Probleme virus XP 2012

Résolu
lajez Messages postés 9 Statut Membre -  
lajez Messages postés 9 Statut Membre -
Bonjour,



Je suis infesté par le virus XP 2012, j'ai réussi à lancer rogue killer. Quelqu'un pourrait-il m'aider à partir du rapport réalisé.

RogueKiller V6.2.0 [12/12/2011] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: https://www.luanagames.com/index.fr.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: Romain [Droits d'admin]
Mode: Recherche -- Date : 21/12/2011 00:18:35

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 5 ¤¤¤
[HJ] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> FOUND
[HJ] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> FOUND
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[FILEASSO] HKLM\[...]Software\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command : ("C:\Documents and Settings\NetworkService\Local Settings\Application Data\pje.exe" -a "C:\Program Files\Mozilla Firefox 2 Beta 2\firefox.exe" -safe-mode) -> FOUND

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[FOLDER] plugs : c:\documents and settings\romain\application data\adobe\plugs --> FOUND
[FOLDER] shed : c:\documents and settings\romain\application data\adobe\shed --> FOUND

¤¤¤ Driver: [LOADED] ¤¤¤
S_SSDT[0] : -> HOOKED ( @ 0x00000000)

¤¤¤ Infection : Rogue.AntiSpy-AH|Root.MBR ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
127.0.0.1 bin.errorprotector.com ## added by CiD
127.0.0.1 br.errorsafe.com ## added by CiD
127.0.0.1 br.winantivirus.com ## added by CiD
127.0.0.1 br.winfixer.com ## added by CiD
127.0.0.1 cdn.drivecleaner.com ## added by CiD
127.0.0.1 cdn.errorsafe.com ## added by CiD
127.0.0.1 cdn.winsoftware.com ## added by CiD
127.0.0.1 de.errorsafe.com ## added by CiD
127.0.0.1 de.winantivirus.com ## added by CiD
127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
127.0.0.1 download.cdn.errorsafe.com ## added by CiD
127.0.0.1 download.cdn.winsoftware.com ## added by CiD
127.0.0.1 download.errorsafe.com ## added by CiD
127.0.0.1 download.systemdoctor.com ## added by CiD
127.0.0.1 download.winantispyware.com ## added by CiD
127.0.0.1 download.windrivecleaner.com ## added by CiD
127.0.0.1 download.winfixer.com ## added by CiD
127.0.0.1 drivecleaner.com ## added by CiD
127.0.0.1 dynamique.drivecleaner.com ## added by CiD
[...]

¤¤¤ MBR Verif: ¤¤¤
--- User ---
[MBR] 0b18409534474a717a78d509b6ba3081
[BSP] 115f5cb7bd1141e872924e5736d587e5 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNW [HIDDEN!] Offset (sectors): 63 | Size: 5239 Mo
1 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 10233405 | Size: 122145 Mo
2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 248798655 | Size: 122671 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 243a844a712de45616454dbf075f5eda
[BSP] afc08b0fcd7a76bd3cf5288f55612f90 : MBR Code unknown
Partition table:
0 - [XXXXXX] UNKNW [HIDDEN!] Offset (sectors): 63 | Size: 5239 Mo
1 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 10233405 | Size: 122145 Mo
2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 248798655 | Size: 122671 Mo

Termine : << RKreport[1].txt >>
RKreport[1].txt

MERCI

8 réponses

  1. Utilisateur anonyme
     
    Bonjour

    * Quitter tous les programmes en cours
    * lancer sRogueKiller.exe
    * Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
    * Lorsque demandé, taper 2 et valider
    * Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), colle son contenu dans la réponse
    * Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe

    ========================================

    * Quitter tous les programmes en cours
    * Sous Vista/Seven , clic droit -> lancer en tant qu'administrateur
    * lancer RogueKiller.exe
    * Lorsque demandé, taper 3 et valider
    * Un rapport à dû s'ouvrir (RKreport.txt se trouve également à côté de l'exécutable), colle son contenu dans la réponse
    * Si le programme a été bloqué, ne pas hésiter a essayer plusieurs fois. Si vraiment cela ne passe pas (ça peut arriver), le renommer en winlogon.exe

    ===================================================

    -Télécharge l'utilitaire TDSSKiller (de Kaspersky) sur ton Bureau.

    http://fradesch.perso.cegetel.net/transf/Load_tdsskiller.exe

    * Lance TDSSKiller.exe

    -Sous XP double-clic sur l'icône pour lancer l'outil.
    - Sous Vista/Seven clic-droit sur l'icône et choisir "Exécuter en tant qu'administrateur" dans le menu contextuel.

    * Clique sur Start scan.
    * Laisse l'outil balayer ton système sans l'interrompre et sans utiliser le PC.
    * Conserve l'action proposée par défaut par l'outil
    - Si TDSS.tdl2 : l'option Delete sera cochée.
    - Si TDSS.tdl3 ou TDSS.tdl4 : assure toi que Cure soit bien cochée.
    - Si "Suspicious object" laisse l'option cochée sur Skip
    - Si Rootkit.Win32.ZAccess.* est détecté règle sur cure en haut , et delete en bas

    * Clique sur Continue puis sur Reboot now si le redémarrage est proposé.
    * Le rapport se trouve à la racine du disque principal : C:\TDSSKiller.n° de version_date_heure_log.txt

    ========================================================

    * Télécharge et installe : Malwarebyte's Anti-Malware
    * A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
    * Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
    * Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
    * Sélectionne tes disques durs" puis clique sur "Lancer l'examen"
    * A la fin du scan, clique sur Afficher les résultats
    * Coche tous les éléments détectés puis clique sur Supprimer la sélection
    * Enregistre le rapport
    * S'il t'est demandé de redémarrer, clique sur Yes
    * Poste le rapport de scan après la suppression ici.(poste le rapport, même si rien n'est détecté.)
    * Si tu as besoin d'aide regarde ce tutorial
    https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

    0
    1. lajez Messages postés 9 Statut Membre
       
      Voici le rapport avec tdss killer (le scan est en cours avec malwarebytes, je l'envoie apres).

