Malwarebytes Fermé

Question

Bonjour, je possède un ordinateur windows xp attaqué par le malware "antimalware doctor". J'ai donc suivi les instructions et j'ai lancé le "scan complet". Jusque là pas de problème mais quand le scan se termine et que je lance la suppression des fichiers "mauvais", malwarebytes ne répond plus...
Par ailleurs, j'ai eu le temps d'enregistrer le rapport mais malheureusement je ne me souviens plus du lieu où je l'ai enregistrer. Sinon les fichiers "mauvais" se trouvent encore sous quarantaine (ce qui n'empêche pas "doctor" de continuer son trafic).
Je voulais savoir comment surmonter se "ne répond plus".
J'ai vu en surfant un coup qu'il est possible de le faire en mode "sans erreur" mais en surfant encore, l'éditeur du logiciel déconseille ce mode car il serait "peu efficace". 
De plus mon caractère peu patient me pousse à vous demander : suis-je obliger de relancer le scan en mode "sans erreur" ou puis-je, à partir des scans précédents déjà réalisés reprendre la suppression qui ne répondait plus ?
Merci d'avance. Cordialement... :).



Configuration: Mac OS X / Safari 531.21.10

juju666 · Answer

Bonjour,

De la patience il en faudra ;) et suivre mes instructions jusqu'au moment où je te dis "on se quitte" sinon dans 1 semaine tu reviendras ;)

&#9654 Télécharge sur le bureau RogueKiller  (par tigzy)   

&#9654 &#9654 Sous Windows XP, double clic gauche   

&#9654 &#9654  Sous Vista/Seven, clique droit, lancer en tant qu'administrateur   

&#9654 Quitte tous tes programmes en cours   
&#9654 Lance RogueKiller.exe.   
&#9654 Un scan se lance, puis tu verra d''indiqué dans la fenêtre  
&#9830 1. Recherche (écrit en vert) 
&#9830 2. Suppression(écrit en rouge)  
&#9830 3. Hosts RAZ (écrit en rouge)  
&#9830 4. Proxy RAZ (écrit en rouge) 
&#9830 5. DNS RAZ (écrit en rouge) 
&#9830 6. Raccourcis RAZ (écrit en rouge) 
&#9830 0. Quitter (écrit en vert) 
&#9654  A ce moment tape 2 et valide   

&#9654 Une fois terminé, un rapport (RKreport1.txt) a du se créer à côté de l'exécutable, colle son contenu dans la réponse.
&#9654 Utilise l'option 0 pour fermer RogueKiller à ce moment là.

&#9654 Si le programme a été bloqué, ne pas hésiter à essayer plusieurs fois ou a changer son nom en winlogon.exe

Tutoriel : http://forums-fec.be/entraide/viewtopic.php?f=55&t=24

~~

suite à ça, MBAM devrait passer, mets le à jour avant le scan ;)

Rikyou · Answer

Juju666, tout d'abord merci de ta réponse (bien que ma patient en souffre :p), j'ai suivi tes conseils à la lettre mais un problème est apparu (comme d'ab...). Quand je colle le contenu dans la réponse, le logiciel descend à une vitesse folle puis disparaît...
C'est sûrement une mauvaise manipulation de ma part mais peux-tu encore une fois me venir en aide :) ?

juju666 · Answer

Rikyou, d'abord de rien :3

Heu ... Le logiciel descend à une vitesse folle

J'ai pas compris ? 

RogueKiller, une fois fini son taf, il ouvre un rapport dans un fichier bloc note.
T'as juste à coller dans ta réponse le rapport "bloc note" ...
Une fois le bloc note fermé, RogueKiller se remet à son menu principal et là tu tapes 0 pour le fermer.

Rikyou · Answer

Ah ! Excuse moi je me suis égaré, mais pour te donner la réponse il faut que je passe ce dossier sur une clef usb car "doctor" bloque safari ce qui va me prendre un peu de temps...

juju666 · Answer

meuh non après le passage de rogue killer safari n'est plus bloqué :)
et s'il te met une erreur 404 page introuvable, lance rogue killer mode 4 ;)

Rikyou · Answer

Exact, merci :) ! Voici le résultat : RogueKiller V6.2.0 [12/12/2011] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Propriétaire [Droits d'admin] Mode: Suppression -- Date : 12/12/2011 21:20:06 ¤¤¤ Processus malicieux: 0 ¤¤¤ ¤¤¤ Entrees de registre: 19 ¤¤¤ [BLACKLIST] HKLM\[...]\Winlogon : Userinit (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) -> REPLACED (C:\WINDOWS\system32\userinit.exe,) [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ 127.0.0.1 127.0.0.1 ad.ghura.pl 127.0.0.1 ircgalaxy.pl 127.0.0.1 ru.brans.pl 127.0.0.1 zief.pl ¤¤¤ MBR Verif: ¤¤¤ --- User --- [MBR] e6df9eca0c3c169071b56d403c36d85e [BSP] 90101588f32e75ab94924d1dfb01d359 : MBR Code unknown Partition table: 0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 63 | Size: 62915 Mo 1 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 122881185 | Size: 97115 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[1].txt >> RKreport[1].txt

juju666 · Answer

relance roguekiller mode 4 :)
y'a un proxy qui redirige tes recherches.

Rikyou · Answer

Le résultat est le meme...

juju666 · Answer

rapport ? 
RKReport2.txt

Rikyou · Answer

RogueKiller V6.2.0 [12/12/2011] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Propriétaire [Droits d'admin] Mode: Proxy RAZ -- Date : 12/12/2011 21:35:18 ¤¤¤ Processus malicieux: 0 ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Entrees de registre: 0 ¤¤¤ Termine : << RKreport[1].txt >> RKreport[1].txt C'est le rapport quand je fais le mode 4 . Et le mode 2 : RogueKiller V6.2.0 [12/12/2011] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Propriétaire [Droits d'admin] Mode: Suppression -- Date : 12/12/2011 21:37:13 ¤¤¤ Processus malicieux: 0 ¤¤¤ ¤¤¤ Entrees de registre: 19 ¤¤¤ [BLACKLIST] HKLM\[...]\Winlogon : Userinit (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) -> REPLACED (C:\WINDOWS\system32\userinit.exe,) [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> NOT REMOVED, USE DNSFIX ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ 127.0.0.1 127.0.0.1 ad.ghura.pl 127.0.0.1 ircgalaxy.pl 127.0.0.1 ru.brans.pl 127.0.0.1 zief.pl ¤¤¤ MBR Verif: ¤¤¤ --- User --- [MBR] e6df9eca0c3c169071b56d403c36d85e [BSP] 90101588f32e75ab94924d1dfb01d359 : MBR Code unknown Partition table: 0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 63 | Size: 62915 Mo 1 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 122881185 | Size: 97115 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[2].txt >> RKreport[1].txt ; RKreport[2].txt-- Everything I do, I do it big. Wiz Khalifa.

juju666 · Answer

autant pour moi, c'était le mode 5 qu'il fallait passer x)
dns raz

Rikyou · Answer

Mode 5 : RogueKiller V6.2.0 [12/12/2011] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Propriétaire [Droits d'admin] Mode: DNS RAZ -- Date : 12/12/2011 21:41:15 ¤¤¤ Processus malicieux: 0 ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Entrees de registre: 18 ¤¤¤ [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet002\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{14934CE1-6E57-45A2-86AA-42E686F562F7} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{3CDA1538-FA42-4926-8E28-08DDAF441FFB} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{5680D972-0ECE-4440-87DA-8D3E8D9E544B} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{56D9ECDD-7535-49B2-8B27-E73A2729947D} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6A51F8E6-367E-4575-A46B-D70FA5895872} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{6C6C93EB-77AB-4C4B-AD92-6CFDA9AD2777} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{BD6BCC4D-AACF-491F-A07E-BC78B875BDD2} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{D5B47ABD-7008-46A7-B3D5-E826DF84A906} : NameServer (195.242.208.40) -> REPLACED () [DNS] HKLM\[...]\ControlSet003\Parameters\Interfaces\{FBED70DE-9B16-45B0-BD9C-C599CB2A6BF7} : NameServer (195.242.208.40) -> REPLACED () Termine : << RKreport[3].txt >> RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt Mode 2 : RogueKiller V6.2.0 [12/12/2011] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Propriétaire [Droits d'admin] Mode: Suppression -- Date : 12/12/2011 21:41:27 ¤¤¤ Processus malicieux: 0 ¤¤¤ ¤¤¤ Entrees de registre: 1 ¤¤¤ [BLACKLIST] HKLM\[...]\Winlogon : Userinit (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) -> REPLACED (C:\WINDOWS\system32\userinit.exe,) ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver: [LOADED] ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ 127.0.0.1 127.0.0.1 ad.ghura.pl 127.0.0.1 ircgalaxy.pl 127.0.0.1 ru.brans.pl 127.0.0.1 zief.pl ¤¤¤ MBR Verif: ¤¤¤ --- User --- [MBR] e6df9eca0c3c169071b56d403c36d85e [BSP] 90101588f32e75ab94924d1dfb01d359 : MBR Code unknown Partition table: 0 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 63 | Size: 62915 Mo 1 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 122881185 | Size: 97115 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[4].txt >> RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt-- Everything I do, I do it big. Wiz Khalifa.

juju666 · Answer

voilà qui est tout de suite mieux ^^

allé go mise à jour mbam puis scan rapide, ça va shooter le rogue une bonne fois pour toutes.

