000 "\SystemRoot\System32\ATMFD.DLL" .\debug.cpp(256) : 0x8e12f000 0x0001b000 "\SystemRoot\system32\drivers\luafv.sys" .\debug.cpp(256) : 0x8e14a000 0x00014000 "\SystemRoot\system32\DRIVERS\avgntflt.sys" .\debug.cpp(256) : 0x9c00d000 0x000af000 "\SystemRoot\system32\drivers\spsys.sys" .\debug.cpp(256) : 0x9c0bc000 0x00010000 "\SystemRoot\system32\DRIVERS\lltdio.sys" .\debug.cpp(256) : 0x9c0cc000 0x00013000 "\SystemRoot\system32\DRIVERS spndr.sys" .\debug.cpp(256) : 0x9c0df000 0x0006d000 "\SystemRoot\system32\drivers\HTTP.sys" .\debug.cpp(256) : 0x9c14c000 0x0001d000 "\SystemRoot\System32\DRIVERS\srvnet.sys" .\debug.cpp(256) : 0x9c169000 0x00019000 "\SystemRoot\system32\DRIVERS\bowser.sys" .\debug.cpp(256) : 0x9c182000 0x00015000 "\SystemRoot\System32\drivers\mpsdrv.sys" .\debug.cpp(256) : 0x9c197000 0x00020000 "\SystemRoot\system32\drivers\mrxdav.sys" .\debug.cpp(256) : 0x9c1b7000 0x0001f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys" .\debug.cpp(256) : 0x8e15e000 0x00039000 "\SystemRoot\system32\DRIVERS\mrxsmb10.sys" .\debug.cpp(256) : 0x9c1d6000 0x00018000 "\SystemRoot\system32\DRIVERS\mrxsmb20.sys" .\debug.cpp(256) : 0x8e197000 0x00027000 "\SystemRoot\System32\DRIVERS\srv2.sys" .\debug.cpp(256) : 0x9e401000 0x0004e000 "\SystemRoot\System32\DRIVERS\srv.sys" .\debug.cpp(256) : 0x9e44f000 0x00007000 "\??\C:\Windows\system32\drivers\int15.sys" .\debug.cpp(256) : 0x9e456000 0x000de000 "\SystemRoot\system32\drivers\peauth.sys" .\debug.cpp(256) : 0x9e534000 0x0000a000 "\SystemRoot\System32\Drivers\secdrv.SYS" .\debug.cpp(256) : 0x9e53e000 0x0000c000 "\SystemRoot\System32\drivers cpipreg.sys" .\debug.cpp(256) : 0x9e54a000 0x00015000 "\SystemRoot\system32\DRIVERS\WUDFRd.sys" .\debug.cpp(256) : 0x9e55f000 0x00012000 "\SystemRoot\system32\DRIVERS\WUDFPf.sys" .\debug.cpp(256) : 0x9e571000 0x00016000 "\SystemRoot\system32\DRIVERS\cdfs.sys" .\debug.cpp(256) : 0x775f0000 0x00127000 "\Windows\System32 tdll.dll" .\debug.cpp(263) : ********************************************** .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] *********** .\debug.cpp(308) : ********************************************** .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a059729b-76ca-11dc-8950-001d72b676c5}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS" .\debug.cpp(400) : Destination="\Device\Ndis" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:" .\debug.cpp(400) : Destination="\Device\RaidPort1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1" .\debug.cpp(400) : Destination="\Device\Video0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000030" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000001" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2" .\debug.cpp(400) : Destination="\Device\Video1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&6342bdf&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination="\Device\USBPDO-1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000031" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{6bdd1fc6-810f-11d0-bec7-08002be2092f}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_00#7&a31f1ed&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\0000005d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3" .\debug.cpp(400) : Destination="\Device\Video2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{368ABA44-F30B-4B9B-B006-B5A2DB131DBF}" .\debug.cpp(400) : Destination="\Device\NDMP10" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E34CD445-D9B5-45AC-8C30-61A9E6C9AE11}" .\debug.cpp(400) : Destination="\Device\NDMP9" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy1" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:" .\debug.cpp(400) : Destination="\Device\Harddisk" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4" .\debug.cpp(400) : Destination="\Device\Video3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgio" .\debug.cpp(400) : Destination="\Device\avgio" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy2" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIAdminDevice" .\debug.cpp(400) : Destination="\Device\WMIAdminDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.00#20060413092100000&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000005b" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tun0" .\debug.cpp(400) : Destination="\Device\Tun0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi4:" .\debug.cpp(400) : Destination="\Device\RaidPort2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{601A5F35-E01E-4A22-A307-3541312908BA}" .\debug.cpp(400) : Destination="\Device\NDMP8" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy3" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VolMgrControl" .\debug.cpp(400) : Destination="\Device\VolMgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0BDA&PID_0151#20060413092100000#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_107#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination="\Device\0000003c" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy4" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset2747305200Length233E75CE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy5" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\F:" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice" .\debug.cpp(400) : Destination="\Device\WMIDataDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SpDevice" .\debug.cpp(400) : Destination="\Device\SpDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&f3b1c94&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination="\Device\USBPDO-0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000002" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy6" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset100000Length500000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PEAuth" .\debug.cpp(400) : Destination="\Device\PEAuth" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgntflt" .\debug.cpp(400) : Destination="\FileSystem\Filters\avgntflt" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy7" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy7" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE" .\debug.cpp(400) : Destination="\Device\NamedPipe" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_Generic-&Prod_SM#xD#SD#MMC#MS&Rev_1.00#20060413092100000&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy8" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy8" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC" .\debug.cpp(400) : Destination="\Device\Mup" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Psched" .\debug.cpp(400) : Destination="\Device\Psched" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_01531025&REV_A2#3&2411e6fe&0&38#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0009" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy9" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy9" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\0000003e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg" .\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgrMsg" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0" .\debug.cpp(400) : Destination="\Device\USBFDO-0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp" .\debug.cpp(400) : Destination="\Device\Tcp" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\00000043" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{6bdd1fc6-810f-11d0-bec7-08002be2092f}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1" .\debug.cpp(400) : Destination="\Device\USBFDO-1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0" .\debug.cpp(400) : Destination="\Device\Harddisk0\DR0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_0040#6&14e46287&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000056" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN" .\debug.cpp(400) : Destination="\DosDevices\LPT1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000002" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\H:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1" .\debug.cpp(400) : Destination="\Device\Harddisk1\DR1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#UMBUS#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000038" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap" .\debug.cpp(400) : Destination="\Device\FsWrap" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive2" .\debug.cpp(400) : Destination="\Device\Harddisk2\DR2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{6ac27878-a6fa-4155-ba85-f98f491d4f33}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&WpdBusEnumRoot#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000061" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000032" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#volmgr#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\00000039" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_WDC_WD32&Prod_00AAJS-22L7A#4&320c5d7d&0&010100#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ISCSIPRT#0000#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\00000004" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global" .\debug.cpp(400) : Destination="\GLOBAL??" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\I:" .\debug.cpp(400) : Destination="\Device\Harddisk" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_DVDRAM_GH40F#4&1f52acd8&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LOG:" .\debug.cpp(400) : Destination="\clfs" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000033" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F1&SUBSYS_CB8410DE&REV_A3#3&2411e6fe&0&10#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0004" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{BE6AF4D2-2E8C-445C-A289-AB07269C6FA6}" .\debug.cpp(400) : Destination="\Device\NDMP2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a0597265-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv" .\debug.cpp(400) : Destination="\Device\Secdrv" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E38947E4-A2A7-40BA-B57C-9BC41B63B78D}" .\debug.cpp(400) : Destination="\Device\NDMP3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000001" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy10" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy10" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\00000042" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_DVDRAM_GH40F#4&1f52acd8&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_01#7&19a54bd5&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\0000005e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_0040#6&14e46287&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\00000056" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy11" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy11" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a0597264-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-4ea95deb-b1ed-11df-b426-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-4ea95deb-b1ed-11df-b426-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-4ea95de6-b1ed-11df-b426-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-4ea95de6-b1ed-11df-b426-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\int15" .\debug.cpp(400) : Destination="\Device\int15" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03D0&SUBSYS_01531025&REV_A2#3&2411e6fe&0&68#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0015" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_045E&PID_0040#5&7f652ae&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000031" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000033" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager" .\debug.cpp(400) : Destination="\Device\MountPointManager" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-4ea95de7-b1ed-11df-b426-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-4ea95de7-b1ed-11df-b426-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ssmctl" .\debug.cpp(400) : Destination="\Device\ssmctl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Nsi" .\debug.cpp(400) : Destination="\Device\Nsi" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp" .\debug.cpp(400) : Destination="\Device\WANARP" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#ACR0062#4&564cef3&0&UID256#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}" .\debug.cpp(400) : Destination="\Device\0000005f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PartmgrControl" .\debug.cpp(400) : Destination="\Device\PartmgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NXTIPSECDevice" .\debug.cpp(400) : Destination="\Device\NXTIPSEC" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#ACR0062#4&564cef3&0&UID256#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}" .\debug.cpp(400) : Destination="\Device\0000005f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{850EA409-FC82-49A7-9DEB-BABC66146CA7}" .\debug.cpp(400) : Destination="\Device\NDMP4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_01531025&REV_A2#3&2411e6fe&0&41#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0011" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&10269dc4&0&1#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\Ide\PciIde0Channel1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WFPDev" .\debug.cpp(400) : Destination="\Device\WFP" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_045E&PID_00DD#5&7f652ae&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP" .\debug.cpp(400) : Destination="\Device\NDMP6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArpV6" .\debug.cpp(400) : Destination="\Device\WANARPV6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:" .\debug.cpp(400) : Destination="\Device\Ide\IdePort0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03D0&SUBSYS_01531025&REV_A2#3&2411e6fe&0&68#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0015" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000060" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_01531025&REV_A2#3&2411e6fe&0&40#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0010" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a05972a8-76ca-11dc-8950-001d72b676c5}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{097b921d-0818-11de-9513-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000032" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&10269dc4&0&0#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\Ide\PciIde0Channel0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan" .\debug.cpp(400) : Destination="\Device\NdisWan" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd" .\debug.cpp(400) : Destination="\Device\AscKmd" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:" .\debug.cpp(400) : Destination="\Device\Ide\IdePort1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_107#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination="\Device\0000003b" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANBH" .\debug.cpp(400) : Destination="\Device\NDMP5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_01531025&REV_A2#3&2411e6fe&0&38#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0009" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F2&SUBSYS_CB8410DE&REV_A3#3&2411e6fe&0&11#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0005" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.00#20060413092100000&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MpsDevice" .\debug.cpp(400) : Destination="\Device\MPS" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr" .\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgr" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{4E1980D9-0414-43CB-9685-1C308F4C2D83}" .\debug.cpp(400) : Destination="\Device\NDMP1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl" .\debug.cpp(400) : Destination="\Device\VolMgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT" .\debug.cpp(400) : Destination="\Device\MailSlot" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX" .\debug.cpp(400) : Destination="\DosDevices\COM1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPV6" .\debug.cpp(400) : Destination="\Device\NDMP7" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT" .\debug.cpp(400) : Destination="" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL" .\debug.cpp(400) : Destination="\Device\Null" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SstpDrv" .\debug.cpp(400) : Destination="\Device\SstpDrv" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000035" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:" .\debug.cpp(400) : Destination="\Device\RaidPort0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic-&Prod_SM#xD#SD#MMC#MS&Rev_1.00#20060413092100000&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000005c" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WfpAle" .\debug.cpp(400) : Destination="\Device\WfpAle" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000034" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a059726b-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset500100000Length2247200000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_00#7&a31f1ed&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\0000005d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avipbb" .\debug.cpp(400) : Destination="\Device\avipbb" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000030" .\debug.cpp(451) : ********************************************** .\boot_cleaner.cpp(1077) : System volume is \.\C: .\boot_cleaner.cpp(1113) : \.\C: -> \.\PhysicalDrive0 at offset 0x00000005'00100000 .\boot_cleaner.cpp(424) : Boot sector MD5 is: d4b876239615e81ab805b6a9431ee920 .\boot_cleaner.cpp(1151) : .\boot_cleaner.cpp(1152) : Size Device Name MBR Status .\boot_cleaner.cpp(1153) : -------------------------------------------- .\boot_cleaner.cpp(1197) : 298 GB \.\PhysicalDrive0 Unknown boot code .\boot_cleaner.cpp(1203) : .\boot_cleaner.cpp(1209) : Unknown boot code has been found on some of your physical disks. .\boot_cleaner.cpp(1211) : To inspect the boot code manually, dump the master boot sector: .\boot_cleaner.cpp(1212) : remover.exe dump [output_file] .\boot_cleaner.cpp(1216) : To disinfect the master boot sector, use the following command: .\boot_cleaner.cpp(1217) : remover.exe fix .\boot_cleaner.cpp(1220) : .\boot_cleaner.cpp(1242) : Done;