      12:35:24.0000 3912 ============================================================
      12:35:24.0000 3912 Current date / time: 2011/12/21 12:35:24.0000
      12:35:24.0000 3912 SystemInfo:
      12:35:24.0000 3912
      12:35:24.0000 3912 OS Version: 5.1.2600 ServicePack: 3.0
      12:35:24.0000 3912 Product type: Workstation
      12:35:24.0000 3912 ComputerName: NONO
      12:35:24.0000 3912 UserName: Romain
      12:35:24.0000 3912 Windows directory: C:\WINDOWS
      12:35:24.0000 3912 System windows directory: C:\WINDOWS
      12:35:24.0000 3912 Processor architecture: Intel x86
      12:35:24.0000 3912 Number of processors: 2
      12:35:24.0000 3912 Page size: 0x1000
      12:35:24.0000 3912 Boot type: Normal boot
      12:35:24.0000 3912 ============================================================
      12:35:25.0750 3912 Initialize success
      12:35:27.0171 3780 ============================================================
      12:35:27.0171 3780 Scan started
      12:35:27.0171 3780 Mode: Manual;
      12:35:27.0171 3780 ============================================================
      12:35:29.0593 3780 Abiosdsk - ok
      12:35:29.0796 3780 abp480n5 - ok
      12:35:29.0875 3780 ACPI (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
      12:35:29.0875 3780 ACPI - ok
      12:35:29.0921 3780 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
      12:35:29.0921 3780 ACPIEC - ok
      12:35:30.0140 3780 adpu160m - ok
      12:35:30.0218 3780 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
      12:35:30.0218 3780 aec - ok
      12:35:30.0390 3780 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys
      12:35:30.0390 3780 Afc - ok
      12:35:30.0500 3780 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
      12:35:30.0500 3780 AFD - ok
      12:35:30.0812 3780 Aha154x - ok
      12:35:31.0015 3780 aic78u2 - ok
      12:35:31.0218 3780 aic78xx - ok
      12:35:31.0484 3780 ALCXWDM (93f93a8e3e14cbbf1ce9a5af1a70c095) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
      12:35:31.0640 3780 ALCXWDM - ok
      12:35:31.0843 3780 AliIde - ok
      12:35:32.0000 3780 AmdK8 (62271ff14baa810323ac816c5d355ba9) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
      12:35:32.0000 3780 AmdK8 - ok
      12:35:32.0203 3780 amsint - ok
      12:35:32.0281 3780 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
      12:35:32.0281 3780 Arp1394 - ok
      12:35:32.0468 3780 asc - ok
      12:35:32.0656 3780 asc3350p - ok
      12:35:32.0890 3780 asc3550 - ok
      12:35:32.0984 3780 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
      12:35:32.0984 3780 AsyncMac - ok
      12:35:33.0046 3780 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
      12:35:33.0046 3780 atapi - ok
      12:35:33.0250 3780 Atdisk - ok
      12:35:33.0296 3780 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
      12:35:33.0312 3780 Atmarpc - ok
      12:35:33.0437 3780 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
      12:35:33.0437 3780 audstub - ok
      12:35:33.0609 3780 AVWLP_USB (509fe795ac0031daedea89a2bc3f1748) C:\WINDOWS\system32\DRIVERS\AVWLPUSB.sys
      12:35:33.0625 3780 AVWLP_USB - ok
      12:35:33.0703 3780 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
      12:35:33.0703 3780 Beep - ok
      12:35:33.0812 3780 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
      12:35:33.0828 3780 Bridge - ok
      12:35:33.0828 3780 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys
      12:35:33.0843 3780 BridgeMP - ok
      12:35:33.0875 3780 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
      12:35:33.0875 3780 cbidf2k - ok
      12:35:33.0937 3780 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
      12:35:33.0953 3780 CCDECODE - ok
      12:35:34.0140 3780 cd20xrnt - ok
      12:35:34.0171 3780 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
      12:35:34.0171 3780 Cdaudio - ok
      12:35:34.0234 3780 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
      12:35:34.0234 3780 Cdfs - ok
      12:35:34.0296 3780 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
      12:35:34.0296 3780 Cdrom - ok
      12:35:34.0484 3780 Changer - ok
      12:35:34.0718 3780 CmdIde - ok
      12:35:34.0937 3780 Cpqarray - ok
      12:35:35.0125 3780 dac2w2k - ok
      12:35:35.0328 3780 dac960nt - ok
      12:35:35.0390 3780 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
      12:35:35.0390 3780 Disk - ok
      12:35:35.0468 3780 dmboot (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
      12:35:35.0500 3780 dmboot - ok
      12:35:35.0546 3780 dmio (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
      12:35:35.0562 3780 dmio - ok
      12:35:35.0578 3780 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
      12:35:35.0578 3780 dmload - ok
      12:35:35.0671 3780 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
      12:35:35.0671 3780 DMusic - ok
      12:35:35.0875 3780 dpti2o - ok
      12:35:35.0921 3780 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
      12:35:35.0921 3780 drmkaud - ok
      12:35:36.0125 3780 F-Secure Standalone Minifilter - ok
      12:35:36.0171 3780 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
      12:35:36.0171 3780 Fastfat - ok
      12:35:36.0218 3780 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
      12:35:36.0234 3780 Fdc - ok
      12:35:36.0437 3780 Fips (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
      12:35:36.0437 3780 Fips - ok
      12:35:36.0640 3780 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
      12:35:36.0640 3780 Flpydisk - ok
      12:35:36.0765 3780 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
      12:35:36.0765 3780 FltMgr - ok
      12:35:36.0906 3780 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
      12:35:36.0906 3780 fssfltr - ok
      12:35:36.0953 3780 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
      12:35:36.0953 3780 Fs_Rec - ok
      12:35:37.0000 3780 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
      12:35:37.0000 3780 Ftdisk - ok
      12:35:37.0140 3780 GEARAspiWDM (ab8a6a87d9d7255c3884d5b9541a6e80) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
      12:35:37.0140 3780 GEARAspiWDM - ok