Rikyou · Answer

Antimalware doctor est un rogue :) ? Sinon je suis entrain de scanner là :) merci beaucoup.

juju666 · Answer

oui c'est un rogue (faux logiciel de sécurité) :)
certains l'appellent ransomware ou un truc du genre ^^

Rikyou · Answer

Je viens de finir mais un rapport bloc notes : "Impossible de supprimer certains éléments. Un fichier rapport a été enregistré dans le dossier logs." Que dois-je faire?

juju666 · Answer

tu redémarres, au redémarrage si le rapport s'ouvre pas tu vas dans mbam, onglet rapports/logs, tu le colle ici :)

Rikyou · Answer

Dossier(s) infecté(s):
c:\documents and settings\propriétaire\application data\systemproc (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Fichier(s) infecté(s):
c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32
et.net (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sdra64.exe (Trojan.Meredrop) -> Delete on reboot.
c:\documents and settings\propriétaire\application data\sdra64.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\0045.DLL (Trojan.Witkinat) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\cooper.mine (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\glmf3232.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sshnas21.dll (Trojan.Inject) -> Quarantined and deleted successfully.
c:\WINDOWS\system32x6zjwmd.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\zqvvdbvyy9.sys (Rootkit.Tent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\wbem\grpconv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\janfw.exe (Malware.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\smanxrocwe.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\smss.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\system.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp	askmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp
otepad.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\mexcosanwr.tmp (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\mhq49i8w.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\debug.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\dm9540y0q.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wasmeorxcn.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\khvcol.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\lpmv6hmn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\ukhfw5q.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\urt1a1.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\Uvb.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\Uvc.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\uvono.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\~TM5D.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\ccl9ke.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wgvyd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\win.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\win32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wzhuglnue.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\grb4dg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\jczqq47i3y5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv381274835170.exe (Trojan.Insain) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\application data\asam.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\application data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings	emporary internet files\Content.IE5\47SL61YJ\yptozgozmu[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings	emporary internet files\Content.IE5\WD2VCLUJ\gnemtrzxsn[1].htm (Malware.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\Unapua.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\Adobe\sp.DLL (TrojanProxy.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\systemproc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\h7t.wt (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\hgtd.ruy (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32
mklo.dll (Worm.MarioFev) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\WORK.DAT (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv271274835423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\explorer.exe:userini.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
c:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\systemproc\upd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
c:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.--
Everything I do, I do it big. Wiz Khalifa.

juju666 · Answer

jpeux avoir le rapport complet ?

Rikyou · Answer

Autant pour moi, c'est que c'est pas tout petit :p :
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 8352

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

12/12/2011 22:15:29
mbam-log-2011-12-12 (22-15-29).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 179381
Temps écoulé: 13 minute(s), 51 seconde(s)

Processus mémoire infecté(s): 5
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 27
Valeur(s) du Registre infectée(s): 12
Elément(s) de données du Registre infecté(s): 3
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 71

Processus mémoire infecté(s):
c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> 644 -> Unloaded process successfully.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3716 -> Unloaded process successfully.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3848 -> Unloaded process successfully.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3856 -> Unloaded process successfully.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 4008 -> Unloaded process successfully.

Module(s) mémoire infecté(s):
c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspimgr (Trojan.Spambot) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{10467BA9-92F6-47DC-BF84-CAF34C5BE324} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{315547D4-976F-486B-9A97-378AE6F23AF4} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
et (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INSTALL.EXE (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Sft (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASPIMGR (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SPService (TrojanProxy.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Value: {A2BA40A0-74F1-52BD-F411-00B15A2C8953} -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\GootkitSSO (Trojan.Downloader) -> Value: GootkitSSO -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
et (Trojan.Downloader) -> Value: net -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Value: {A2BA40A0-74F1-52BD-F411-00B15A2C8953} -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> Value: WINID -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Value: idstrf -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Value: UID -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Meredrop) -> Bad: (C:\WINDOWS\system32\sdra64.exe) Good: () -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
c:\documents and settings\propriétaire\application data\systemproc (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Fichier(s) infecté(s):
c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.
c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32
et.net (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sdra64.exe (Trojan.Meredrop) -> Delete on reboot.
c:\documents and settings\propriétaire\application data\sdra64.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\0045.DLL (Trojan.Witkinat) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\cooper.mine (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\glmf3232.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\sshnas21.dll (Trojan.Inject) -> Quarantined and deleted successfully.
c:\WINDOWS\system32x6zjwmd.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\drivers\zqvvdbvyy9.sys (Rootkit.Tent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\wbem\grpconv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\janfw.exe (Malware.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\smanxrocwe.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\smss.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\system.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp	askmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp
otepad.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\mexcosanwr.tmp (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\mhq49i8w.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\debug.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\dm9540y0q.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wasmeorxcn.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\khvcol.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\lpmv6hmn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\ukhfw5q.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\urt1a1.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\Uvb.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\Uvc.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\uvono.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\~TM5D.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\ccl9ke.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wgvyd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\win.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\win32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\wzhuglnue.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\grb4dg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\jczqq47i3y5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv381274835170.exe (Trojan.Insain) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\application data\asam.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\application data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings	emporary internet files\Content.IE5\47SL61YJ\yptozgozmu[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings	emporary internet files\Content.IE5\WD2VCLUJ\gnemtrzxsn[1].htm (Malware.Gen) -> Quarantined and deleted successfully.
c:\WINDOWS\Unapua.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\02000000bb25252c922s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\Adobe\sp.DLL (TrojanProxy.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\systemproc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\h7t.wt (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\hgtd.ruy (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\system32
mklo.dll (Worm.MarioFev) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\WORK.DAT (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\local settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\wpv271274835423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\explorer.exe:userini.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
c:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
c:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\propriétaire\application data\systemproc\upd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
c:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.

juju666 · Answer

joli tout ça ^^

j'crois qu'il se cache encore pas mal de choses :p

&#9654 Télécharge Reload_TDSSKiller  

&#9654 Lance le   

choisis : lancer le nettoyage  

l'outil va automatiquement télécharger la derniere version puis   

TDSSKiller va s'ouvrir , clique sur "Start Scan"  Clique ici pour l'aide en image  

Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut.   
Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée.   
Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée.   
Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas  
Si Suspicious file est indiqué, laisse l''option cochée sur Skip    
une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer  

sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau  

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

Tutoriel : http://forums-fec.be/entraide/viewtopic.php?f=55&t=15

Rikyou · Answer

quand le scan se termine j'arrive sur "threats detected" et j'ai 2 choses, 2 "forged file" dont le type est kernel driver, je ne comprend rien mais ca ne corespond pas à ce que tu m'as écrit, sauf peut etre le fait qu'il y est écrit "suspicious object".