Xplode · Answer

# Lancez BTKR_Runbox puis sélectionnez l'option n°3
# Validez en appuyant sur "1" puis [Entrée]
# Le PC redémarrera. Au redémarrage, relancez BTKR_Runbox en sélectionnant l'option n°1 

Puis poste moi le rapport.

miss-crystal · Answer

.\debug.cpp(238) : Debug log started at 27.08.2010 - 15:40:45 .\boot_cleaner.cpp(675) : Bootkit Remover .\boot_cleaner.cpp(676) : (c) 2009 eSage Lab .\boot_cleaner.cpp(677) : www.esagelab.com .\boot_cleaner.cpp(681) : Program version: 1.1.0.0 .\boot_cleaner.cpp(688) : OS Version: Microsoft Windows Vista Home Basic Edition Service Pack 1 (build 6001), 32-bit .\debug.cpp(248) : ********************************************** .\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] *********** .\debug.cpp(250) : ********************************************** .\debug.cpp(256) : 0x81e0d000 0x003b9000 "\SystemRoot\system32 tkrnlpa.exe" .\debug.cpp(256) : 0x821c6000 0x00033000 "\SystemRoot\system32\hal.dll" .\debug.cpp(256) : 0x86b4b000 0x00008000 "\SystemRoot\system32\kdcom.dll" .\debug.cpp(256) : 0x8040e000 0x00011000 "\SystemRoot\system32\PSHED.dll" .\debug.cpp(256) : 0x8041f000 0x00008000 "\SystemRoot\system32\BOOTVID.dll" .\debug.cpp(256) : 0x80427000 0x00041000 "\SystemRoot\system32\CLFS.SYS" .\debug.cpp(256) : 0x80468000 0x000e0000 "\SystemRoot\system32\CI.dll" .\debug.cpp(256) : 0x80548000 0x0007c000 "\SystemRoot\system32\drivers\Wdf01000.sys" .\debug.cpp(256) : 0x805c4000 0x0000d000 "\SystemRoot\system32\drivers\WDFLDR.SYS" .\debug.cpp(256) : 0x80606000 0x00046000 "\SystemRoot\system32\drivers\acpi.sys" .\debug.cpp(256) : 0x8064c000 0x00009000 "\SystemRoot\system32\drivers\WMILIB.SYS" .\debug.cpp(256) : 0x80655000 0x00008000 "\SystemRoot\system32\drivers\msisadrv.sys" .\debug.cpp(256) : 0x8065d000 0x00027000 "\SystemRoot\system32\drivers\pci.sys" .\debug.cpp(256) : 0x80684000 0x0000f000 "\SystemRoot\System32\drivers\partmgr.sys" .\debug.cpp(256) : 0x80693000 0x0000f000 "\SystemRoot\system32\drivers\volmgr.sys" .\debug.cpp(256) : 0x806a2000 0x0004a000 "\SystemRoot\System32\drivers\volmgrx.sys" .\debug.cpp(256) : 0x806ec000 0x00007000 "\SystemRoot\system32\drivers\pciide.sys" .\debug.cpp(256) : 0x806f3000 0x0000e000 "\SystemRoot\system32\drivers\PCIIDEX.SYS" .\debug.cpp(256) : 0x80701000 0x00010000 "\SystemRoot\System32\drivers\mountmgr.sys" .\debug.cpp(256) : 0x80711000 0x00008000 "\SystemRoot\system32\drivers\atapi.sys" .\debug.cpp(256) : 0x80719000 0x0001e000 "\SystemRoot\system32\drivers\ataport.SYS" .\debug.cpp(256) : 0x80737000 0x00025000 "\SystemRoot\system32\DRIVERS vstor32.sys" .\debug.cpp(256) : 0x8075c000 0x00041000 "\SystemRoot\system32\DRIVERS\storport.sys" .\debug.cpp(256) : 0x8079d000 0x00032000 "\SystemRoot\system32\drivers\fltmgr.sys" .\debug.cpp(256) : 0x807cf000 0x00010000 "\SystemRoot\system32\drivers\fileinfo.sys" .\debug.cpp(256) : 0x82405000 0x00071000 "\SystemRoot\System32\Drivers\ksecdd.sys" .\debug.cpp(256) : 0x82476000 0x0010b000 "\SystemRoot\system32\drivers dis.sys" .\debug.cpp(256) : 0x82581000 0x0002b000 "\SystemRoot\system32\drivers\msrpc.sys" .\debug.cpp(256) : 0x825ac000 0x0003a000 "\SystemRoot\system32\drivers\NETIO.SYS" .\debug.cpp(256) : 0x82605000 0x000e9000 "\SystemRoot\System32\drivers cpip.sys" .\debug.cpp(256) : 0x826ee000 0x0001b000 "\SystemRoot\System32\drivers\fwpkclnt.sys" .\debug.cpp(256) : 0x8980e000 0x0010f000 "\SystemRoot\System32\Drivers\Ntfs.sys" .\debug.cpp(256) : 0x8991d000 0x00039000 "\SystemRoot\system32\drivers\volsnap.sys" .\debug.cpp(256) : 0x89956000 0x00008000 "\SystemRoot\System32\Drivers\spldr.sys" .\debug.cpp(256) : 0x8995e000 0x0000f000 "\SystemRoot\System32\Drivers\mup.sys" .\debug.cpp(256) : 0x8996d000 0x00027000 "\SystemRoot\System32\drivers\ecache.sys" .\debug.cpp(256) : 0x89994000 0x00011000 "\SystemRoot\system32\drivers\disk.sys" .\debug.cpp(256) : 0x899a5000 0x00021000 "\SystemRoot\system32\drivers\CLASSPNP.SYS" .\debug.cpp(256) : 0x899c6000 0x00009000 "\SystemRoot\system32\drivers\crcdisk.sys" .\debug.cpp(256) : 0x899e6000 0x0000b000 "\SystemRoot\system32\DRIVERS unnel.sys" .\debug.cpp(256) : 0x899f1000 0x00009000 "\SystemRoot\system32\DRIVERS unmp.sys" .\debug.cpp(256) : 0x8272e000 0x00010000 "\SystemRoot\system32\DRIVERS\amdk8.sys" .\debug.cpp(256) : 0x89800000 0x00009000 "\SystemRoot\system32\DRIVERS\wmiacpi.sys" .\debug.cpp(256) : 0x8273e000 0x0000a000 "\SystemRoot\system32\DRIVERS\usbohci.sys" .\debug.cpp(256) : 0x82748000 0x0003e000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS" .\debug.cpp(256) : 0x82786000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbehci.sys" .\debug.cpp(256) : 0x82795000 0x00012000 "\SystemRoot\system32\DRIVERS\HDAudBus.sys" .\debug.cpp(256) : 0x8d40c000 0x000ff000 "\SystemRoot\system32\DRIVERS vmfdx32.sys" .\debug.cpp(256) : 0x8d50b000 0x00018000 "\SystemRoot\system32\DRIVERS\cdrom.sys" .\debug.cpp(256) : 0x8da0b000 0x0070a000 "\SystemRoot\system32\DRIVERS vlddmkm.sys" .\debug.cpp(256) : 0x8e115000 0x0009f000 "\SystemRoot\System32\drivers\dxgkrnl.sys" .\debug.cpp(256) : 0x8e1b4000 0x0000d000 "\SystemRoot\System32\drivers\watchdog.sys" .\debug.cpp(256) : 0x8e1c1000 0x0002e000 "\SystemRoot\system32\DRIVERS\msiscsi.sys" .\debug.cpp(256) : 0x8e1ef000 0x0000b000 "\SystemRoot\system32\DRIVERS\TDI.SYS" .\debug.cpp(256) : 0x8d523000 0x00017000 "\SystemRoot\system32\DRIVERS asl2tp.sys" .\debug.cpp(256) : 0x8da00000 0x0000b000 "\SystemRoot\system32\DRIVERS distapi.sys" .\debug.cpp(256) : 0x8d53a000 0x00023000 "\SystemRoot\system32\DRIVERS diswan.sys" .\debug.cpp(256) : 0x8d55d000 0x0000f000 "\SystemRoot\system32\DRIVERS aspppoe.sys" .\debug.cpp(256) : 0x8d56c000 0x00014000 "\SystemRoot\system32\DRIVERS aspptp.sys" .\debug.cpp(256) : 0x8d580000 0x00015000 "\SystemRoot\system32\DRIVERS assstp.sys" .\debug.cpp(256) : 0x8d595000 0x00010000 "\SystemRoot\system32\DRIVERS ermdd.sys" .\debug.cpp(256) : 0x8d5a5000 0x0000b000 "\SystemRoot\system32\DRIVERS\kbdclass.sys" .\debug.cpp(256) : 0x8d5b0000 0x0000b000 "\SystemRoot\system32\DRIVERS\mouclass.sys" .\debug.cpp(256) : 0x8e1fa000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys" .\debug.cpp(256) : 0x8d5bb000 0x0002a000 "\SystemRoot\system32\DRIVERS\ks.sys" .\debug.cpp(256) : 0x8d5e5000 0x0000a000 "\SystemRoot\system32\DRIVERS\mssmbios.sys" .\debug.cpp(256) : 0x8d5ef000 0x0000d000 "\SystemRoot\system32\DRIVERS\umbus.sys" .\debug.cpp(256) : 0x827a7000 0x00034000 "\SystemRoot\system32\DRIVERS\usbhub.sys" .\debug.cpp(256) : 0x827db000 0x00011000 "\SystemRoot\System32\Drivers\NDProxy.SYS" .\debug.cpp(256) : 0x8e203000 0x0020a000 "\SystemRoot\system32\drivers\RTKVHDA.sys" .\debug.cpp(256) : 0x8e40d000 0x0002d000 "\SystemRoot\system32\drivers\portcls.sys" .\debug.cpp(256) : 0x8e43a000 0x00025000 "\SystemRoot\system32\drivers\drmk.sys" .\debug.cpp(256) : 0x8e45f000 0x00009000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS" .\debug.cpp(256) : 0x8e468000 0x00007000 "\SystemRoot\System32\Drivers\Null.SYS" .\debug.cpp(256) : 0x8e46f000 0x00007000 "\SystemRoot\System32\Drivers\Beep.SYS" .\debug.cpp(256) : 0x8e492000 0x00007000 "\SystemRoot\system32\DRIVERS\HIDPARSE.SYS" .\debug.cpp(256) : 0x8e499000 0x0000c000 "\SystemRoot\System32\drivers\vga.sys" .\debug.cpp(256) : 0x8e4a5000 0x00021000 "\SystemRoot\System32\drivers\VIDEOPRT.SYS" .\debug.cpp(256) : 0x8e4c6000 0x00008000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys" .\debug.cpp(256) : 0x8e4ce000 0x00008000 "\SystemRoot\system32\drivers dpencdd.sys" .\debug.cpp(256) : 0x8e4d6000 0x0000b000 "\SystemRoot\System32\Drivers\Msfs.SYS" .\debug.cpp(256) : 0x8e4e1000 0x0000e000 "\SystemRoot\System32\Drivers\Npfs.SYS" .\debug.cpp(256) : 0x8e4ef000 0x00009000 "\SystemRoot\System32\DRIVERS asacd.sys" .\debug.cpp(256) : 0x8e4f8000 0x00016000 "\SystemRoot\system32\DRIVERS dx.sys" .\debug.cpp(256) : 0x8e50e000 0x00014000 "\SystemRoot\system32\DRIVERS\smb.sys" .\debug.cpp(256) : 0x8e522000 0x00048000 "\SystemRoot\system32\drivers\afd.sys" .\debug.cpp(256) : 0x8e56a000 0x00032000 "\SystemRoot\System32\DRIVERS etbt.sys" .\debug.cpp(256) : 0x8e59c000 0x00009000 "\SystemRoot\system32\drivers\ws2ifsl.sys" .\debug.cpp(256) : 0x8e5a5000 0x00016000 "\SystemRoot\system32\DRIVERS\pacer.sys" .\debug.cpp(256) : 0x8e5bb000 0x0000e000 "\SystemRoot\system32\DRIVERS etbios.sys" .\debug.cpp(256) : 0x8e5c9000 0x00013000 "\SystemRoot\system32\DRIVERS\wanarp.sys" .\debug.cpp(256) : 0x8e5dc000 0x00006000 "\SystemRoot\system32\DRIVERS\ssmdrv.sys" .\debug.cpp(256) : 0x8d600000 0x0003c000 "\SystemRoot\system32\DRIVERS dbss.sys" .\debug.cpp(256) : 0x8d63c000 0x0000a000 "\SystemRoot\system32\drivers siproxy.sys" .\debug.cpp(256) : 0x8d646000 0x00017000 "\SystemRoot\System32\Drivers\dfsc.sys" .\debug.cpp(256) : 0x8d65d000 0x0001c000 "\SystemRoot\system32\DRIVERS\avipbb.sys" .\debug.cpp(256) : 0x8d679000 0x00002000 "\??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys" .\debug.cpp(256) : 0x8d67b000 0x0000d000 "\SystemRoot\System32\Drivers\crashdmp.sys" .\debug.cpp(256) : 0x8d688000 0x0000a000 "\SystemRoot\System32\Drivers\dump_diskdump.sys" .\debug.cpp(256) : 0x8d692000 0x00025000 "\SystemRoot\System32\Drivers\dump_nvstor32.sys" .\debug.cpp(256) : 0x8d6b7000 0x00009000 "\SystemRoot\system32\DRIVERS\hidusb.sys" .\debug.cpp(256) : 0x8d6c0000 0x00010000 "\SystemRoot\system32\DRIVERS\HIDCLASS.SYS" .\debug.cpp(256) : 0x8d6d0000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS" .\debug.cpp(256) : 0x8d6d2000 0x00008000 "\SystemRoot\system32\DRIVERS\mouhid.sys" .\debug.cpp(256) : 0x8d6da000 0x00017000 "\SystemRoot\system32\DRIVERS\usbccgp.sys" .\debug.cpp(256) : 0x8d6f1000 0x00012000 "\SystemRoot\system32\DRIVERS\USBSTOR.SYS" .\debug.cpp(256) : 0x8d703000 0x00009000 "\SystemRoot\system32\DRIVERS\kbdhid.sys" .\debug.cpp(256) : 0x91230000 0x00202000 "\SystemRoot\System32\win32k.sys" .\debug.cpp(256) : 0x8d70c000 0x0000a000 "\SystemRoot\System32\drivers\Dxapi.sys" .\debug.cpp(256) : 0x8d716000 0x0000f000 "\SystemRoot\system32\DRIVERS\monitor.sys" .\debug.cpp(256) : 0x91450000 0x00009000 "\SystemRoot\System32\TSDDD.dll" .\debug.cpp(256) : 0x91470000 0x0004c000 "\SystemRoot\System32\ATMFD.DLL" .\debug.cpp(256) : 0x914c0000 0x0000e000 "\SystemRoot\System32\cdd.dll" .\debug.cpp(256) : 0x8d725000 0x0001b000 "\SystemRoot\system32\drivers\luafv.sys" .\debug.cpp(256) : 0x8d740000 0x00014000 "\SystemRoot\system32\DRIVERS\avgntflt.sys" .\debug.cpp(256) : 0x9c40f000 0x000af000 "\SystemRoot\system32\drivers\spsys.sys" .