      12:35:37.0343 3780 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
      12:35:37.0343 3780 Gpc - ok
      12:35:37.0546 3780 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
      12:35:37.0546 3780 hidusb - ok
      12:35:37.0750 3780 hpn - ok
      12:35:37.0890 3780 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
      12:35:37.0890 3780 HPZid412 - ok
      12:35:38.0031 3780 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
      12:35:38.0031 3780 HPZipr12 - ok
      12:35:38.0171 3780 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
      12:35:38.0171 3780 HPZius12 - ok
      12:35:38.0312 3780 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
      12:35:38.0312 3780 HTTP - ok
      12:35:38.0515 3780 i2omgmt - ok
      12:35:38.0718 3780 i2omp - ok
      12:35:38.0937 3780 i8042prt (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
      12:35:38.0937 3780 i8042prt - ok
      12:35:39.0171 3780 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
      12:35:39.0171 3780 Imapi - ok
      12:35:39.0375 3780 ini910u - ok
      12:35:39.0375 3780 int15.sys - ok
      12:35:39.0578 3780 IntelIde - ok
      12:35:39.0671 3780 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
      12:35:39.0671 3780 Ip6Fw - ok
      12:35:39.0718 3780 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
      12:35:39.0718 3780 IpFilterDriver - ok
      12:35:39.0921 3780 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
      12:35:39.0921 3780 IpInIp - ok
      12:35:40.0140 3780 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
      12:35:40.0140 3780 IpNat - ok
      12:35:40.0359 3780 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
      12:35:40.0359 3780 IPSec - ok
      12:35:40.0562 3780 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
      12:35:40.0578 3780 irda - ok
      12:35:40.0781 3780 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
      12:35:40.0781 3780 IRENUM - ok
      12:35:40.0906 3780 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
      12:35:40.0906 3780 irsir - ok
      12:35:41.0093 3780 isapnp (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
      12:35:41.0093 3780 isapnp - ok
      12:35:41.0343 3780 Kbdclass (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
      12:35:41.0343 3780 Kbdclass - ok
      12:35:41.0546 3780 kbdhid (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
      12:35:41.0546 3780 kbdhid - ok
      12:35:41.0750 3780 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
      12:35:41.0765 3780 kmixer - ok
      12:35:41.0828 3780 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
      12:35:41.0828 3780 KSecDD - ok
      12:35:42.0015 3780 lbrtfdc - ok
      12:35:42.0234 3780 LVcKap (8113133ec42dd6c566908008ce913edd) C:\WINDOWS\system32\DRIVERS\LVcKap.sys
      12:35:42.0296 3780 LVcKap - ok
      12:35:42.0531 3780 LVMVDrv (0dd5b8af4917a2821047450195c511b3) C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys
      12:35:42.0578 3780 LVMVDrv - ok
      12:35:42.0781 3780 LVPr2Mon (406b1d186f75b4b4832d6237859e1b00) C:\WINDOWS\system32\drivers\LVPr2Mon.sys
      12:35:42.0781 3780 LVPr2Mon - ok
      12:35:42.0937 3780 LVUSBSta (be5e104be263921d6842c555db6a5c23) C:\WINDOWS\system32\drivers\LVUSBSta.sys
      12:35:42.0937 3780 LVUSBSta - ok
      12:35:43.0000 3780 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
      12:35:43.0000 3780 mnmdd - ok
      12:35:43.0203 3780 Modem (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
      12:35:43.0218 3780 Modem - ok
      12:35:43.0453 3780 Mouclass (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
      12:35:43.0453 3780 Mouclass - ok
      12:35:43.0625 3780 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
      12:35:43.0625 3780 mouhid - ok
      12:35:43.0828 3780 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
      12:35:43.0828 3780 MountMgr - ok
      12:35:44.0015 3780 mraid35x - ok
      12:35:44.0078 3780 MRVW225 (5d235daa0a9feed8d880df7277d6ccc8) C:\WINDOWS\system32\DRIVERS\MRVW225.sys
      12:35:44.0093 3780 MRVW225 - ok
      12:35:44.0281 3780 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
      12:35:44.0296 3780 MRxDAV - ok
      12:35:44.0453 3780 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
      12:35:44.0468 3780 MRxSmb - ok
      12:35:44.0687 3780 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
      12:35:44.0687 3780 Msfs - ok
      12:35:44.0875 3780 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
      12:35:44.0875 3780 MSKSSRV - ok
      12:35:45.0062 3780 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
      12:35:45.0062 3780 MSPCLOCK - ok
      12:35:45.0234 3780 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
      12:35:45.0234 3780 MSPQM - ok
      12:35:45.0343 3780 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
      12:35:45.0343 3780 mssmbios - ok
      12:35:45.0500 3780 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
      12:35:45.0500 3780 MSTEE - ok
      12:35:45.0578 3780 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
      12:35:45.0578 3780 Mup - ok
      12:35:45.0781 3780 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
      12:35:45.0781 3780 NABTSFEC - ok
      12:35:45.0968 3780 NBXG7031 (cc6d9f85df0f35c8fe8508a8172fb41e) C:\WINDOWS\system32\DRIVERS\WlanUIG.sys
      12:35:45.0968 3780 NBXG7031 - ok
      12:35:46.0156 3780 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
      12:35:46.0156 3780 NDIS - ok
      12:35:46.0343 3780 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
      12:35:46.0343 3780 NdisIP - ok
      12:35:46.0500 3780 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
      12:35:46.0500 3780 NdisTapi - ok
      12:35:46.0718 3780 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
      12:35:46.0718 3780 Ndisuio - ok
      12:35:46.0921 3780 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
      12:35:46.0921 3780 NdisWan - ok
      12:35:47.0078 3780 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
      12:35:47.0078 3780 NDProxy - ok
      12:35:47.0265 3780 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
      12:35:47.0265 3780 NetBIOS - ok