juju666 · Answer

si c'est suspicious tu skip

Rikyou · Answer

22:50:48.0046 3140	TDSS rootkit removing tool 2.6.22.0 Dec  7 2011 13:21:06
22:50:48.0171 3140	============================================================
22:50:48.0171 3140	Current date / time: 2011/12/12 22:50:48.0171
22:50:48.0171 3140	SystemInfo:
22:50:48.0171 3140	
22:50:48.0171 3140	OS Version: 5.1.2600 ServicePack: 2.0
22:50:48.0171 3140	Product type: Workstation
22:50:48.0171 3140	ComputerName: WORKSTATION
22:50:48.0171 3140	UserName: Propriétaire
22:50:48.0171 3140	Windows directory: C:\WINDOWS
22:50:48.0171 3140	System windows directory: C:\WINDOWS
22:50:48.0171 3140	Processor architecture: Intel x86
22:50:48.0171 3140	Number of processors: 1
22:50:48.0171 3140	Page size: 0x1000
22:50:48.0171 3140	Boot type: Normal boot
22:50:48.0171 3140	============================================================
22:50:48.0375 3140	Initialize success
22:50:49.0781 3408	============================================================
22:50:49.0781 3408	Scan started
22:50:49.0781 3408	Mode: Manual; 
22:50:49.0781 3408	============================================================
22:50:51.0203 3408	Abiosdsk - ok
22:50:51.0234 3408	abp480n5 - ok
22:50:51.0421 3408	ACPI            (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:50:51.0546 3408	ACPI - ok
22:50:51.0937 3408	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
22:50:51.0968 3408	ACPIEC - ok
22:50:52.0093 3408	adpu160m - ok
22:50:52.0500 3408	aec             (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
22:50:52.0531 3408	aec - ok
22:50:52.0781 3408	AFD             (944ca435bfcfc82cc1ed9e3a7d731aa9) C:\WINDOWS\System32\drivers\afd.sys
22:50:52.0828 3408	AFD - ok
22:50:53.0078 3408	Aha154x - ok
22:50:53.0218 3408	aic78u2 - ok
22:50:53.0281 3408	aic78xx - ok
22:50:54.0562 3408	ALCXWDM         (071757a906c7b3500916548e6fd8870b) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
22:50:55.0578 3408	ALCXWDM - ok
22:50:55.0765 3408	AliIde - ok
22:50:55.0906 3408	AmdK7           (c0f59933070392e662b3c2bb2be77955) C:\WINDOWS\system32\DRIVERS\amdk7.sys
22:50:55.0921 3408	AmdK7 - ok
22:50:56.0109 3408	amsint - ok
22:50:56.0406 3408	Arp1394         (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
22:50:56.0406 3408	Arp1394 - ok
22:50:56.0625 3408	asc - ok
22:50:56.0812 3408	asc3350p - ok
22:50:57.0093 3408	asc3550 - ok
22:50:57.0296 3408	AsyncMac        (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:50:57.0296 3408	AsyncMac - ok
22:50:57.0406 3408	atapi           (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
22:50:57.0406 3408	atapi - ok
22:50:57.0500 3408	Atdisk - ok
22:50:58.0390 3408	ati2mtag        (3b88b6466896cc1a3a7e3287d72aca85) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
22:50:59.0640 3408	ati2mtag - ok
22:51:00.0156 3408	Atmarpc         (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:51:00.0187 3408	Atmarpc - ok
22:51:00.0687 3408	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
22:51:00.0734 3408	audstub - ok
22:51:01.0187 3408	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
22:51:01.0218 3408	Beep - ok
22:51:01.0359 3408	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
22:51:01.0375 3408	cbidf2k - ok
22:51:01.0609 3408	CCDECODE        (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
22:51:01.0609 3408	CCDECODE - ok
22:51:01.0781 3408	cd20xrnt - ok
22:51:02.0000 3408	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
22:51:02.0031 3408	Cdaudio - ok
22:51:02.0218 3408	Cdfs            (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
22:51:02.0234 3408	Cdfs - ok
22:51:02.0468 3408	Cdrom           (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:51:02.0484 3408	Cdrom - ok
22:51:02.0765 3408	Changer - ok
22:51:03.0015 3408	CmdIde - ok
22:51:03.0125 3408	Cpqarray - ok
22:51:03.0296 3408	dac2w2k - ok
22:51:03.0421 3408	dac960nt - ok
22:51:03.0656 3408	Disk            (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
22:51:03.0671 3408	Disk - ok
22:51:03.0984 3408	dmboot          (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
22:51:04.0125 3408	dmboot - ok
22:51:04.0437 3408	dmio            (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
22:51:04.0468 3408	dmio - ok
22:51:04.0640 3408	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
22:51:04.0656 3408	dmload - ok
22:51:04.0859 3408	DMusic          (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
22:51:04.0875 3408	DMusic - ok
22:51:05.0125 3408	dpti2o - ok
22:51:05.0312 3408	driverhardwarev2 (aad5b49f2aabeb78f8e37984f475659e) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
22:51:05.0328 3408	driverhardwarev2 - ok
22:51:05.0515 3408	drmkaud         (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
22:51:05.0531 3408	drmkaud - ok
22:51:05.0687 3408	EagleNT - ok
22:51:05.0921 3408	Fastfat         (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
22:51:06.0000 3408	Fastfat - ok
22:51:06.0281 3408	Fdc             (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
22:51:06.0281 3408	Fdc - ok
22:51:06.0515 3408	FETNDIS         (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
22:51:06.0546 3408	FETNDIS - ok
22:51:06.0812 3408	Fips            (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
22:51:06.0843 3408	Fips - ok
22:51:07.0125 3408	Flpydisk        (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
22:51:07.0156 3408	Flpydisk - ok
22:51:07.0390 3408	FltMgr          (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
22:51:07.0437 3408	FltMgr - ok
22:51:07.0703 3408	fssfltr         (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
22:51:07.0734 3408	fssfltr - ok
22:51:08.0015 3408	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:51:08.0031 3408	Fs_Rec - ok
22:51:08.0218 3408	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:51:08.0281 3408	Ftdisk - ok
22:51:08.0562 3408	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
22:51:08.0593 3408	GEARAspiWDM - ok
22:51:08.0812 3408	Gpc             (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:51:08.0828 3408	Gpc - ok
22:51:09.0093 3408	HidUsb          (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:51:09.0109 3408	HidUsb - ok
22:51:09.0265 3408	hpn - ok
22:51:09.0656 3408	HTTP            (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
22:51:09.0703 3408	HTTP - ok
22:51:09.0906 3408	i2omgmt - ok
22:51:10.0046 3408	i2omp - ok
22:51:10.0140 3408	i8042prt        (b4c177f19780948708646d6d124397cd) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:51:10.0140 3408	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\i8042prt.sys. Real md5: b4c177f19780948708646d6d124397cd, Fake md5: f41fff8a2299855dfb8fcb98412a90a7
22:51:10.0140 3408	i8042prt ( ForgedFile.Multi.Generic ) - warning
22:51:10.0140 3408	i8042prt - detected ForgedFile.Multi.Generic (1)
22:51:10.0312 3408	Imapi           (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
22:51:10.0343 3408	Imapi - ok
22:51:10.0515 3408	ini910u - ok
22:51:10.0609 3408	IntelIde - ok
22:51:10.0750 3408	Ip6Fw           (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
22:51:10.0750 3408	Ip6Fw - ok
22:51:10.0953 3408	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:51:10.0953 3408	IpFilterDriver - ok
22:51:11.0187 3408	IpInIp          (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:51:11.0187 3408	IpInIp - ok
22:51:11.0421 3408	IpNat           (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:51:11.0453 3408	IpNat - ok
22:51:11.0734 3408	IPSec           (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:51:11.0734 3408	IPSec - ok
22:51:11.0921 3408	IRENUM          (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
22:51:11.0937 3408	IRENUM - ok
22:51:12.0140 3408	isapnp          (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:51:12.0140 3408	isapnp - ok
22:51:12.0359 3408	izorex - ok
22:51:12.0562 3408	Kbdclass        (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:51:12.0578 3408	Kbdclass - ok
22:51:12.0734 3408	kbdhid          (62dd5eefcec4ef4163f1168d4262a9e4) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:51:12.0734 3408	kbdhid - ok
22:51:12.0968 3408	kmixer          (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
22:51:13.0000 3408	kmixer - ok
22:51:13.0187 3408	KSecDD          (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
22:51:13.0187 3408	KSecDD - ok
22:51:13.0375 3408	lbrtfdc - ok
22:51:13.0781 3408	MBAMSwissArmy   (0905dc0814d738cff53577a59ccd81e0) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
22:51:13.0812 3408	MBAMSwissArmy - ok
22:51:14.0015 3408	mfeapfk         (b5c306c5b5e7417b9d2b410894678069) C:\WINDOWS\system32\drivers\mfeapfk.sys
22:51:14.0046 3408	mfeapfk - ok
22:51:14.0500 3408	mfeavfk         (87b28198b308af3469d6e0b81d86c1fa) C:\WINDOWS\system32\drivers\mfeavfk.sys
22:51:14.0515 3408	mfeavfk - ok
22:51:14.0843 3408	mfebopk         (cf37784dd24c83f62626bc0ea3f5e386) C:\WINDOWS\system32\drivers\mfebopk.sys
22:51:14.0890 3408	mfebopk - ok
22:51:15.0078 3408	mfehidk         (241c09c7d8c589ea1d72a36e6578e42c) C:\WINDOWS\system32\drivers\mfehidk.sys
22:51:15.0187 3408	mfehidk - ok
22:51:15.0437 3408	mferkdk         (37b5228bea6b4429ffb90dfa77af4431) C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
22:51:15.0468 3408	mferkdk - ok
22:51:15.0796 3408	mfetdik         (19c2d8af421e96d12e4004ca2162dbe9) C:\WINDOWS\system32\drivers\mfetdik.sys
22:51:15.0843 3408	mfetdik - ok
22:51:16.0109 3408	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
22:51:16.0140 3408	mnmdd - ok
22:51:16.0375 3408	Modem           (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
22:51:16.0390 3408	Modem - ok
22:51:16.0609 3408	MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
22:51:16.0625 3408	MODEMCSA - ok
22:51:16.0843 3408	Mouclass        (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:51:16.0843 3408	Mouclass - ok
22:51:17.0078 3408	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:51:17.0093 3408	mouhid - ok
22:51:17.0312 3408	MountMgr        (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
22:51:17.0343 3408	MountMgr - ok
22:51:17.0468 3408	mraid35x - ok
22:51:17.0718 3408	MRxDAV          (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:51:17.0750 3408	MRxDAV - ok
22:51:18.0093 3408	MRxSmb          (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:51:18.0156 3408	MRxSmb - ok
22:51:18.0390 3408	Msfs            (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
22:51:18.0421 3408	Msfs - ok
22:51:18.0703 3408	MSKSSRV         (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:51:18.0718 3408	MSKSSRV - ok
22:51:18.0937 3408	MSPCLOCK        (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:51:18.0937 3408	MSPCLOCK - ok
22:51:19.0187 3408	MSPQM           (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
22:51:19.0187 3408	MSPQM - ok
22:51:19.0390 3408	mssmbios        (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:51:19.0406 3408	mssmbios - ok
22:51:19.0484 3408	MSTEE           (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
22:51:19.0500 3408	MSTEE - ok
22:51:19.0578 3408	Mtlmnt5         (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
22:51:19.0578 3408	Mtlmnt5 - ok
22:51:19.0921 3408	Mtlstrm         (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
22:51:20.0250 3408	Mtlstrm - ok
22:51:20.0546 3408	Mup             (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
22:51:20.0593 3408	Mup - ok
22:51:20.0843 3408	NABTSFEC        (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
22:51:20.0859 3408	NABTSFEC - ok
22:51:21.0171 3408	NDIS            (93b984ecaff503d80c61e76a9959ceea) C:\WINDOWS\system32\drivers\NDIS.sys
22:51:21.0187 3408	NDIS - ok
22:51:21.0343 3408	NdisIP          (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
22:51:21.0343 3408	NdisIP - ok
22:51:21.0500 3408	NdisTapi        (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS
distapi.sys
22:51:21.0500 3408	NdisTapi - ok
22:51:21.0562 3408	Ndisuio         (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS
disuio.sys
22:51:21.0593 3408	Ndisuio - ok