\debug.cpp(256) : 0x9c4be000 0x00010000 "\SystemRoot\system32\DRIVERS\lltdio.sys" .\debug.cpp(256) : 0x9c4ce000 0x00013000 "\SystemRoot\system32\DRIVERS spndr.sys" .\debug.cpp(256) : 0x9c4e1000 0x0006d000 "\SystemRoot\system32\drivers\HTTP.sys" .\debug.cpp(256) : 0x9c54e000 0x0001d000 "\SystemRoot\System32\DRIVERS\srvnet.sys" .\debug.cpp(256) : 0x9c56b000 0x00019000 "\SystemRoot\system32\DRIVERS\bowser.sys" .\debug.cpp(256) : 0x9c584000 0x00015000 "\SystemRoot\System32\drivers\mpsdrv.sys" .\debug.cpp(256) : 0x9c599000 0x00020000 "\SystemRoot\system32\drivers\mrxdav.sys" .\debug.cpp(256) : 0x9c5b9000 0x0001f000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys" .\debug.cpp(256) : 0x8d754000 0x00039000 "\SystemRoot\system32\DRIVERS\mrxsmb10.sys" .\debug.cpp(256) : 0x9c5d8000 0x00018000 "\SystemRoot\system32\DRIVERS\mrxsmb20.sys" .\debug.cpp(256) : 0x8d78d000 0x00027000 "\SystemRoot\System32\DRIVERS\srv2.sys" .\debug.cpp(256) : 0x9ea01000 0x0004e000 "\SystemRoot\System32\DRIVERS\srv.sys" .\debug.cpp(256) : 0x9ea4f000 0x00007000 "\??\C:\Windows\system32\drivers\int15.sys" .\debug.cpp(256) : 0x9ea56000 0x000de000 "\SystemRoot\system32\drivers\peauth.sys" .\debug.cpp(256) : 0x9eb34000 0x0000a000 "\SystemRoot\System32\Drivers\secdrv.SYS" .\debug.cpp(256) : 0x9eb3e000 0x0000c000 "\SystemRoot\System32\drivers cpipreg.sys" .\debug.cpp(256) : 0x9eb4a000 0x00015000 "\SystemRoot\system32\DRIVERS\WUDFRd.sys" .\debug.cpp(256) : 0x9eb5f000 0x00012000 "\SystemRoot\system32\DRIVERS\WUDFPf.sys" .\debug.cpp(256) : 0x9eb71000 0x00016000 "\SystemRoot\system32\DRIVERS\cdfs.sys" .\debug.cpp(256) : 0x77820000 0x00127000 "\Windows\System32 tdll.dll" .\debug.cpp(263) : ********************************************** .\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] *********** .\debug.cpp(308) : ********************************************** .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a059729b-76ca-11dc-8950-001d72b676c5}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS" .\debug.cpp(400) : Destination="\Device\Ndis" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi3:" .\debug.cpp(400) : Destination="\Device\RaidPort1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1" .\debug.cpp(400) : Destination="\Device\Video0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000030" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000001" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2" .\debug.cpp(400) : Destination="\Device\Video1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&6342bdf&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination="\Device\USBPDO-1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000031" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{6bdd1fc6-810f-11d0-bec7-08002be2092f}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_00#7&a31f1ed&0&0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\0000005d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3" .\debug.cpp(400) : Destination="\Device\Video2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{368ABA44-F30B-4B9B-B006-B5A2DB131DBF}" .\debug.cpp(400) : Destination="\Device\NDMP10" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E34CD445-D9B5-45AC-8C30-61A9E6C9AE11}" .\debug.cpp(400) : Destination="\Device\NDMP9" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy1" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\E:" .\debug.cpp(400) : Destination="\Device\Harddisk" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{6ac27878-a6fa-4155-ba85-f98f491d4f33}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4" .\debug.cpp(400) : Destination="\Device\Video3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgio" .\debug.cpp(400) : Destination="\Device\avgio" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy2" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIAdminDevice" .\debug.cpp(400) : Destination="\Device\WMIAdminDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tun0" .\debug.cpp(400) : Destination="\Device\Tun0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.00#20060413092100000&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000005b" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi4:" .\debug.cpp(400) : Destination="\Device\RaidPort2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{86841137-ed8e-4d97-9975-f2ed56b4430e}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{601A5F35-E01E-4A22-A307-3541312908BA}" .\debug.cpp(400) : Destination="\Device\NDMP8" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy3" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\VolMgrControl" .\debug.cpp(400) : Destination="\Device\VolMgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_0BDA&PID_0151#20060413092100000#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_107#_1#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination="\Device\0000003c" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy4" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset2747305200Length233E75CE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy5" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\F:" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice" .\debug.cpp(400) : Destination="\Device\WMIDataDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SpDevice" .\debug.cpp(400) : Destination="\Device\SpDevice" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&f3b1c94&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}" .\debug.cpp(400) : Destination="\Device\USBPDO-0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000002" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy6" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset100000Length500000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PEAuth" .\debug.cpp(400) : Destination="\Device\PEAuth" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avgntflt" .\debug.cpp(400) : Destination="\FileSystem\Filters\avgntflt" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy7" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy7" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE" .\debug.cpp(400) : Destination="\Device\NamedPipe" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_Generic-&Prod_SM#xD#SD#MMC#MS&Rev_1.00#20060413092100000&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy8" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy8" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\G:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC" .\debug.cpp(400) : Destination="\Device\Mup" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Psched" .\debug.cpp(400) : Destination="\Device\Psched" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_01531025&REV_A2#3&2411e6fe&0&38#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0009" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy9" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy9" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\0000003e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg" .\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgrMsg" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0" .\debug.cpp(400) : Destination="\Device\USBFDO-0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp" .\debug.cpp(400) : Destination="\Device\Tcp" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#FixedButton#2&daba3ff&2#{4afa3d53-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\00000043" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD#SD#MMC#MS&REV_1.00#20060413092100000&1##{6bdd1fc6-810f-11d0-bec7-08002be2092f}" .\debug.cpp(400) : Destination="\Device\00000063" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{dda54a40-1e4c-11d1-a050-405705c10000}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1" .\debug.cpp(400) : Destination="\Device\USBFDO-1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0" .\debug.cpp(400) : Destination="\Device\Harddisk0\DR0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_0040#6&14e46287&0&0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000056" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN" .\debug.cpp(400) : Destination="\DosDevices\LPT1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*TUNMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000002" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\H:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive1" .\debug.cpp(400) : Destination="\Device\Harddisk1\DR1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#UMBUS#0000#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000038" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap" .\debug.cpp(400) : Destination="\Device\FsWrap" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{6ac27878-a6fa-4155-ba85-f98f491d4f33}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive2" .\debug.cpp(400) : Destination="\Device\Harddisk2\DR2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&WpdBusEnumRoot#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000061" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000032" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#volmgr#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\00000039" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#Disk&Ven_WDC_WD32&Prod_00AAJS-22L7A#4&320c5d7d&0&010100#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANBH#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ISCSIPRT#0000#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\00000004" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global" .\debug.cpp(400) : Destination="\GLOBAL??" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_DVDRAM_GH40F#4&1f52acd8&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-23c108e5-b1f1-11df-874d-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-23c108e5-b1f1-11df-874d-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\LOG:" .\debug.cpp(400) : Destination="\clfs" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000033" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F1&SUBSYS_CB8410DE&REV_A3#3&2411e6fe&0&10#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0004" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{BE6AF4D2-2E8C-445C-A289-AB07269C6FA6}" .\debug.cpp(400) : Destination="\Device\NDMP2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a0597265-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Secdrv" .