      12:35:47.0453 3780 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
      12:35:47.0453 3780 NetBT - ok
      12:35:47.0718 3780 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
      12:35:47.0718 3780 NIC1394 - ok
      12:35:47.0906 3780 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
      12:35:47.0906 3780 Npfs - ok
      12:35:48.0109 3780 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
      12:35:48.0125 3780 Ntfs - ok
      12:35:48.0234 3780 NTIDrvr (7f1c1f78d709c4a54cbb46ede7e0b48d) C:\WINDOWS\system32\DRIVERS\NTIDrvr.sys
      12:35:48.0234 3780 NTIDrvr - ok
      12:35:48.0281 3780 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
      12:35:48.0281 3780 Null - ok
      12:35:48.0515 3780 nv (6f6f92603a4311a466f0241e8ef951fb) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
      12:35:48.0609 3780 nv - ok
      12:35:48.0765 3780 NVENETFD (2a7a2c6ab9631028b6e3a4159aa65705) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
      12:35:48.0765 3780 NVENETFD - ok
      12:35:48.0890 3780 nvnetbus (20526a8827dc0956b5526aebcb6751a0) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
      12:35:48.0890 3780 nvnetbus - ok
      12:35:48.0953 3780 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
      12:35:48.0953 3780 NwlnkFlt - ok
      12:35:48.0984 3780 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
      12:35:48.0984 3780 NwlnkFwd - ok
      12:35:49.0156 3780 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
      12:35:49.0156 3780 ohci1394 - ok
      12:35:49.0343 3780 Parport (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
      12:35:49.0343 3780 Parport - ok
      12:35:49.0531 3780 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
      12:35:49.0531 3780 PartMgr - ok
      12:35:49.0562 3780 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
      12:35:49.0562 3780 ParVdm - ok
      12:35:49.0968 3780 PCAMPR5 (b670c5d89f0726b7a2a7dfb4e968cdf8) C:\WINDOWS\system32\PCAMPR5.SYS
      12:35:49.0968 3780 PCAMPR5 - ok
      12:35:50.0359 3780 PCANDIS5 (ecd2f9d67b06606064daf6961a6d5efe) C:\WINDOWS\system32\PCANDIS5.SYS
      12:35:50.0375 3780 PCANDIS5 - ok
      12:35:50.0500 3780 PCASp50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\WINDOWS\system32\Drivers\PCASp50.sys
      12:35:50.0500 3780 PCASp50 - ok
      12:35:50.0671 3780 PCI (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
      12:35:50.0671 3780 PCI - ok
      12:35:50.0859 3780 PCIDump - ok
      12:35:50.0890 3780 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
      12:35:50.0890 3780 PCIIde - ok
      12:35:51.0093 3780 Pcmcia (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
      12:35:51.0093 3780 Pcmcia - ok
      12:35:51.0218 3780 pcouffin (02aaafb7ba137ce5ddabcdf8090954d9) C:\WINDOWS\system32\Drivers\pcouffin.sys
      12:35:51.0218 3780 pcouffin - ok
      12:35:51.0390 3780 PDCOMP - ok
      12:35:51.0562 3780 PDFRAME - ok
      12:35:51.0734 3780 PDRELI - ok
      12:35:51.0890 3780 PDRFRAME - ok
      12:35:52.0062 3780 perc2 - ok
      12:35:52.0218 3780 perc2hib - ok
      12:35:52.0390 3780 PID_0928 (3551190e9cf1eb4c0971bdef4269ca25) C:\WINDOWS\system32\DRIVERS\LV561AV.SYS
      12:35:52.0390 3780 PID_0928 - ok
      12:35:52.0562 3780 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
      12:35:52.0562 3780 PptpMiniport - ok
      12:35:52.0734 3780 Processor (e19c9632ac828f6f214391e2bdda11cb) C:\WINDOWS\system32\DRIVERS\processr.sys
      12:35:52.0734 3780 Processor - ok
      12:35:52.0906 3780 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
      12:35:52.0906 3780 PSched - ok
      12:35:52.0937 3780 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
      12:35:52.0937 3780 Ptilink - ok
      12:35:53.0093 3780 ql1080 - ok
      12:35:53.0265 3780 Ql10wnt - ok
      12:35:53.0437 3780 ql12160 - ok
      12:35:53.0593 3780 ql1240 - ok
      12:35:53.0765 3780 ql1280 - ok
      12:35:53.0812 3780 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
      12:35:53.0812 3780 RasAcd - ok
      12:35:53.0921 3780 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
      12:35:53.0921 3780 Rasirda - ok
      12:35:54.0078 3780 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
      12:35:54.0078 3780 Rasl2tp - ok
      12:35:54.0218 3780 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
      12:35:54.0234 3780 RasPppoe - ok
      12:35:54.0250 3780 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
      12:35:54.0250 3780 Raspti - ok
      12:35:54.0421 3780 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
      12:35:54.0421 3780 Rdbss - ok
      12:35:54.0453 3780 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
      12:35:54.0453 3780 RDPCDD - ok
      12:35:54.0609 3780 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
      12:35:54.0609 3780 RDPWD - ok
      12:35:54.0781 3780 redbook (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERS\redbook.sys
      12:35:54.0781 3780 redbook - ok
      12:35:54.0953 3780 s816bus (8c156e6b568aa927eb5deadeb870bdd2) C:\WINDOWS\system32\DRIVERS\s816bus.sys
      12:35:54.0953 3780 s816bus - ok
      12:35:55.0062 3780 s816mdfl (d4ed429953a2b8b09c702805813a26c8) C:\WINDOWS\system32\DRIVERS\s816mdfl.sys
      12:35:55.0062 3780 s816mdfl - ok
      12:35:55.0171 3780 s816mdm (94306f371a6ff8b690bea81157111b3b) C:\WINDOWS\system32\DRIVERS\s816mdm.sys
      12:35:55.0171 3780 s816mdm - ok
      12:35:55.0312 3780 s816mgmt (fafdd00abad1b6029bf7f4067764ab41) C:\WINDOWS\system32\DRIVERS\s816mgmt.sys
      12:35:55.0312 3780 s816mgmt - ok
      12:35:55.0468 3780 s816nd5 (fd0d1e39cb22558d79bff59b66a5874a) C:\WINDOWS\system32\DRIVERS\s816nd5.sys
      12:35:55.0468 3780 s816nd5 - ok
      12:35:55.0593 3780 s816obex (8eacd5e46764463e75f171d9bf305348) C:\WINDOWS\system32\DRIVERS\s816obex.sys
      12:35:55.0593 3780 s816obex - ok
      12:35:55.0734 3780 s816unic (e2090b041b935430abc8e184b7d6cd75) C:\WINDOWS\system32\DRIVERS\s816unic.sys
      12:35:55.0734 3780 s816unic - ok
      12:35:55.0906 3780 sbp2port (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys
      12:35:55.0906 3780 sbp2port - ok
      12:35:56.0046 3780 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
      12:35:56.0062 3780 Secdrv - ok