22:51:21.0687 3408	NdisWan         (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS
diswan.sys
22:51:21.0703 3408	NdisWan - ok
22:51:21.0812 3408	NDProxy         (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
22:51:21.0828 3408	NDProxy - ok
22:51:21.0968 3408	NetBIOS         (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS
etbios.sys
22:51:21.0984 3408	NetBIOS - ok
22:51:22.0140 3408	NetBT           (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS
etbt.sys
22:51:22.0140 3408	NetBT - ok
22:51:22.0375 3408	NIC1394         (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS
ic1394.sys
22:51:22.0375 3408	NIC1394 - ok
22:51:22.0500 3408	nm              (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
22:51:22.0500 3408	nm - ok
22:51:22.0671 3408	Npfs            (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
22:51:22.0671 3408	Npfs - ok
22:51:22.0875 3408	Ntfs            (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
22:51:22.0921 3408	Ntfs - ok
22:51:23.0031 3408	NtMtlFax        (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
22:51:23.0062 3408	NtMtlFax - ok
22:51:23.0203 3408	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
22:51:23.0203 3408	Null - ok
22:51:23.0343 3408	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
22:51:23.0343 3408	NwlnkFlt - ok
22:51:23.0437 3408	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
22:51:23.0437 3408	NwlnkFwd - ok
22:51:23.0640 3408	ohci1394        (8800483b09d1a28edae0af60ed24425e) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
22:51:23.0656 3408	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ohci1394.sys. Real md5: 8800483b09d1a28edae0af60ed24425e, Fake md5: e50531721efcad1323add311425b21fc
22:51:23.0656 3408	ohci1394 ( ForgedFile.Multi.Generic ) - warning
22:51:23.0656 3408	ohci1394 - detected ForgedFile.Multi.Generic (1)
22:51:23.0796 3408	Parport         (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\DRIVERS\parport.sys
22:51:23.0796 3408	Parport - ok
22:51:23.0906 3408	PartMgr         (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
22:51:23.0906 3408	PartMgr - ok
22:51:24.0093 3408	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
22:51:24.0125 3408	ParVdm - ok
22:51:24.0234 3408	PCI             (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
22:51:24.0234 3408	PCI - ok
22:51:24.0375 3408	PCIDump - ok
22:51:24.0671 3408	PCIIde          (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
22:51:24.0671 3408	PCIIde - ok
22:51:24.0921 3408	Pcmcia          (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\drivers\Pcmcia.sys
22:51:24.0953 3408	Pcmcia - ok
22:51:25.0062 3408	PDCOMP - ok
22:51:25.0218 3408	PDFRAME - ok
22:51:25.0468 3408	PDRELI - ok
22:51:25.0515 3408	PDRFRAME - ok
22:51:25.0578 3408	perc2 - ok
22:51:25.0765 3408	perc2hib - ok
22:51:26.0109 3408	PptpMiniport    (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERSaspptp.sys
22:51:26.0125 3408	PptpMiniport - ok
22:51:26.0281 3408	PSched          (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
22:51:26.0281 3408	PSched - ok
22:51:26.0453 3408	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:51:26.0453 3408	Ptilink - ok
22:51:26.0625 3408	PxHelp20        (0c8da0a8b0d227319c285e0eae65defd) C:\WINDOWS\system32\Drivers\PxHelp20.sys
22:51:26.0656 3408	PxHelp20 - ok
22:51:26.0765 3408	ql1080 - ok
22:51:27.0062 3408	Ql10wnt - ok
22:51:27.0218 3408	ql12160 - ok
22:51:27.0328 3408	ql1240 - ok
22:51:27.0484 3408	ql1280 - ok
22:51:27.0750 3408	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
22:51:27.0765 3408	RasAcd - ok
22:51:27.0921 3408	Rasl2tp         (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERSasl2tp.sys
22:51:27.0937 3408	Rasl2tp - ok
22:51:28.0218 3408	RasPppoe        (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERSaspppoe.sys
22:51:28.0218 3408	RasPppoe - ok
22:51:28.0390 3408	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
22:51:28.0406 3408	Raspti - ok
22:51:28.0671 3408	Rdbss           (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERSdbss.sys
22:51:28.0687 3408	Rdbss - ok
22:51:28.0953 3408	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:51:28.0953 3408	RDPCDD - ok
22:51:29.0328 3408	RDPWD           (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
22:51:29.0328 3408	RDPWD - ok
22:51:29.0531 3408	RecAgent        (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
22:51:29.0531 3408	RecAgent - ok
22:51:29.0703 3408	redbook         (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERSedbook.sys
22:51:29.0718 3408	redbook - ok
22:51:29.0937 3408	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:51:29.0953 3408	Secdrv - ok
22:51:30.0062 3408	serenum         (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
22:51:30.0078 3408	serenum - ok
22:51:30.0187 3408	Serial          (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\DRIVERS\serial.sys
22:51:30.0187 3408	Serial - ok
22:51:30.0406 3408	Sfloppy         (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
22:51:30.0421 3408	Sfloppy - ok
22:51:30.0578 3408	Simbad - ok
22:51:30.0671 3408	SIS163u         (c2299af684920f592d87aa002d072080) C:\WINDOWS\system32\DRIVERS\sis163u.sys
22:51:30.0703 3408	SIS163u - ok
22:51:30.0906 3408	sjzfmmz - ok
22:51:31.0062 3408	SLIP            (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
22:51:31.0078 3408	SLIP - ok
22:51:31.0437 3408	Slntamr         (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
22:51:31.0437 3408	Slntamr - ok
22:51:31.0687 3408	SlNtHal         (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
22:51:31.0718 3408	SlNtHal - ok
22:51:31.0953 3408	SlWdmSup        (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
22:51:31.0953 3408	SlWdmSup - ok
22:51:32.0140 3408	Sparrow - ok
22:51:32.0359 3408	splitter        (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
22:51:32.0390 3408	splitter - ok
22:51:32.0687 3408	sr              (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
22:51:32.0687 3408	sr - ok
22:51:33.0078 3408	Srv             (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINDOWS\system32\DRIVERS\srv.sys
22:51:33.0156 3408	Srv - ok
22:51:33.0390 3408	streamip        (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
22:51:33.0406 3408	streamip - ok
22:51:33.0656 3408	swenum          (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
22:51:33.0671 3408	swenum - ok
22:51:33.0906 3408	swmidi          (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
22:51:33.0921 3408	swmidi - ok
22:51:34.0093 3408	symc810 - ok
22:51:34.0125 3408	symc8xx - ok
22:51:34.0140 3408	sym_hi - ok
22:51:34.0187 3408	sym_u3 - ok
22:51:34.0296 3408	sysaudio        (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
22:51:34.0312 3408	sysaudio - ok
22:51:34.0687 3408	Tcpip           (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS	cpip.sys
22:51:34.0750 3408	Tcpip - ok
22:51:35.0078 3408	TDPIPE          (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
22:51:35.0078 3408	TDPIPE - ok
22:51:35.0375 3408	TDTCP           (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
22:51:35.0375 3408	TDTCP - ok
22:51:35.0562 3408	TermDD          (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS	ermdd.sys
22:51:35.0578 3408	TermDD - ok
22:51:35.0718 3408	TosIde - ok
22:51:35.0843 3408	TrueSight       (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys
22:51:35.0875 3408	TrueSight - ok
22:51:36.0031 3408	uagp35          (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys
22:51:36.0062 3408	uagp35 - ok
22:51:36.0218 3408	Udfs            (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
22:51:36.0234 3408	Udfs - ok
22:51:36.0343 3408	ultra - ok
22:51:36.0531 3408	Update          (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
22:51:36.0546 3408	Update - ok
22:51:36.0734 3408	USBAAPL         (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
22:51:36.0734 3408	USBAAPL - ok
22:51:36.0921 3408	usbaudio        (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
22:51:36.0937 3408	usbaudio - ok
22:51:37.0203 3408	usbccgp         (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:51:37.0234 3408	usbccgp - ok
22:51:37.0406 3408	usbehci         (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:51:37.0421 3408	usbehci - ok
22:51:37.0625 3408	usbhub          (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:51:37.0640 3408	usbhub - ok
22:51:37.0906 3408	usbscan         (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:51:37.0906 3408	usbscan - ok
22:51:38.0171 3408	USBSTOR         (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:51:38.0203 3408	USBSTOR - ok
22:51:38.0375 3408	usbuhci         (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
22:51:38.0390 3408	usbuhci - ok
22:51:38.0640 3408	VgaSave         (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
22:51:38.0656 3408	VgaSave - ok
22:51:38.0859 3408	ViaIde          (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
22:51:38.0906 3408	ViaIde - ok
22:51:39.0171 3408	VolSnap         (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
22:51:39.0187 3408	VolSnap - ok
22:51:39.0453 3408	w200bus         (34923e278eac7ddcea717ae1fcf592f6) C:\WINDOWS\system32\DRIVERS\w200bus.sys
22:51:39.0484 3408	w200bus - ok
22:51:39.0656 3408	w200mdfl        (eff90a983cd3deab05922242e8072dc6) C:\WINDOWS\system32\DRIVERS\w200mdfl.sys
22:51:39.0671 3408	w200mdfl - ok
22:51:39.0906 3408	w200mdm         (f03da4fbb2708a0b5409ea63e88c0f50) C:\WINDOWS\system32\DRIVERS\w200mdm.sys
22:51:39.0953 3408	w200mdm - ok
22:51:40.0203 3408	w200mgmt        (1522d6387e6bb54aef9824b1733832db) C:\WINDOWS\system32\DRIVERS\w200mgmt.sys
22:51:40.0203 3408	w200mgmt - ok
22:51:40.0453 3408	w200obex        (8405be0bba1ccf26d0fbdd26be03c816) C:\WINDOWS\system32\DRIVERS\w200obex.sys
22:51:40.0515 3408	w200obex - ok
22:51:40.0796 3408	Wanarp          (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:51:40.0812 3408	Wanarp - ok
22:51:40.0953 3408	WDICA - ok
22:51:41.0218 3408	wdmaud          (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
22:51:41.0218 3408	wdmaud - ok
22:51:41.0781 3408	WmBEnum         (1abfd1399436e81c9d857f5fc76eaf98) C:\WINDOWS\system32\drivers\WmBEnum.sys
22:51:41.0796 3408	WmBEnum - ok
22:51:42.0187 3408	WmFilter        (b3cfcbcc91ff61ef82fc693b8b57e7f0) C:\WINDOWS\system32\drivers\WmFilter.sys
22:51:42.0203 3408	WmFilter - ok
22:51:42.0640 3408	WmVirHid        (a40d2dd0f019423ef6c363f1295eb38d) C:\WINDOWS\system32\drivers\WmVirHid.sys
22:51:42.0718 3408	WmVirHid - ok
22:51:43.0031 3408	WmXlCore        (2bf505424f469155cd90d7b3301d7adc) C:\WINDOWS\system32\drivers\WmXlCore.sys
22:51:43.0046 3408	WmXlCore - ok
22:51:43.0375 3408	WSTCODEC        (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
22:51:43.0406 3408	WSTCODEC - ok
22:51:43.0671 3408	zqvvdbvyy9 - ok
22:51:43.0921 3408	ZSMC301b        (73b6b26943db1660e35b99254336e2c8) C:\WINDOWS\system32\Drivers\usbVM31b.sys
22:51:43.0937 3408	ZSMC301b - ok
22:51:44.0000 3408	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
22:51:48.0453 3408	\Device\Harddisk0\DR0 - ok
22:51:48.0484 3408	Boot (0x1200)   (1c204c6158ac013f45bb8f7e0d051c99) \Device\Harddisk0\DR0\Partition0
22:51:48.0484 3408	\Device\Harddisk0\DR0\Partition0 - ok
22:51:48.0515 3408	Boot (0x1200)   (830ff424407abe83c7e40ab2846408ce) \Device\Harddisk0\DR0\Partition1
22:51:48.0531 3408	\Device\Harddisk0\DR0\Partition1 - ok
22:51:48.0531 3408	============================================================
22:51:48.0531 3408	Scan finished
22:51:48.0531 3408	============================================================
22:51:48.0562 3412	Detected object count: 2
22:51:48.0562 3412	Actual detected object count: 2
22:59:47.0718 3412	i8042prt ( ForgedFile.Multi.Generic ) - skipped by user
22:59:47.0718 3412	i8042prt ( ForgedFile.Multi.Generic ) - User select action: Skip 
22:59:47.0718 3412	ohci1394 ( ForgedFile.Multi.Generic ) - skipped by user
22:59:47.0734 3412	ohci1394 ( ForgedFile.Multi.Generic ) - User select action: Skip 
23:00:27.0453 2868	Deinitialize success--
Everything I do, I do it big. Wiz Khalifa.