\debug.cpp(400) : Destination="\Device\Secdrv" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E38947E4-A2A7-40BA-B57C-9BC41B63B78D}" .\debug.cpp(400) : Destination="\Device\NDMP3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#*ISATAP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000001" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy10" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy10" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THRM#{4afa3d51-74a7-11d0-be5e-00a0c9062857}" .\debug.cpp(400) : Destination="\Device\00000042" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SCSI#CdRom&Ven_HL-DT-ST&Prod_DVDRAM_GH40F#4&1f52acd8&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000004f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_01#7&19a54bd5&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\0000005e" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_0040#6&14e46287&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\00000056" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HarddiskVolumeShadowCopy11" .\debug.cpp(400) : Destination="\Device\HarddiskVolumeShadowCopy11" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a0597264-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-23c108e7-b1f1-11df-874d-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-23c108e7-b1f1-11df-874d-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\int15" .\debug.cpp(400) : Destination="\Device\int15" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03D0&SUBSYS_01531025&REV_A2#3&2411e6fe&0&68#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0015" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_045E&PID_0040#5&7f652ae&0&4#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000031" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_SSTPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\00000033" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager" .\debug.cpp(400) : Destination="\Device\MountPointManager" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ssmctl" .\debug.cpp(400) : Destination="\Device\ssmctl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\0000002d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp" .\debug.cpp(400) : Destination="\Device\WANARP" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Nsi" .\debug.cpp(400) : Destination="\Device\Nsi" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#ACR0062#4&564cef3&0&UID256#{e6f07b5f-ee97-4a90-b076-33f57bf4eaa7}" .\debug.cpp(400) : Destination="\Device\0000005f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PartmgrControl" .\debug.cpp(400) : Destination="\Device\PartmgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NXTIPSECDevice" .\debug.cpp(400) : Destination="\Device\NXTIPSEC" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY#ACR0062#4&564cef3&0&UID256#{866519b5-3f07-4c97-b7df-24c5d8a8ccb8}" .\debug.cpp(400) : Destination="\Device\0000005f" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{cac88484-7515-4c03-82e6-71a87abac361}" .\debug.cpp(400) : Destination="\Device\0000002d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{850EA409-FC82-49A7-9DEB-BABC66146CA7}" .\debug.cpp(400) : Destination="\Device\NDMP4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_01531025&REV_A2#3&2411e6fe&0&41#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0011" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&10269dc4&0&1#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\Ide\PciIde0Channel1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WFPDev" .\debug.cpp(400) : Destination="\Device\WFP" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#VID_045E&PID_00DD#5&7f652ae&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}" .\debug.cpp(400) : Destination="\Device\USBPDO-3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP" .\debug.cpp(400) : Destination="\Device\NDMP6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArpV6" .\debug.cpp(400) : Destination="\Device\WANARPV6" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:" .\debug.cpp(400) : Destination="\Device\Ide\IdePort0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMB#UMB#1&841921d&0&PrinterBusEnumerator#{65a9a6cf-64cd-480b-843e-32c86e1ba19f}" .\debug.cpp(400) : Destination="\Device\00000060" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03D0&SUBSYS_01531025&REV_A2#3&2411e6fe&0&68#{1ca05180-a699-450a-9a0c-de4fbe3ddd89}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0015" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F6&SUBSYS_01531025&REV_A2#3&2411e6fe&0&40#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0010" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a05972a8-76ca-11dc-8950-001d72b676c5}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{097b921d-0818-11de-9513-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume3" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}" .\debug.cpp(400) : Destination="\Device\00000036" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000032" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCIIDE#IDEChannel#4&10269dc4&0&0#{2accfe60-c130-11d2-b082-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\Ide\PciIde0Channel0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan" .\debug.cpp(400) : Destination="\Device\NdisWan" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\UMDFCtrlDev-23c108eb-b1f1-11df-874d-001d72b676c5" .\debug.cpp(400) : Destination="\Device\UMDFCtrlDev-23c108eb-b1f1-11df-874d-001d72b676c5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AscKmd" .\debug.cpp(400) : Destination="\Device\AscKmd" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:" .\debug.cpp(400) : Destination="\Device\Ide\IdePort1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#AuthenticAMD_-_x86_Family_15_Model_107#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}" .\debug.cpp(400) : Destination="\Device\0000003b" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANBH" .\debug.cpp(400) : Destination="\Device\NDMP5" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03EF&SUBSYS_01531025&REV_A2#3&2411e6fe&0&38#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0009" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_10DE&DEV_03F2&SUBSYS_CB8410DE&REV_A3#3&2411e6fe&0&11#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}" .\debug.cpp(400) : Destination="\Device\NTPNP_PCI0005" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&_??_USBSTOR#Disk&Ven_Generic-&Prod_Compact_Flash&Rev_1.00#20060413092100000&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume4" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MpsDevice" .\debug.cpp(400) : Destination="\Device\MPS" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#20060413092100000&0##{f33fdc04-d1ac-4e8e-9a30-19bbd4b108ae}" .\debug.cpp(400) : Destination="\Device\00000062" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr" .\debug.cpp(400) : Destination="\FileSystem\Filters\FltMgr" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\{4E1980D9-0414-43CB-9685-1C308F4C2D83}" .\debug.cpp(400) : Destination="\Device\NDMP1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl" .\debug.cpp(400) : Destination="\Device\VolMgrControl" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT" .\debug.cpp(400) : Destination="\Device\MailSlot" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX" .\debug.cpp(400) : Destination="\DosDevices\COM1" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIPV6" .\debug.cpp(400) : Destination="\Device\NDMP7" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL" .\debug.cpp(400) : Destination="\Device\Null" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT" .\debug.cpp(400) : Destination="" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\SstpDrv" .\debug.cpp(400) : Destination="\Device\SstpDrv" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000035" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi2:" .\debug.cpp(400) : Destination="\Device\RaidPort0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HDAUDIO#FUNC_01&VEN_10EC&DEV_0888&SUBSYS_10250157&REV_1002#4&150fe0ac&0&0001#{eb115ffc-10c8-4964-831d-6dcb02e6f23f}" .\debug.cpp(400) : Destination="\Device\00000054" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\USBSTOR#Disk&Ven_Generic-&Prod_SM#xD#SD#MMC#MS&Rev_1.00#20060413092100000&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\0000005c" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\WfpAle" .\debug.cpp(400) : Destination="\Device\WfpAle" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}" .\debug.cpp(400) : Destination="\Device\00000034" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{a059726b-76ca-11dc-8950-806e6f6e6963}" .\debug.cpp(400) : Destination="\Device\CdRom0" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&19f7e59c&0&Signature643CA784Offset500100000Length2247200000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" .\debug.cpp(400) : Destination="\Device\HarddiskVolume2" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\HID#VID_045E&PID_00DD&MI_00#7&a31f1ed&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030}" .\debug.cpp(400) : Destination="\Device\0000005d" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\avipbb" .\debug.cpp(400) : Destination="\Device\avipbb" .\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIPV6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}" .\debug.cpp(400) : Destination="\Device\00000030" .\debug.cpp(451) : ********************************************** .\boot_cleaner.cpp(1077) : System volume is \.\C: .\boot_cleaner.cpp(1113) : \.\C: -> \.\PhysicalDrive0 at offset 0x00000005'00100000 .\boot_cleaner.cpp(424) : Boot sector MD5 is: d4b876239615e81ab805b6a9431ee920 .\boot_cleaner.cpp(1151) : .\boot_cleaner.cpp(1152) : Size Device Name MBR Status .\boot_cleaner.cpp(1153) : -------------------------------------------- .\boot_cleaner.cpp(1197) : 298 GB \.\PhysicalDrive0 Unknown boot code .\boot_cleaner.cpp(1203) : .\boot_cleaner.cpp(1209) : Unknown boot code has been found on some of your physical disks. .\boot_cleaner.cpp(1211) : To inspect the boot code manually, dump the master boot sector: .\boot_cleaner.cpp(1212) : remover.exe dump [output_file] .\boot_cleaner.cpp(1216) : To disinfect the master boot sector, use the following command: .\boot_cleaner.cpp(1217) : remover.exe fix .\boot_cleaner.cpp(1220) : .\boot_cleaner.cpp(1242) : Done;