      12:35:56.0234 3780 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
      12:35:56.0234 3780 serenum - ok
      12:35:56.0390 3780 Serial (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
      12:35:56.0390 3780 Serial - ok
      12:35:56.0578 3780 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
      12:35:56.0593 3780 Sfloppy - ok
      12:35:56.0750 3780 SG762_XP (fa30e1c37b67de5a2e4cb8815d022880) C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys
      12:35:56.0765 3780 SG762_XP - ok
      12:35:56.0984 3780 Simbad - ok
      12:35:57.0140 3780 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
      12:35:57.0156 3780 SLIP - ok
      12:35:57.0328 3780 Sparrow - ok
      12:35:57.0515 3780 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
      12:35:57.0515 3780 splitter - ok
      12:35:57.0687 3780 sr (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
      12:35:57.0703 3780 sr - ok
      12:35:57.0828 3780 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
      12:35:57.0828 3780 Srv - ok
      12:35:57.0984 3780 ssmdrv (3ad0362cf68de3ac500e981700242cca) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
      12:35:57.0984 3780 ssmdrv - ok
      12:35:58.0203 3780 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
      12:35:58.0203 3780 streamip - ok
      12:35:58.0390 3780 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
      12:35:58.0390 3780 swenum - ok
      12:35:58.0593 3780 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
      12:35:58.0593 3780 swmidi - ok
      12:35:58.0843 3780 symc810 - ok
      12:35:59.0046 3780 symc8xx - ok
      12:35:59.0234 3780 sym_hi - ok
      12:35:59.0437 3780 sym_u3 - ok
      12:35:59.0593 3780 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
      12:35:59.0593 3780 sysaudio - ok
      12:35:59.0750 3780 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
      12:35:59.0750 3780 Tcpip - ok
      12:35:59.0921 3780 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
      12:35:59.0921 3780 TDPIPE - ok
      12:36:00.0078 3780 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
      12:36:00.0078 3780 TDTCP - ok
      12:36:00.0234 3780 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
      12:36:00.0234 3780 TermDD - ok
      12:36:00.0437 3780 TosIde - ok
      12:36:00.0593 3780 TrueSight (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys
      12:36:00.0593 3780 TrueSight - ok
      12:36:00.0796 3780 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
      12:36:00.0796 3780 Udfs - ok
      12:36:01.0015 3780 ultra - ok
      12:36:01.0125 3780 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
      12:36:01.0125 3780 Update - ok
      12:36:01.0296 3780 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
      12:36:01.0296 3780 usbaudio - ok
      12:36:01.0468 3780 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
      12:36:01.0468 3780 usbccgp - ok
      12:36:01.0546 3780 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
      12:36:01.0546 3780 usbehci - ok
      12:36:01.0734 3780 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
      12:36:01.0734 3780 usbhub - ok
      12:36:01.0921 3780 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
      12:36:01.0921 3780 usbohci - ok
      12:36:02.0078 3780 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
      12:36:02.0078 3780 usbprint - ok
      12:36:02.0250 3780 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
      12:36:02.0250 3780 usbscan - ok
      12:36:02.0421 3780 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
      12:36:02.0437 3780 USBSTOR - ok
      12:36:02.0500 3780 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
      12:36:02.0500 3780 usbvideo - ok
      12:36:02.0687 3780 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
      12:36:02.0687 3780 VgaSave - ok
      12:36:02.0921 3780 ViaIde - ok
      12:36:03.0093 3780 VolSnap (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
      12:36:03.0093 3780 VolSnap - ok
      12:36:03.0265 3780 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
      12:36:03.0265 3780 Wanarp - ok
      12:36:03.0484 3780 WDICA - ok
      12:36:03.0640 3780 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
      12:36:03.0656 3780 wdmaud - ok
      12:36:03.0875 3780 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
      12:36:03.0875 3780 WpdUsb - ok
      12:36:04.0046 3780 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
      12:36:04.0046 3780 WSTCODEC - ok
      12:36:04.0171 3780 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
      12:36:04.0171 3780 WudfPf - ok
      12:36:04.0296 3780 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
      12:36:04.0296 3780 WudfRd - ok
      12:36:04.0468 3780 ZDCndis5 - ok
      12:36:05.0703 3780 ZDPNDIS5 - ok
      12:36:05.0859 3780 ZDPSp50 (00ae175b903d45ed4a62384d3315dc2a) C:\WINDOWS\system32\Drivers\ZDPSp50.sys
      12:36:05.0859 3780 ZDPSp50 - ok
      12:36:05.0921 3780 MBR (0x1B8) (0c523de221afdce53b8be886a6514650) \Device\Harddisk0\DR0
      12:36:05.0921 3780 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - infected
      12:36:05.0921 3780 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
      12:36:05.0937 3780 Boot (0x1200) (ab573ba9ffc6f345e0271d3e1e20b742) \Device\Harddisk0\DR0\Partition0
      12:36:05.0937 3780 \Device\Harddisk0\DR0\Partition0 - ok
      12:36:05.0953 3780 Boot (0x1200) (7a030cdab65b7a8e243fff6d7c98d425) \Device\Harddisk0\DR0\Partition1
      12:36:05.0953 3780 \Device\Harddisk0\DR0\Partition1 - ok
      12:36:05.0953 3780 ============================================================
      12:36:05.0953 3780 Scan finished
      12:36:05.0953 3780 ============================================================
      12:36:05.0968 3328 Detected object count: 1
      12:36:05.0968 3328 Actual detected object count: 1
      12:37:20.0484 3328 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - will be cured on reboot
      12:37:20.0484 3328 \Device\Harddisk0\DR0 - ok
      12:37:20.0484 3328 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - User select action: Cure
      12:37:36.0078 3324 Deinitialize success