juju666 · Answer

relance le scan mais fais cure si tu peux, si pas delete ;)

Rikyou · Answer

je l'ai fait, et maintenant :) ?

Rikyou · Answer

23:27:46.0796 0840	TDSS rootkit removing tool 2.6.22.0 Dec  7 2011 13:21:06
23:27:46.0906 0840	============================================================
23:27:46.0906 0840	Current date / time: 2011/12/12 23:27:46.0906
23:27:46.0906 0840	SystemInfo:
23:27:46.0906 0840	
23:27:46.0906 0840	OS Version: 5.1.2600 ServicePack: 2.0
23:27:46.0906 0840	Product type: Workstation
23:27:46.0906 0840	ComputerName: WORKSTATION
23:27:46.0906 0840	UserName: Propriétaire
23:27:46.0906 0840	Windows directory: C:\WINDOWS
23:27:46.0906 0840	System windows directory: C:\WINDOWS
23:27:46.0906 0840	Processor architecture: Intel x86
23:27:46.0906 0840	Number of processors: 1
23:27:46.0906 0840	Page size: 0x1000
23:27:46.0906 0840	Boot type: Normal boot
23:27:46.0906 0840	============================================================
23:27:48.0406 0840	Initialize success
23:27:52.0500 3296	============================================================
23:27:52.0500 3296	Scan started
23:27:52.0500 3296	Mode: Manual; 
23:27:52.0500 3296	============================================================
23:27:53.0281 3296	Scan interrupted by user!
23:27:53.0281 3296	Scan interrupted by user!
23:27:53.0281 3296	Scan interrupted by user!
23:27:53.0281 3296	============================================================
23:27:53.0281 3296	Scan finished
23:27:53.0281 3296	============================================================
23:27:53.0312 3316	Detected object count: 0
23:27:53.0312 3316	Actual detected object count: 0
23:27:54.0140 2488	============================================================
23:27:54.0140 2488	Scan started
23:27:54.0140 2488	Mode: Manual; 
23:27:54.0140 2488	============================================================
23:27:54.0343 2488	Abiosdsk - ok
23:27:54.0375 2488	abp480n5 - ok
23:27:54.0421 2488	ACPI            (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
23:27:54.0421 2488	ACPI - ok
23:27:54.0500 2488	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
23:27:54.0515 2488	ACPIEC - ok
23:27:54.0562 2488	adpu160m - ok
23:27:54.0609 2488	aec             (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
23:27:54.0640 2488	aec - ok
23:27:54.0765 2488	AFD             (944ca435bfcfc82cc1ed9e3a7d731aa9) C:\WINDOWS\System32\drivers\afd.sys
23:27:54.0796 2488	AFD - ok
23:27:54.0859 2488	Aha154x - ok
23:27:54.0890 2488	aic78u2 - ok
23:27:54.0921 2488	aic78xx - ok
23:27:55.0078 2488	ALCXWDM         (071757a906c7b3500916548e6fd8870b) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
23:27:55.0234 2488	ALCXWDM - ok
23:27:55.0312 2488	AliIde - ok
23:27:55.0375 2488	AmdK7           (c0f59933070392e662b3c2bb2be77955) C:\WINDOWS\system32\DRIVERS\amdk7.sys
23:27:55.0406 2488	AmdK7 - ok
23:27:55.0453 2488	amsint - ok
23:27:55.0531 2488	Arp1394         (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
23:27:55.0578 2488	Arp1394 - ok
23:27:55.0625 2488	asc - ok
23:27:55.0656 2488	asc3350p - ok
23:27:55.0687 2488	asc3550 - ok
23:27:55.0781 2488	AsyncMac        (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
23:27:55.0812 2488	AsyncMac - ok
23:27:55.0906 2488	atapi           (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
23:27:55.0937 2488	atapi - ok
23:27:55.0968 2488	Atdisk - ok
23:27:56.0109 2488	ati2mtag        (3b88b6466896cc1a3a7e3287d72aca85) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
23:27:56.0296 2488	ati2mtag - ok
23:27:56.0500 2488	Atmarpc         (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
23:27:56.0546 2488	Atmarpc - ok
23:27:56.0765 2488	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
23:27:56.0796 2488	audstub - ok
23:27:56.0968 2488	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
23:27:57.0000 2488	Beep - ok
23:27:57.0171 2488	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
23:27:57.0203 2488	cbidf2k - ok
23:27:57.0281 2488	CCDECODE        (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
23:27:57.0296 2488	CCDECODE - ok
23:27:57.0343 2488	cd20xrnt - ok
23:27:57.0406 2488	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
23:27:57.0421 2488	Cdaudio - ok
23:27:57.0484 2488	Cdfs            (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
23:27:57.0500 2488	Cdfs - ok
23:27:57.0546 2488	Cdrom           (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
23:27:57.0593 2488	Cdrom - ok
23:27:57.0625 2488	Changer - ok
23:27:57.0687 2488	CmdIde - ok
23:27:57.0734 2488	Cpqarray - ok
23:27:57.0796 2488	dac2w2k - ok
23:27:57.0828 2488	dac960nt - ok
23:27:57.0906 2488	Disk            (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
23:27:57.0921 2488	Disk - ok
23:27:58.0015 2488	dmboot          (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
23:27:58.0109 2488	dmboot - ok
23:27:58.0218 2488	dmio            (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
23:27:58.0265 2488	dmio - ok
23:27:58.0328 2488	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
23:27:58.0359 2488	dmload - ok
23:27:58.0421 2488	DMusic          (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
23:27:58.0468 2488	DMusic - ok
23:27:58.0500 2488	dpti2o - ok
23:27:58.0609 2488	driverhardwarev2 (aad5b49f2aabeb78f8e37984f475659e) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
23:27:58.0625 2488	driverhardwarev2 - ok
23:27:58.0750 2488	drmkaud         (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
23:27:58.0781 2488	drmkaud - ok
23:27:58.0812 2488	EagleNT - ok
23:27:58.0890 2488	Fastfat         (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
23:27:58.0921 2488	Fastfat - ok
23:27:59.0015 2488	Fdc             (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
23:27:59.0031 2488	Fdc - ok
23:27:59.0093 2488	FETNDIS         (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
23:27:59.0109 2488	FETNDIS - ok
23:27:59.0187 2488	Fips            (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
23:27:59.0218 2488	Fips - ok
23:27:59.0265 2488	Flpydisk        (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
23:27:59.0281 2488	Flpydisk - ok
23:27:59.0343 2488	FltMgr          (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
23:27:59.0375 2488	FltMgr - ok
23:27:59.0468 2488	fssfltr         (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
23:27:59.0468 2488	fssfltr - ok
23:27:59.0546 2488	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
23:27:59.0562 2488	Fs_Rec - ok
23:27:59.0625 2488	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
23:27:59.0656 2488	Ftdisk - ok
23:27:59.0750 2488	GEARAspiWDM     (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
23:27:59.0765 2488	GEARAspiWDM - ok
23:27:59.0828 2488	Gpc             (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
23:27:59.0875 2488	Gpc - ok
23:27:59.0937 2488	HidUsb          (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
23:27:59.0968 2488	HidUsb - ok
23:27:59.0984 2488	hpn - ok
23:28:00.0062 2488	HTTP            (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
23:28:00.0062 2488	HTTP - ok
23:28:00.0140 2488	i2omgmt - ok
23:28:00.0171 2488	i2omp - ok
23:28:00.0203 2488	i8042prt        (b4c177f19780948708646d6d124397cd) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
23:28:00.0218 2488	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\i8042prt.sys. Real md5: b4c177f19780948708646d6d124397cd, Fake md5: f41fff8a2299855dfb8fcb98412a90a7
23:28:00.0218 2488	i8042prt ( ForgedFile.Multi.Generic ) - warning
23:28:00.0218 2488	i8042prt - detected ForgedFile.Multi.Generic (1)
23:28:00.0296 2488	Imapi           (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
23:28:00.0343 2488	Imapi - ok
23:28:00.0375 2488	ini910u - ok
23:28:00.0406 2488	IntelIde - ok
23:28:00.0468 2488	Ip6Fw           (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
23:28:00.0484 2488	Ip6Fw - ok
23:28:00.0578 2488	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
23:28:00.0593 2488	IpFilterDriver - ok
23:28:00.0656 2488	IpInIp          (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
23:28:00.0703 2488	IpInIp - ok
23:28:00.0796 2488	IpNat           (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
23:28:00.0796 2488	IpNat - ok
23:28:00.0859 2488	IPSec           (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
23:28:00.0906 2488	IPSec - ok
23:28:00.0968 2488	IRENUM          (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
23:28:00.0984 2488	IRENUM - ok