Xplode · Answer

Rien à faire il veut pas partir ! Fais ceci : -+-+-+-+-> ZHPFix <-+-+-+-+- /!\ Utilisateurs de vista/7 , cette manipulation est à effectuer en tant qu'administrateur ( Clic droit -> [Exécuter en tant qu'administrateur] ) /!\ [x] Copie le texte en gras ci-dessous ( CTRL + C pour copier ) R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643 O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMP\rere.tmp\svchost.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMP\rere.tmp\svchost.exe (.not file.) O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe O64 - Services: CurCS - (.not file.) - csvjeikupwyviqk (csvjeikupwyviqk) .(.Pas de propriétaire - Pas de description.) - LEGACY_CSVJEIKUPWYVIQK O64 - Services: CurCS - (.not file.) - ufngede (ufngede) .(.Pas de propriétaire - Pas de description.) - LEGACY_UFNGEDE SS - | Auto 17/09/2008 0 | (PEVSystemStart) . (.Pas de propriétaire.) - C:\ComboFix\PEV.cfxxe exeC \i C:\ComboFix\HIDEC.exe O23 - Service: (PEVSystemStart) . (.Pas de propriétaire - Pas de description.) - C:\ComboFix\PEV.cfxxe exeC \i C:\ComboFix\HIDEC.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = [x] Lance ZHPFix qui est présent sur ton bureau. [x] Clique sur le "H" bleu ( Coller les lignes Helper ) [x] Les lignes précédemment copiées apparaîtront à l'écran dans l'encadré jaune pâle. [x] Vérifie que seules les lignes indiquées plus haut sont présentes puis clique sur [Ok] [x] Clique maintenant sur [Tous] , puis sur [Nettoyer] [x] Copie/Colle le contenu du rapport à l'écran dans ton prochain message. [x] Note : le rapport se trouve également sous C:\Program Files\ZHPDiag\ZHPFixReport.txt Puis Relance TDSSKiller et poste moi le rapport.