      Merci
      0
    2. lajez Messages postés 9 Statut Membre
       
      Re,

      Voici le rapport malwarebytes.

      Malwarebytes' Anti-Malware 1.51.2.1300
      www.malwarebytes.org

      Version de la base de données: 911122103

      Windows 5.1.2600 Service Pack 3
      Internet Explorer 8.0.6001.18702

      21/12/2011 14:08:03
      mbam-log-2011-12-21 (14-08-03).txt

      Type d'examen: Examen complet (C:\|D:\|)
      Elément(s) analysé(s): 338258
      Temps écoulé: 38 minute(s), 0 seconde(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 8
      Valeur(s) du Registre infectée(s): 0
      Elément(s) de données du Registre infecté(s): 0
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 4

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_CLASSES_ROOT\AppID\{90A52F08-64AC-4DC6-9D7D-4516670275D3} (Trojan.Downloader) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\TypeLib\{90A52F08-64AC-4DC6-9D7D-4516670275D3} (Trojan.Downloader) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{6C51F7E9-8542-4F25-A30F-2060157752E1} (Trojan.Downloader) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Software\{9C360EFF-A52D-49c9-8531-456C1A406D3C} (Trojan.Downloader) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      (Aucun élément nuisible détecté)

      Elément(s) de données du Registre infecté(s):
      (Aucun élément nuisible détecté)

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      c:\documents and settings\networkservice\local settings\application data\pje.exe (Rootkit.0Access) -> Quarantined and deleted successfully.
      c:\system volume information\_restore{18120fb7-1173-47c3-9bcd-321152d5f4e4}\RP1534\A0192088.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
      c:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
      c:\documents and settings\Romain\2gweorjqjutp92vjy9gake (Malware.Trace) -> Quarantined and deleted successfully.