23:28:01.0046 2488	isapnp          (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
23:28:01.0078 2488	isapnp - ok
23:28:01.0140 2488	izorex - ok
23:28:01.0187 2488	Kbdclass        (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
23:28:01.0218 2488	Kbdclass - ok
23:28:01.0281 2488	kbdhid          (62dd5eefcec4ef4163f1168d4262a9e4) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
23:28:01.0296 2488	kbdhid - ok
23:28:01.0359 2488	kmixer          (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
23:28:01.0390 2488	kmixer - ok
23:28:01.0453 2488	KSecDD          (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
23:28:01.0468 2488	KSecDD - ok
23:28:01.0515 2488	lbrtfdc - ok
23:28:01.0578 2488	MBAMSwissArmy - ok
23:28:01.0656 2488	mfeapfk         (b5c306c5b5e7417b9d2b410894678069) C:\WINDOWS\system32\drivers\mfeapfk.sys
23:28:01.0687 2488	mfeapfk - ok
23:28:01.0812 2488	mfeavfk         (87b28198b308af3469d6e0b81d86c1fa) C:\WINDOWS\system32\drivers\mfeavfk.sys
23:28:01.0828 2488	mfeavfk - ok
23:28:01.0890 2488	mfebopk         (cf37784dd24c83f62626bc0ea3f5e386) C:\WINDOWS\system32\drivers\mfebopk.sys
23:28:01.0921 2488	mfebopk - ok
23:28:01.0984 2488	mfehidk         (241c09c7d8c589ea1d72a36e6578e42c) C:\WINDOWS\system32\drivers\mfehidk.sys
23:28:02.0015 2488	mfehidk - ok
23:28:02.0125 2488	mferkdk         (37b5228bea6b4429ffb90dfa77af4431) C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
23:28:02.0140 2488	mferkdk - ok
23:28:02.0234 2488	mfetdik         (19c2d8af421e96d12e4004ca2162dbe9) C:\WINDOWS\system32\drivers\mfetdik.sys
23:28:02.0265 2488	mfetdik - ok
23:28:02.0328 2488	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
23:28:02.0359 2488	mnmdd - ok
23:28:02.0421 2488	Modem           (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
23:28:02.0421 2488	Modem - ok
23:28:02.0484 2488	MODEMCSA        (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
23:28:02.0500 2488	MODEMCSA - ok
23:28:02.0546 2488	Mouclass        (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
23:28:02.0578 2488	Mouclass - ok
23:28:02.0640 2488	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
23:28:02.0656 2488	mouhid - ok
23:28:02.0750 2488	MountMgr        (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
23:28:02.0765 2488	MountMgr - ok
23:28:02.0812 2488	mraid35x - ok
23:28:02.0875 2488	MRxDAV          (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
23:28:02.0921 2488	MRxDAV - ok
23:28:02.0984 2488	MRxSmb          (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
23:28:03.0062 2488	MRxSmb - ok
23:28:03.0171 2488	Msfs            (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
23:28:03.0187 2488	Msfs - ok
23:28:03.0265 2488	MSKSSRV         (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
23:28:03.0281 2488	MSKSSRV - ok
23:28:03.0343 2488	MSPCLOCK        (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
23:28:03.0359 2488	MSPCLOCK - ok
23:28:03.0406 2488	MSPQM           (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
23:28:03.0437 2488	MSPQM - ok
23:28:03.0500 2488	mssmbios        (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
23:28:03.0500 2488	mssmbios - ok
23:28:03.0562 2488	MSTEE           (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
23:28:03.0578 2488	MSTEE - ok
23:28:03.0656 2488	Mtlmnt5         (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
23:28:03.0703 2488	Mtlmnt5 - ok
23:28:03.0843 2488	Mtlstrm         (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
23:28:03.0921 2488	Mtlstrm - ok
23:28:04.0015 2488	Mup             (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
23:28:04.0031 2488	Mup - ok
23:28:04.0109 2488	NABTSFEC        (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
23:28:04.0125 2488	NABTSFEC - ok
23:28:04.0218 2488	NDIS            (93b984ecaff503d80c61e76a9959ceea) C:\WINDOWS\system32\drivers\NDIS.sys
23:28:04.0578 2488	NDIS - ok
23:28:04.0671 2488	NdisIP          (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
23:28:04.0703 2488	NdisIP - ok
23:28:04.0796 2488	NdisTapi        (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS
distapi.sys
23:28:04.0812 2488	NdisTapi - ok
23:28:04.0875 2488	Ndisuio         (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS
disuio.sys
23:28:04.0890 2488	Ndisuio - ok
23:28:04.0937 2488	NdisWan         (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS
diswan.sys
23:28:04.0968 2488	NdisWan - ok
23:28:05.0031 2488	NDProxy         (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
23:28:05.0062 2488	NDProxy - ok
23:28:05.0109 2488	NetBIOS         (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS
etbios.sys
23:28:05.0125 2488	NetBIOS - ok
23:28:05.0187 2488	NetBT           (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS
etbt.sys
23:28:05.0218 2488	NetBT - ok
23:28:05.0312 2488	NIC1394         (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS
ic1394.sys
23:28:05.0343 2488	NIC1394 - ok
23:28:05.0421 2488	nm              (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
23:28:05.0437 2488	nm - ok
23:28:05.0500 2488	Npfs            (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
23:28:05.0531 2488	Npfs - ok
23:28:05.0609 2488	Ntfs            (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
23:28:05.0671 2488	Ntfs - ok
23:28:05.0796 2488	NtMtlFax        (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
23:28:05.0843 2488	NtMtlFax - ok
23:28:05.0906 2488	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
23:28:05.0921 2488	Null - ok
23:28:05.0984 2488	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
23:28:06.0000 2488	NwlnkFlt - ok
23:28:06.0062 2488	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
23:28:06.0093 2488	NwlnkFwd - ok
23:28:06.0156 2488	ohci1394        (8800483b09d1a28edae0af60ed24425e) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
23:28:06.0171 2488	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ohci1394.sys. Real md5: 8800483b09d1a28edae0af60ed24425e, Fake md5: e50531721efcad1323add311425b21fc
23:28:06.0171 2488	ohci1394 ( ForgedFile.Multi.Generic ) - warning
23:28:06.0171 2488	ohci1394 - detected ForgedFile.Multi.Generic (1)
23:28:06.0281 2488	Parport         (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\DRIVERS\parport.sys
23:28:06.0328 2488	Parport - ok
23:28:06.0390 2488	PartMgr         (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
23:28:06.0421 2488	PartMgr - ok
23:28:06.0468 2488	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
23:28:06.0500 2488	ParVdm - ok
23:28:06.0562 2488	PCI             (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
23:28:06.0578 2488	PCI - ok
23:28:06.0609 2488	PCIDump - ok
23:28:06.0656 2488	PCIIde          (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
23:28:06.0671 2488	PCIIde - ok
23:28:06.0765 2488	Pcmcia          (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\drivers\Pcmcia.sys
23:28:06.0796 2488	Pcmcia - ok
23:28:06.0859 2488	PDCOMP - ok
23:28:06.0875 2488	PDFRAME - ok
23:28:06.0906 2488	PDRELI - ok
23:28:06.0921 2488	PDRFRAME - ok
23:28:06.0953 2488	perc2 - ok
23:28:06.0968 2488	perc2hib - ok
23:28:07.0062 2488	PptpMiniport    (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERSaspptp.sys
23:28:07.0093 2488	PptpMiniport - ok
23:28:07.0187 2488	PSched          (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
23:28:07.0218 2488	PSched - ok
23:28:07.0281 2488	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
23:28:07.0312 2488	Ptilink - ok
23:28:07.0359 2488	PxHelp20        (0c8da0a8b0d227319c285e0eae65defd) C:\WINDOWS\system32\Drivers\PxHelp20.sys
23:28:07.0390 2488	PxHelp20 - ok
23:28:07.0421 2488	ql1080 - ok
23:28:07.0453 2488	Ql10wnt - ok
23:28:07.0468 2488	ql12160 - ok
23:28:07.0500 2488	ql1240 - ok
23:28:07.0515 2488	ql1280 - ok
23:28:07.0578 2488	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
23:28:07.0593 2488	RasAcd - ok
23:28:07.0687 2488	Rasl2tp         (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERSasl2tp.sys
23:28:07.0718 2488	Rasl2tp - ok
23:28:07.0796 2488	RasPppoe        (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERSaspppoe.sys
23:28:07.0843 2488	RasPppoe - ok
23:28:07.0890 2488	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
23:28:07.0921 2488	Raspti - ok
23:28:08.0000 2488	Rdbss           (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERSdbss.sys
23:28:08.0046 2488	Rdbss - ok
23:28:08.0109 2488	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
23:28:08.0140 2488	RDPCDD - ok