miss-crystal · Answer

2010/08/27 17:50:57.0118	TDSS rootkit removing tool 2.4.1.3 Aug 27 2010 08:53:42
2010/08/27 17:50:57.0118	================================================================================
2010/08/27 17:50:57.0118	SystemInfo:
2010/08/27 17:50:57.0118	
2010/08/27 17:50:57.0118	OS Version: 6.0.6001 ServicePack: 1.0
2010/08/27 17:50:57.0118	Product type: Workstation
2010/08/27 17:50:57.0118	ComputerName: PC-DE-CALLIWEB
2010/08/27 17:50:57.0120	UserName: CalliWeb
2010/08/27 17:50:57.0120	Windows directory: C:\Windows
2010/08/27 17:50:57.0120	System windows directory: C:\Windows
2010/08/27 17:50:57.0120	Processor architecture: Intel x86
2010/08/27 17:50:57.0120	Number of processors: 2
2010/08/27 17:50:57.0120	Page size: 0x1000
2010/08/27 17:50:57.0120	Boot type: Normal boot
2010/08/27 17:50:57.0120	================================================================================
2010/08/27 17:50:57.0437	Initialize success
2010/08/27 17:51:00.0135	================================================================================
2010/08/27 17:51:00.0135	Scan started
2010/08/27 17:51:00.0135	Mode: Manual;
2010/08/27 17:51:00.0135	================================================================================
2010/08/27 17:51:00.0390	ACPI            (fcb8c7210f0135e24c6580f7f649c73c) C:\Windows\system32\drivers\acpi.sys
2010/08/27 17:51:00.0444	adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2010/08/27 17:51:00.0476	adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2010/08/27 17:51:00.0516	adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2010/08/27 17:51:00.0543	adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2010/08/27 17:51:00.0670	AFD             (763e172a55177e478cb419f88fd0ba03) C:\Windows\system32\drivers\afd.sys
2010/08/27 17:51:00.0754	agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2010/08/27 17:51:00.0821	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2010/08/27 17:51:00.0879	aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2010/08/27 17:51:00.0905	amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2010/08/27 17:51:00.0922	amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2010/08/27 17:51:00.0947	AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2010/08/27 17:51:00.0973	AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
2010/08/27 17:51:01.0079	arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2010/08/27 17:51:01.0118	arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2010/08/27 17:51:01.0139	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/27 17:51:01.0167	atapi           (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys
2010/08/27 17:51:01.0259	avgio           (f1d43170fdd7399ee17ea32d4f868b0c) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2010/08/27 17:51:01.0389	avgntflt        (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2010/08/27 17:51:01.0516	avipbb          (ad9bd66a862116e79cb45bb6be46055f) C:\Windows\system32\DRIVERS\avipbb.sys
2010/08/27 17:51:01.0594	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2010/08/27 17:51:01.0640	blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2010/08/27 17:51:01.0706	bowser          (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2010/08/27 17:51:01.0757	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2010/08/27 17:51:01.0782	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2010/08/27 17:51:01.0815	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2010/08/27 17:51:01.0840	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2010/08/27 17:51:01.0866	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2010/08/27 17:51:01.0889	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2010/08/27 17:51:01.0918	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2010/08/27 17:51:02.0044	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/08/27 17:51:02.0103	cdrom           (1ec25cea0de6ac4718bf89f9e1778b57) C:\Windows\system32\DRIVERS\cdrom.sys
2010/08/27 17:51:02.0129	circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2010/08/27 17:51:02.0181	CLFS            (465745561c832b29f7c48b488aab3842) C:\Windows\system32\CLFS.sys
2010/08/27 17:51:02.0212	cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2010/08/27 17:51:02.0238	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\drivers\compbatt.sys
2010/08/27 17:51:02.0276	crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2010/08/27 17:51:02.0306	Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2010/08/27 17:51:02.0354	DfsC            (9e635ae5e8ad93e2b5989e2e23679f97) C:\Windows\system32\Drivers\dfsc.sys
2010/08/27 17:51:02.0427	disk            (64109e623abd6955c8fb110b592e68b7) C:\Windows\system32\drivers\disk.sys
2010/08/27 17:51:02.0556	driverhardwarev2 (c0bf8cd94c88b34fb324f4bd6dae544d) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
2010/08/27 17:51:02.0638	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2010/08/27 17:51:02.0677	DXGKrnl         (85f33880b8cfb554bd3d9ccdb486845a) C:\Windows\System32\drivers\dxgkrnl.sys
2010/08/27 17:51:02.0748	E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2010/08/27 17:51:02.0811	Ecache          (dd2cd259d83d8b72c02c5f2331ff9d68) C:\Windows\system32\drivers\ecache.sys
2010/08/27 17:51:02.0839	elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2010/08/27 17:51:02.0896	ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2010/08/27 17:51:02.0979	exfat           (0d858eb20589a34efb25695acaa6aa2d) C:\Windows\system32\drivers\exfat.sys
2010/08/27 17:51:03.0004	fastfat         (3c489390c2e2064563727752af8eab9e) C:\Windows\system32\drivers\fastfat.sys
2010/08/27 17:51:03.0023	fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2010/08/27 17:51:03.0061	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2010/08/27 17:51:03.0083	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2010/08/27 17:51:03.0121	flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/27 17:51:03.0151	FltMgr          (05ea53afe985443011e36dab07343b46) C:\Windows\system32\drivers\fltmgr.sys
2010/08/27 17:51:03.0177	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2010/08/27 17:51:03.0203	gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2010/08/27 17:51:03.0254	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
2010/08/27 17:51:03.0291	HDAudBus        (c87b1ee051c0464491c1a7b03fa0bc99) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/27 17:51:03.0314	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2010/08/27 17:51:03.0332	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2010/08/27 17:51:03.0353	HidUsb          (854ca287ab7faf949617a788306d967e) C:\Windows\system32\DRIVERS\hidusb.sys
2010/08/27 17:51:03.0382	HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2010/08/27 17:51:03.0459	HTTP            (33b02459e86d0a2b86a6b9fe19139390) C:\Windows\system32\drivers\HTTP.sys
2010/08/27 17:51:03.0486	i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2010/08/27 17:51:03.0523	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/27 17:51:03.0550	iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2010/08/27 17:51:03.0580	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2010/08/27 17:51:03.0615	int15           (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Windows\system32\drivers\int15.sys
2010/08/27 17:51:03.0694	IntcAzAudAddService (58628f232a00a3149d7cc7708c521499) C:\Windows\system32\drivers\RTKVHDA.sys
2010/08/27 17:51:03.0752	intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2010/08/27 17:51:03.0770	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2010/08/27 17:51:03.0795	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/27 17:51:03.0836	IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2010/08/27 17:51:03.0857	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2010/08/27 17:51:03.0877	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2010/08/27 17:51:03.0901	isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2010/08/27 17:51:03.0927	iScsiPrt        (f247eec28317f6c739c16de420097301) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/27 17:51:03.0951	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2010/08/27 17:51:03.0966	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2010/08/27 17:51:03.0991	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/27 17:51:04.0027	kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/27 17:51:04.0059	KSecDD          (7a0cf7908b6824d6a2a1d313e5ae3dca) C:\Windows\system32\Drivers\ksecdd.sys
2010/08/27 17:51:04.0108	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/08/27 17:51:04.0146	LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2010/08/27 17:51:04.0169	LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2010/08/27 17:51:04.0188	LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2010/08/27 17:51:04.0212	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2010/08/27 17:51:04.0259	megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2010/08/27 17:51:04.0308	MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2010/08/27 17:51:04.0334	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2010/08/27 17:51:04.0362	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2010/08/27 17:51:04.0398	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2010/08/27 17:51:04.0423	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2010/08/27 17:51:04.0446	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2010/08/27 17:51:04.0472	mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2010/08/27 17:51:04.0493	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2010/08/27 17:51:04.0516	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2010/08/27 17:51:04.0530	MRxDAV          (ae3de84536b6799d2267443cec8edbb9) C:\Windows\system32\drivers\mrxdav.sys
2010/08/27 17:51:04.0570	mrxsmb          (7afc42e60432fd1014f5342f2b1b1f74) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/27 17:51:04.0591	mrxsmb10        (8a75752ae17924f65452746674b14b78) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/27 17:51:04.0617	mrxsmb20        (f4d0f3252e651f02be64984ffa738394) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/27 17:51:04.0653	msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2010/08/27 17:51:04.0674	msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2010/08/27 17:51:04.0702	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2010/08/27 17:51:04.0729	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2010/08/27 17:51:04.0777	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2010/08/27 17:51:04.0794	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/27 17:51:04.0815	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2010/08/27 17:51:04.0840	MsRPC           (b5614aecb05a9340aa0fb55bf561cc63) C:\Windows\system32\drivers\MsRPC.sys