      Je te fais suivre les prapports rogue killer.
      0
    3. lajez Messages postés 9 Statut Membre
       
      Et enfin, les rapports Rogue killer:

      1
      RogueKiller V6.2.0 [12/12/2011] par Tigzy
      mail: tigzyRK<at>gmail<dot>com
      Remontees: https://www.luanagames.com/index.fr.html
      Blog: http://tigzyrk.blogspot.com

      Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
      Demarrage : Mode normal
      Utilisateur: Romain [Droits d'admin]
      Mode: Recherche -- Date : 21/12/2011 14:11:16

      ¤¤¤ Processus malicieux: 0 ¤¤¤

      ¤¤¤ Entrees de registre: 0 ¤¤¤

      ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

      ¤¤¤ Driver: [LOADED] ¤¤¤
      S_SSDT[0] : -> HOOKED ( @ 0x00000000)

      ¤¤¤ Infection : ¤¤¤

      ¤¤¤ Fichier HOSTS: ¤¤¤
      127.0.0.1 localhost
      127.0.0.1 bin.errorprotector.com ## added by CiD
      127.0.0.1 br.errorsafe.com ## added by CiD
      127.0.0.1 br.winantivirus.com ## added by CiD
      127.0.0.1 br.winfixer.com ## added by CiD
      127.0.0.1 cdn.drivecleaner.com ## added by CiD
      127.0.0.1 cdn.errorsafe.com ## added by CiD
      127.0.0.1 cdn.winsoftware.com ## added by CiD
      127.0.0.1 de.errorsafe.com ## added by CiD
      127.0.0.1 de.winantivirus.com ## added by CiD
      127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
      127.0.0.1 download.cdn.errorsafe.com ## added by CiD
      127.0.0.1 download.cdn.winsoftware.com ## added by CiD
      127.0.0.1 download.errorsafe.com ## added by CiD
      127.0.0.1 download.systemdoctor.com ## added by CiD
      127.0.0.1 download.winantispyware.com ## added by CiD
      127.0.0.1 download.windrivecleaner.com ## added by CiD
      127.0.0.1 download.winfixer.com ## added by CiD
      127.0.0.1 drivecleaner.com ## added by CiD
      127.0.0.1 dynamique.drivecleaner.com ## added by CiD
      [...]


      ¤¤¤ MBR Verif: ¤¤¤
      --- User ---
      [MBR] 0b18409534474a717a78d509b6ba3081
      [BSP] 115f5cb7bd1141e872924e5736d587e5 : MBR Code unknown
      Partition table:
      0 - [XXXXXX] UNKNW [HIDDEN!] Offset (sectors): 63 | Size: 5239 Mo
      1 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 10233405 | Size: 122145 Mo
      2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 248798655 | Size: 122671 Mo
      User = LL1 ... OK!
      User = LL2 ... OK!

      Termine : << RKreport[4].txt >>
      RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt

      2
      RogueKiller V6.2.0 [12/12/2011] par Tigzy
      mail: tigzyRK<at>gmail<dot>com
      Remontees: https://www.luanagames.com/index.fr.html
      Blog: http://tigzyrk.blogspot.com

      Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
      Demarrage : Mode normal
      Utilisateur: Romain [Droits d'admin]
      Mode: Suppression -- Date : 21/12/2011 14:12:20

      ¤¤¤ Processus malicieux: 0 ¤¤¤

      ¤¤¤ Entrees de registre: 0 ¤¤¤

      ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

      ¤¤¤ Driver: [LOADED] ¤¤¤
      S_SSDT[0] : -> HOOKED ( @ 0x00000000)

      ¤¤¤ Infection : ¤¤¤

      ¤¤¤ Fichier HOSTS: ¤¤¤
      127.0.0.1 localhost
      127.0.0.1 bin.errorprotector.com ## added by CiD
      127.0.0.1 br.errorsafe.com ## added by CiD
      127.0.0.1 br.winantivirus.com ## added by CiD
      127.0.0.1 br.winfixer.com ## added by CiD
      127.0.0.1 cdn.drivecleaner.com ## added by CiD
      127.0.0.1 cdn.errorsafe.com ## added by CiD
      127.0.0.1 cdn.winsoftware.com ## added by CiD
      127.0.0.1 de.errorsafe.com ## added by CiD
      127.0.0.1 de.winantivirus.com ## added by CiD
      127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
      127.0.0.1 download.cdn.errorsafe.com ## added by CiD
      127.0.0.1 download.cdn.winsoftware.com ## added by CiD
      127.0.0.1 download.errorsafe.com ## added by CiD
      127.0.0.1 download.systemdoctor.com ## added by CiD
      127.0.0.1 download.winantispyware.com ## added by CiD
      127.0.0.1 download.windrivecleaner.com ## added by CiD
      127.0.0.1 download.winfixer.com ## added by CiD
      127.0.0.1 drivecleaner.com ## added by CiD
      127.0.0.1 dynamique.drivecleaner.com ## added by CiD
      [...]


      ¤¤¤ MBR Verif: ¤¤¤
      --- User ---
      [MBR] 0b18409534474a717a78d509b6ba3081
      [BSP] 115f5cb7bd1141e872924e5736d587e5 : MBR Code unknown
      Partition table:
      0 - [XXXXXX] UNKNW [HIDDEN!] Offset (sectors): 63 | Size: 5239 Mo
      1 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 10233405 | Size: 122145 Mo
      2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 248798655 | Size: 122671 Mo
      User = LL1 ... OK!
      User = LL2 ... OK!