23:28:08.0218 2488	RDPWD           (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
23:28:08.0281 2488	RDPWD - ok
23:28:08.0359 2488	RecAgent        (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
23:28:08.0375 2488	RecAgent - ok
23:28:08.0437 2488	redbook         (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERSedbook.sys
23:28:08.0484 2488	redbook - ok
23:28:08.0593 2488	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
23:28:08.0640 2488	Secdrv - ok
23:28:08.0734 2488	serenum         (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
23:28:08.0765 2488	serenum - ok
23:28:08.0828 2488	Serial          (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\DRIVERS\serial.sys
23:28:08.0859 2488	Serial - ok
23:28:08.0906 2488	Sfloppy         (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
23:28:08.0953 2488	Sfloppy - ok
23:28:09.0000 2488	Simbad - ok
23:28:09.0046 2488	SIS163u         (c2299af684920f592d87aa002d072080) C:\WINDOWS\system32\DRIVERS\sis163u.sys
23:28:09.0078 2488	SIS163u - ok
23:28:09.0125 2488	sjzfmmz - ok
23:28:09.0187 2488	SLIP            (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
23:28:09.0234 2488	SLIP - ok
23:28:09.0312 2488	Slntamr         (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
23:28:09.0375 2488	Slntamr - ok
23:28:09.0453 2488	SlNtHal         (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
23:28:09.0484 2488	SlNtHal - ok
23:28:09.0546 2488	SlWdmSup        (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
23:28:09.0562 2488	SlWdmSup - ok
23:28:09.0593 2488	Sparrow - ok
23:28:09.0640 2488	splitter        (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
23:28:09.0671 2488	splitter - ok
23:28:09.0812 2488	sr              (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
23:28:09.0859 2488	sr - ok
23:28:09.0937 2488	Srv             (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINDOWS\system32\DRIVERS\srv.sys
23:28:09.0984 2488	Srv - ok
23:28:10.0062 2488	streamip        (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
23:28:10.0109 2488	streamip - ok
23:28:10.0203 2488	swenum          (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
23:28:10.0218 2488	swenum - ok
23:28:10.0281 2488	swmidi          (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
23:28:10.0312 2488	swmidi - ok
23:28:10.0359 2488	symc810 - ok
23:28:10.0375 2488	symc8xx - ok
23:28:10.0406 2488	sym_hi - ok
23:28:10.0421 2488	sym_u3 - ok
23:28:10.0468 2488	sysaudio        (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
23:28:10.0500 2488	sysaudio - ok
23:28:10.0609 2488	Tcpip           (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS	cpip.sys
23:28:10.0671 2488	Tcpip - ok
23:28:10.0781 2488	TDPIPE          (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
23:28:10.0812 2488	TDPIPE - ok
23:28:10.0875 2488	TDTCP           (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
23:28:10.0921 2488	TDTCP - ok
23:28:10.0984 2488	TermDD          (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS	ermdd.sys
23:28:11.0015 2488	TermDD - ok
23:28:11.0062 2488	TosIde - ok
23:28:11.0109 2488	TrueSight       (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys
23:28:11.0140 2488	TrueSight - ok
23:28:11.0234 2488	uagp35          (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys
23:28:11.0265 2488	uagp35 - ok
23:28:11.0328 2488	Udfs            (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
23:28:11.0359 2488	Udfs - ok
23:28:11.0390 2488	ultra - ok
23:28:11.0453 2488	Update          (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
23:28:11.0484 2488	Update - ok
23:28:11.0609 2488	USBAAPL         (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
23:28:11.0656 2488	USBAAPL - ok
23:28:11.0750 2488	usbaudio        (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
23:28:11.0781 2488	usbaudio - ok
23:28:11.0859 2488	usbccgp         (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
23:28:11.0875 2488	usbccgp - ok
23:28:11.0937 2488	usbehci         (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
23:28:11.0968 2488	usbehci - ok
23:28:12.0031 2488	usbhub          (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
23:28:12.0078 2488	usbhub - ok
23:28:12.0140 2488	usbscan         (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
23:28:12.0156 2488	usbscan - ok
23:28:12.0218 2488	USBSTOR         (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
23:28:12.0250 2488	USBSTOR - ok
23:28:12.0296 2488	usbuhci         (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
23:28:12.0343 2488	usbuhci - ok
23:28:12.0406 2488	VgaSave         (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
23:28:12.0421 2488	VgaSave - ok
23:28:12.0484 2488	ViaIde          (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
23:28:12.0531 2488	ViaIde - ok
23:28:12.0578 2488	VolSnap         (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
23:28:12.0609 2488	VolSnap - ok
23:28:12.0671 2488	w200bus         (34923e278eac7ddcea717ae1fcf592f6) C:\WINDOWS\system32\DRIVERS\w200bus.sys
23:28:12.0687 2488	w200bus - ok
23:28:12.0781 2488	w200mdfl        (eff90a983cd3deab05922242e8072dc6) C:\WINDOWS\system32\DRIVERS\w200mdfl.sys
23:28:12.0796 2488	w200mdfl - ok
23:28:12.0859 2488	w200mdm         (f03da4fbb2708a0b5409ea63e88c0f50) C:\WINDOWS\system32\DRIVERS\w200mdm.sys
23:28:12.0890 2488	w200mdm - ok
23:28:12.0953 2488	w200mgmt        (1522d6387e6bb54aef9824b1733832db) C:\WINDOWS\system32\DRIVERS\w200mgmt.sys
23:28:12.0984 2488	w200mgmt - ok
23:28:13.0046 2488	w200obex        (8405be0bba1ccf26d0fbdd26be03c816) C:\WINDOWS\system32\DRIVERS\w200obex.sys
23:28:13.0078 2488	w200obex - ok
23:28:13.0156 2488	Wanarp          (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
23:28:13.0187 2488	Wanarp - ok
23:28:13.0234 2488	WDICA - ok
23:28:13.0281 2488	wdmaud          (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
23:28:13.0296 2488	wdmaud - ok
23:28:13.0421 2488	WmBEnum         (1abfd1399436e81c9d857f5fc76eaf98) C:\WINDOWS\system32\drivers\WmBEnum.sys
23:28:13.0437 2488	WmBEnum - ok
23:28:13.0515 2488	WmFilter        (b3cfcbcc91ff61ef82fc693b8b57e7f0) C:\WINDOWS\system32\drivers\WmFilter.sys
23:28:13.0531 2488	WmFilter - ok
23:28:13.0609 2488	WmVirHid        (a40d2dd0f019423ef6c363f1295eb38d) C:\WINDOWS\system32\drivers\WmVirHid.sys
23:28:13.0625 2488	WmVirHid - ok
23:28:13.0687 2488	WmXlCore        (2bf505424f469155cd90d7b3301d7adc) C:\WINDOWS\system32\drivers\WmXlCore.sys
23:28:13.0703 2488	WmXlCore - ok
23:28:13.0796 2488	WSTCODEC        (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
23:28:13.0828 2488	WSTCODEC - ok
23:28:13.0890 2488	zqvvdbvyy9 - ok
23:28:13.0937 2488	ZSMC301b        (73b6b26943db1660e35b99254336e2c8) C:\WINDOWS\system32\Drivers\usbVM31b.sys
23:28:13.0968 2488	ZSMC301b - ok
23:28:14.0015 2488	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
23:28:14.0093 2488	\Device\Harddisk0\DR0 - ok
23:28:14.0109 2488	Boot (0x1200)   (1c204c6158ac013f45bb8f7e0d051c99) \Device\Harddisk0\DR0\Partition0
23:28:14.0109 2488	\Device\Harddisk0\DR0\Partition0 - ok
23:28:14.0156 2488	Boot (0x1200)   (830ff424407abe83c7e40ab2846408ce) \Device\Harddisk0\DR0\Partition1
23:28:14.0156 2488	\Device\Harddisk0\DR0\Partition1 - ok
23:28:14.0156 2488	============================================================
23:28:14.0156 2488	Scan finished
23:28:14.0156 2488	============================================================
23:28:14.0187 3476	Detected object count: 2
23:28:14.0187 3476	Actual detected object count: 2
23:28:31.0500 3476	HKLM\SYSTEM\ControlSet002\services\i8042prt - will be deleted on reboot
23:28:31.0500 3476	HKLM\SYSTEM\ControlSet003\services\i8042prt - will be deleted on reboot
23:28:31.0500 3476	HKLM\SYSTEM\ControlSet004\services\i8042prt - will be deleted on reboot
23:28:31.0531 3476	C:\WINDOWS\system32\DRIVERS\i8042prt.sys - will be deleted on reboot
23:28:31.0531 3476	i8042prt ( ForgedFile.Multi.Generic ) - User select action: Delete 
23:28:31.0531 3476	HKLM\SYSTEM\ControlSet002\services\ohci1394 - will be deleted on reboot
23:28:31.0531 3476	HKLM\SYSTEM\ControlSet003\services\ohci1394 - will be deleted on reboot
23:28:31.0531 3476	HKLM\SYSTEM\ControlSet004\services\ohci1394 - will be deleted on reboot
23:28:31.0546 3476	C:\WINDOWS\system32\DRIVERS\ohci1394.sys - will be deleted on reboot
23:28:31.0546 3476	ohci1394 ( ForgedFile.Multi.Generic ) - User select action: Delete 
23:28:39.0390 0832	Deinitialize success--
Everything I do, I do it big. Wiz Khalifa.