2010/08/27 17:51:04.0861	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/27 17:51:04.0900	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2010/08/27 17:51:04.0921	Mup             (6dfd1d322de55b0b7db7d21b90bec49c) C:\Windows\system32\Drivers\mup.sys
2010/08/27 17:51:04.0959	NativeWifiP     (3c21ce48ff529bb73dadb98770b54025) C:\Windows\system32\DRIVERS
wifi.sys
2010/08/27 17:51:04.0995	NDIS            (9bdc71790fa08f0a0b5f10462b1bd0b1) C:\Windows\system32\drivers
dis.sys
2010/08/27 17:51:05.0016	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS
distapi.sys
2010/08/27 17:51:05.0041	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS
disuio.sys
2010/08/27 17:51:05.0062	NdisWan         (3d14c3b3496f88890d431e8aa022a411) C:\Windows\system32\DRIVERS
diswan.sys
2010/08/27 17:51:05.0085	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2010/08/27 17:51:05.0129	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS
etbios.sys
2010/08/27 17:51:05.0157	netbt           (7c5fee5b1c5728507cd96fb4a13e7a02) C:\Windows\system32\DRIVERS
etbt.sys
2010/08/27 17:51:05.0207	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers
frd960.sys
2010/08/27 17:51:05.0226	Npfs            (ecb5003f484f9ed6c608d6d6c7886cbb) C:\Windows\system32\drivers\Npfs.sys
2010/08/27 17:51:05.0263	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers
siproxy.sys
2010/08/27 17:51:05.0315	Ntfs            (b4effe29eb4f15538fd8a9681108492d) C:\Windows\system32\drivers\Ntfs.sys
2010/08/27 17:51:05.0356	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers
trigdigi.sys
2010/08/27 17:51:05.0376	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2010/08/27 17:51:05.0431	NVENETFD        (c39ad3b818502edfa4b819148b72a0e3) C:\Windows\system32\DRIVERS
vmfdx32.sys
2010/08/27 17:51:05.0588	nvlddmkm        (00832a21237ba36901b5a3e499f2e197) C:\Windows\system32\DRIVERS
vlddmkm.sys
2010/08/27 17:51:05.0653	nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers
vraid.sys
2010/08/27 17:51:05.0680	nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers
vstor.sys
2010/08/27 17:51:05.0710	nvstor32        (d05f6e26ac960474494356fe703d61be) C:\Windows\system32\DRIVERS
vstor32.sys
2010/08/27 17:51:05.0742	nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers
v_agp.sys
2010/08/27 17:51:05.0798	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
2010/08/27 17:51:05.0845	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2010/08/27 17:51:05.0880	partmgr         (3b38467e7c3daed009dfe359e17f139f) C:\Windows\system32\drivers\partmgr.sys
2010/08/27 17:51:05.0907	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2010/08/27 17:51:05.0936	pci             (01b94418deb235dff777cc80076354b4) C:\Windows\system32\drivers\pci.sys
2010/08/27 17:51:05.0965	pciide          (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2010/08/27 17:51:05.0994	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2010/08/27 17:51:06.0036	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2010/08/27 17:51:06.0116	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERSaspptp.sys
2010/08/27 17:51:06.0138	Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2010/08/27 17:51:06.0179	PSched          (bfef604508a0ed1eae2a73e872555ffb) C:\Windows\system32\DRIVERS\pacer.sys
2010/08/27 17:51:06.0227	ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2010/08/27 17:51:06.0257	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2010/08/27 17:51:06.0300	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2010/08/27 17:51:06.0327	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERSasacd.sys
2010/08/27 17:51:06.0355	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERSasl2tp.sys
2010/08/27 17:51:06.0376	RasPppoe        (3e9d9b048107b40d87b97df2e48e0744) C:\Windows\system32\DRIVERSaspppoe.sys
2010/08/27 17:51:06.0397	RasSstp         (a7d141684e9500ac928a772ed8e6b671) C:\Windows\system32\DRIVERSassstp.sys
2010/08/27 17:51:06.0424	rdbss           (6e1c5d0457622f9ee35f683110e93d14) C:\Windows\system32\DRIVERSdbss.sys
2010/08/27 17:51:06.0446	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/27 17:51:06.0479	rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\driversdpdr.sys
2010/08/27 17:51:06.0508	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\driversdpencdd.sys
2010/08/27 17:51:06.0538	RDPWD           (e1c18f4097a5abcec941dc4b2f99db7e) C:\Windows\system32\drivers\RDPWD.sys
2010/08/27 17:51:06.0593	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERSspndr.sys
2010/08/27 17:51:06.0623	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2010/08/27 17:51:06.0679	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/08/27 17:51:06.0733	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2010/08/27 17:51:06.0787	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2010/08/27 17:51:06.0810	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2010/08/27 17:51:06.0849	sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
2010/08/27 17:51:06.0873	sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2010/08/27 17:51:06.0893	sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
2010/08/27 17:51:06.0912	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2010/08/27 17:51:06.0949	sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2010/08/27 17:51:06.0967	SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2010/08/27 17:51:06.0990	SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2010/08/27 17:51:07.0045	Smb             (031e6bcd53c9b2b9ace111eafec347b6) C:\Windows\system32\DRIVERS\smb.sys
2010/08/27 17:51:07.0079	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2010/08/27 17:51:07.0162	sptd            (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys
2010/08/27 17:51:07.0237	srv             (8e5fc19b3b38364c5f44ccecec5248e9) C:\Windows\system32\DRIVERS\srv.sys
2010/08/27 17:51:07.0290	srv2            (4ceeb95e0b79e48b81f2da0a6c24c64b) C:\Windows\system32\DRIVERS\srv2.sys
2010/08/27 17:51:07.0338	srvnet          (f9c65e1e00a6bbf7c57d9b8ea068c525) C:\Windows\system32\DRIVERS\srvnet.sys
2010/08/27 17:51:07.0382	ssmdrv          (3ad0362cf68de3ac500e981700242cca) C:\Windows\system32\DRIVERS\ssmdrv.sys
2010/08/27 17:51:07.0441	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2010/08/27 17:51:07.0480	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2010/08/27 17:51:07.0507	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2010/08/27 17:51:07.0547	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2010/08/27 17:51:07.0608	Tcpip           (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\drivers	cpip.sys
2010/08/27 17:51:07.0653	Tcpip6          (2eae4500984c2f8dacfb977060300a15) C:\Windows\system32\DRIVERS	cpip.sys
2010/08/27 17:51:07.0706	tcpipreg        (d4a2e4a4b011f3a883af77315a5ae76b) C:\Windows\system32\drivers	cpipreg.sys
2010/08/27 17:51:07.0723	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers	dpipe.sys
2010/08/27 17:51:07.0743	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers	dtcp.sys
2010/08/27 17:51:07.0767	tdx             (d09276b1fab033ce1d40dcbdf303d10f) C:\Windows\system32\DRIVERS	dx.sys
2010/08/27 17:51:07.0789	TermDD          (a048056f5e1a96a9bf3071b91741a5aa) C:\Windows\system32\DRIVERS	ermdd.sys
2010/08/27 17:51:07.0849	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS	ssecsrv.sys
2010/08/27 17:51:07.0872	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS	unmp.sys
2010/08/27 17:51:07.0911	tunnel          (6042505ff6fa9ac1ef7684d0e03b6940) C:\Windows\system32\DRIVERS	unnel.sys
2010/08/27 17:51:07.0937	uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2010/08/27 17:51:07.0960	udfs            (8b5088058fa1d1cd897a2113ccff6c58) C:\Windows\system32\DRIVERS\udfs.sys
2010/08/27 17:51:07.0995	uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2010/08/27 17:51:08.0020	uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2010/08/27 17:51:08.0048	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2010/08/27 17:51:08.0073	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2010/08/27 17:51:08.0097	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2010/08/27 17:51:08.0140	USBAAPL         (60a68a5ea173a97971ee9f1ff49eb2b3) C:\Windows\system32\Drivers\usbaapl.sys
2010/08/27 17:51:08.0164	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/27 17:51:08.0183	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2010/08/27 17:51:08.0208	usbehci         (cebe90821810e76320155beba722fcf9) C:\Windows\system32\DRIVERS\usbehci.sys
2010/08/27 17:51:08.0228	usbhub          (cc6b28e4ce39951357963119ce47b143) C:\Windows\system32\DRIVERS\usbhub.sys
2010/08/27 17:51:08.0249	usbohci         (7bdb7b0e7d45ac0402d78b90789ef47c) C:\Windows\system32\DRIVERS\usbohci.sys
2010/08/27 17:51:08.0286	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
2010/08/27 17:51:08.0310	USBSTOR         (87ba6b83c5d19b69160968d07d6e2982) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/27 17:51:08.0335	usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/27 17:51:08.0379	vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/27 17:51:08.0414	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2010/08/27 17:51:08.0447	viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2010/08/27 17:51:08.0485	ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2010/08/27 17:51:08.0508	viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2010/08/27 17:51:08.0547	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2010/08/27 17:51:08.0572	volmgrx         (98f5ffe6316bd74e9e2c97206c190196) C:\Windows\system32\drivers\volmgrx.sys
2010/08/27 17:51:08.0596	volsnap         (d8b4a53dd2769f226b3eb374374987c9) C:\Windows\system32\drivers\volsnap.sys
2010/08/27 17:51:08.0632	vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2010/08/27 17:51:08.0685	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2010/08/27 17:51:08.0735	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 17:51:08.0747	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/08/27 17:51:08.0780	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2010/08/27 17:51:08.0812	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2010/08/27 17:51:08.0902	WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/27 17:51:08.0944	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/08/27 17:51:09.0000	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/27 17:51:09.0042	\HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/08/27 17:51:09.0047	================================================================================
2010/08/27 17:51:09.0047	Scan finished
2010/08/27 17:51:09.0047	================================================================================
2010/08/27 17:51:09.0062	Detected object count: 1
2010/08/27 17:51:18.0468	\HardDisk0\MBR - quarantined
2010/08/27 17:51:18.0469	Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Quarantine