      Termine : << RKreport[5].txt >>
      RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt

      3
      RogueKiller V6.2.0 [12/12/2011] par Tigzy
      mail: tigzyRK<at>gmail<dot>com
      Remontees: https://www.luanagames.com/index.fr.html
      Blog: http://tigzyrk.blogspot.com

      Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
      Demarrage : Mode normal
      Utilisateur: Romain [Droits d'admin]
      Mode: HOSTS RAZ -- Date : 21/12/2011 14:12:41

      ¤¤¤ Processus malicieux: 0 ¤¤¤

      ¤¤¤ Driver: [LOADED] ¤¤¤

      ¤¤¤ Fichier HOSTS: ¤¤¤
      127.0.0.1 localhost
      127.0.0.1 bin.errorprotector.com ## added by CiD
      127.0.0.1 br.errorsafe.com ## added by CiD
      127.0.0.1 br.winantivirus.com ## added by CiD
      127.0.0.1 br.winfixer.com ## added by CiD
      127.0.0.1 cdn.drivecleaner.com ## added by CiD
      127.0.0.1 cdn.errorsafe.com ## added by CiD
      127.0.0.1 cdn.winsoftware.com ## added by CiD
      127.0.0.1 de.errorsafe.com ## added by CiD
      127.0.0.1 de.winantivirus.com ## added by CiD
      127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
      127.0.0.1 download.cdn.errorsafe.com ## added by CiD
      127.0.0.1 download.cdn.winsoftware.com ## added by CiD
      127.0.0.1 download.errorsafe.com ## added by CiD
      127.0.0.1 download.systemdoctor.com ## added by CiD
      127.0.0.1 download.winantispyware.com ## added by CiD
      127.0.0.1 download.windrivecleaner.com ## added by CiD
      127.0.0.1 download.winfixer.com ## added by CiD
      127.0.0.1 drivecleaner.com ## added by CiD
      127.0.0.1 dynamique.drivecleaner.com ## added by CiD
      [...]


      ¤¤¤ Nouveau fichier HOSTS: ¤¤¤
      127.0.0.1 localhost

      Termine : << RKreport[6].txt >>
      RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ; RKreport[5].txt ;
      RKreport[6].txt



      merci
      0
  2. Utilisateur anonyme
     
    Tu peux me poster les 2 rapports rogue killer??
    0
  3. Utilisateur anonyme
     
    On va faire une analyse de ton systéme.

    * Télécharge ZHPDiag ( de Nicolas coolman ).
    ou
    ZHPDiag
    ou
    https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

    Ou le lien FTP en secours :
    ftp://zebulon.fr/ZHPDiag2.exe

    ***********************
    /!\Utilisateurs de Vista et Windows 7 : Clique droit sur le logo de ZHPDiag.exe, " exécuter en tant qu'Administrateur /!\
    * Laisse toi guider lors de l'installation
    * Il se lancera automatiquement à la fin de l'installation
    * Clique sur l'icône représentant une loupe (« Lancer le diagnostic »)
    * Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
    * Héberge le rapport ZHPDiag.txt sur le site pjjoint.malekal.com ou cijoint.fr ou toofiles puis copie/colle le lien fournit dans ta prochaine réponse sur le forum
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. lajez Messages postés 9 Statut Membre
     
    Bonjour,

    Je ne sais pas si le pb est lié mais suite à ce virus, la mise à jour automatique de windows est désactivée et il m'est impossible de la remettre en marche. Pouvez vous m'aider pour ce pb?

    Merci
    0
  7. Utilisateur anonyme
     
    * Téléchargez WinUpdateFix sur votre bureau.
    * Lancez-le et appuyez sur "Créer un rapport de diagnostic".
    * Un rapport va alors se créer et s'afficher à l'écran, vous pourrez donc l'utiliser et le faire parvenir à un helper.

    Note : Le rapport est également sauvegardé à la racine du disque dur (C:\WinUpdateFix.txt)
    0
  8. lajez Messages postés 9 Statut Membre
     
    Voici le rapport réalisé a partir de WinUpdateFix, quelqu'un

    v1.3 - Rapport créé le 23/12/2011 à 18:04
    Mis à jour le 06/02/11 à 20h par Xplode
    Système d'exploitation : Microsoft Windows XP (32 bits) [version 5.1.2600] Service Pack 3
    Nom d'utilisateur : Romain - NONO (Administrateur)
    Exécuté depuis : C:\Documents and Settings\Romain\Mes documents\Téléchargements\winupdatefix.exe

    ~~~~~ Windows Update ~~~~~

    Paramètres du centre de sécurité : Les mises à jour automatiques sont activées et sont installées automatiquement.

    Dernière recherche effectuée le : 2011-12-19 à 12:49:28
    Dernier téléchargement effectué le : 2011-12-16 à 18:21:49
    Dernière installation effectuée le : 2011-12-16 à 19:01:48

    ~~~~~ Services ~~~~~~

    [Mises à jour automatiques]

    Nom du service : Wuauserv
    Etat :
    Statut :

    [Service de transfert intelligent en arrière-plan]

    Nom du service : BITS
    Etat : Démarré
    Statut : Automatique

    [Service de cryptographie]

    Nom du service : CryptSvc
    Etat : Démarré
    Statut : Automatique

    ~~~~~ Proxy ~~~~~~

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

    ProxyEnable = 0

    ... OK !

    ~~~~~ Hijack.NoWindowsUpdate ~~~~~

    [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

    ... OK !

    ########## EOF - "C:\WinUpdateFix.txt" - [1339 octets] ##########
    0
  9. lajez Messages postés 9 Statut Membre
     
    C bon ca a fonctionné .

    Merci beaucoup
    0

Discussions similaires

Ou trouver le pilote pour epson xp-2205
lutttinette -
kaneagle -

19 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
probleme configuration wifi epson xp-225
sam099 -
Elchaco -

35 réponses
Jeux origine. freecell-solitaire -démineur- etc... XP ou W7
mandgio -
Utilisateur anonyme -

4 réponses
où trouver le freecell du XP
désolation -
lativ -

7 réponses