Rikyou · Answer

c'est le rapport de delete, il n'y avait pas cure ^^.

juju666 · Answer

Bien.

Nous allons effectuer un diagnostic de ton PC: 

&#9654 Télécharge ZHPDiag 

&#9654 Laisse toi guider lors de l'installation,coche "Ajouter une icône sur le bureau" et  "Exécuter ZHPDiag" 

&#9654 Clique sur l'icône représentant un tournevis vert et coche tout, puis sur l'icone représentant une loupe (« Lancer le diagnostic ») 

&#9654 Durant le scan, accepte l'installation de SigCheck

&#9654 Une fois le scan aux 100%, ferme ZHPDiag. Héberge le rapport ZHPDiag.txt présent sur ton bureau.

Voici comment procéder

&#9654 Rends toi sur pjjoint.malekal.com 
&#9654 Clique sur le bouton Parcourir 
&#9654 Sélectionne le fichier que tu veux héberger et clique sur Ouvrir 
&#9654 Clique sur le bouton Envoyer 
&#9654 Un message de confirmation s'affiche (L'upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015 

&#9654 Copie le lien dans ta prochaine réponse. 

Tutoriel : http://forums-fec.be/entraide/viewtopic.php?f=55&t=13 

A bientôt.

Rikyou · Answer

Merci pour ton aide mais malheureusement, le virus a eu raison de mon ordinateur, il fait un écrant noir au démarrage et je ne peux rien faire, je suis las de tout ces problemes, je te remerci encore une fois pour tout et à bientôt :).

juju666 · Answer

Salut,

Désolé du retard (examens de noël !)

Du coup que fais tu de ton pc ? on peut démarrer en cd live dessus pour tenter de rétablir ça !

Rikyou · Answer

Pour le démarrer en cd live il faut un graveur non ?

Malwarebytes

32 réponses

Discussions similaires