Xplode · Answer

Poste moi également le rapport ZHPFix stp

miss-crystal · Answer

Rapport de ZHPFix v1.12.3138 par Nicolas Coolman, Update du 25/08/2010
Fichier d'export Registre : 
Run by CalliWeb at 27/08/2010 17:49:17
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
O64 - Services: CurCS - (.not file.) - csvjeikupwyviqk (csvjeikupwyviqk) .(.Pas de propriétaire - Pas de description.) - LEGACY_CSVJEIKUPWYVIQK  => Clé supprimée avec succès
O64 - Services: CurCS - (.not file.) - ufngede (ufngede) .(.Pas de propriétaire - Pas de description.) - LEGACY_UFNGEDE  => Clé supprimée avec succès
SS - | Auto 17/09/2008 0 | (PEVSystemStart) . (.Pas de propriétaire.) - C:\ComboFix\PEV.cfxxe exeC \i C:\ComboFix\HIDEC.exe  => Clé supprimée avec succès
O23 - Service: (PEVSystemStart) . (.Pas de propriétaire - Pas de description.) - C:\ComboFix\PEV.cfxxe exeC \i C:\ComboFix\HIDEC.exe  => Clé absente

========== Valeur(s) du Registre ==========
O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMPere.tmp\svchost.exe (.not file.)  => Valeur supprimée avec succès
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe  => Valeur supprimée avec succès
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe  => Valeur absente

========== Elément(s) de donnée du Registre ==========
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643  => Donnée supprimée avec succès
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>  => Donnée supprimée avec succès

========== Fichier(s) ==========
c:\windows	empere.tmp\svchost.exe  => Fichier supprimé au reboot
c:\combofix\pev.cfxxe exec \i c:\combofix\hidec.exe  => Fichier supprimé au reboot


========== Récapitulatif ==========
4 : Clé(s) du Registre
3 : Valeur(s) du Registre
2 : Elément(s) de donnée du Registre
2 : Fichier(s)


End of the scan

Xplode · Answer

Ok.

Fais maintenant ceci s'il te plait :

-+-+-+-+-> GMER <-+-+-+-+-


[x] Rends toi sur cette page puis clique sur " Download EXE " pour télécharger GMER ( renommé ).

[x] Lance le, GMER va scanner ton PC automatiquement.

[x] Laisse GMER travailler.

[x] A la fin du scan, si des lignes rouges sont trouvées, fais clic droit dessus puis :

 - Delete service
 - Delete files
 - Kill process

[x] Clique ensuite sur "save" , sauvegarde le rapport puis copie/colle son contenu dans ton prochain message.

miss-crystal · Answer

Lorsque j'appuie sur scanner...il y a un gros bug...obligé d'éteindre le pc par l'unité centrale :s.

miss-crystal · Answer

Je dois y aller, je continuerai lundi.

Merci

Xplode · Answer

Re,

Quand tu reviendras, fais ceci :

-+-+-+-> Dr.Web CureIt! <-+-+-+- 


[x] Télécharge Dr.Web CureIt 

[x] Lance le, puis clique sur " Commencer le scan " 

[x] Il commencera une analyse des processus, s'il trouve des processus infectés, clique sur " Oui pour tout ". 

[x] A la fin du scan rapide, clique sur Option > Changer la configuration 

[x] A l'onglet Scanner, décoche " Analyse heuristique ". 

[x] De retour à la fenêtre principale, choisis " Analyse complète " 

[x] Clique sur la flèche verte pour que le scan débute. 

[x] Si un fichier est détécté, clique sur " Oui pour tout " 

[x] A la fin du scan, si des infections sont trouvées, clique sur Tout séléctionner > Désinfecter 

[x] Si la désinfection est impossible, mettre en quarantaine. 

[x] De retour au menu principal, clique sur Fichier > Enregistrer le rapport 

[x] Sauvegarde le sur ton bureau, puis ferme Dr.Web et redémarre ton ordinateur ( important ) 

[x] Au redémarrage, poste le contenu du rapport de DrWeb ( DrWeb.csv ) dans ta prochaine réponse.

miss-crystal · Answer

Bonjour, Xplode je te remercie de ne pas m'avoir laissé tomber ! Malheureusement, Dr.Web CureIt! ne fonctionne pas ! Une fois que je lance le scan, il m'affiche un message comme quoi il va démarrer même si un malware ou autre l'en empêche et au final, un écran bleu s'affiche et il me fait redémarrer. :(
Décidément je désespere, d'autant plus que je viens de voir le "csrss.exe : processus d'éxécuttion client" sur mon pc personnel, chez moi...

miss-crystal · Answer

allo?

miss-crystal · Answer

Il n'y a plus personne ?

miss-crystal · Answer

Bon bah j'ai trouvé une solution radicale ! J'ai changé de boite !

Csrss.exe et spoolsv.exe infectés !

31 réponses

Discussions similaires

Newsletters