Comment me débarrasser de MALWARE DEFENSE
Bonjour,
J'ai récupérer de Malware defense et d'autres nuisibles. Je cherche de l'aide pour m'en débarrasser. SVP venez à mon secours, c'est l'horreur. Impossible d'utiliser AVG ou Kapersky ( version d'essai). L'accès internet est régulièrement bloqué. des fenêtres avec messages d'erreur s'ouvrent régulièrement. Merci d'avance !!!
Voici mon rapport HIJACKTHIS:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:48, on 22/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\Acer TV-FM\PCMService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\ControlCenter3\brctrcen.exe
C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\dumprep.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\dwwin.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O20 - AppInit_DLLs: aldyjf.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service Google Update (gupdate1ca022f9f64b058) (gupdate1ca022f9f64b058) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 14383 bytes
J'ai récupérer de Malware defense et d'autres nuisibles. Je cherche de l'aide pour m'en débarrasser. SVP venez à mon secours, c'est l'horreur. Impossible d'utiliser AVG ou Kapersky ( version d'essai). L'accès internet est régulièrement bloqué. des fenêtres avec messages d'erreur s'ouvrent régulièrement. Merci d'avance !!!
Voici mon rapport HIJACKTHIS:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:26:48, on 22/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\SysMonitor.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\Program Files\Acer TV-FM\PCMService.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\ControlCenter3\brctrcen.exe
C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\dumprep.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\dwwin.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer TV-FM\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Rappels du Calendrier Microsoft Works.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Clavier &virtuel - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Analyse des &liens - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O20 - AppInit_DLLs: aldyjf.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Service Google Update (gupdate1ca022f9f64b058) (gupdate1ca022f9f64b058) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 14383 bytes
Configuration: Windows XP Internet Explorer 7.0
38 réponses
Résumé de la discussion
Une infection complexe par Malware Defense et d'autres nuisibles gêne gravement l'accès à Internet et bloque les antivirus sur Windows XP, avec un rapport HijackThis expliquant les processus et les services suspects. Des solutions proposées incluent l’usage de MBAM (Malwarebytes) et TDSSKiller pour éliminer les composants malveillants, puis l’analyse des rapports et leur partage sur VirusTotal pour vérification. D'autres échanges évoquent la gestion des démarrages et des extensions de navigateur, l'importance de ne pas supprimer des éléments système ou cracks, et des étapes intermédiaires comme désactiver le réseau puis relancer les outils. En cas de difficulté, il est recommandé de partager des rapports complémentaires (TDSSKiller, MBAM) et de vérifier les emplacements critiques cités dans HijackThis, afin d'orienter les étapes suivantes.
-
Contributeur sécuritésalut ,je reviens tout juste d'une opération .....
Une dernière question tout de même, comment ne pas être abbreuvée de pub en surfant sur le net ???
tu as toujours des pubs ? -
Contributeur sécuritéUnai : tu peux creer un nouveau sujet dans le forum Virus/sécu et me posté le lien .
-
bjr JFKPRESIDENT
voici le lien: https://forums.commentcamarche.net/forum/affich-15977358-comment-desinstaller-malware-defense
merci pour votre aide
cordialement
-
-
Bjr JFKPRESIDENT,
je suis novice dans ce monde.
hier j ai lancé une mise à jour Windows qui m a zappé mon antivirus AVIRA et installé MALWARE DEFENSE que je n arrive pas à m en débarrasser. des fenêtres s ouvrent toutes les minutes. spécialement une qui s appelle SECURITY CENTER ALERT.
j ai lu votre aide à JEUNENOVICE, mais j ai pas bien saisi.
je sollicite ton grand savoir en la matière pour me filer un coup de pouce.
merci pour ta réponses. -
Contributeur sécuritééxécute cette commande via cmd : msiexec /x {299CF645-48C7-4FA1-8BCD-5CE200CF180D}
-
Bonjour JFK,
Désolée pour avoir été aussi longue mais une urgence familiale m'a retenue ailleurs.
Pour en revenir à notre affaire, la commande n'a pas fonctionné. J'ai alors suprrimé fichier par fichier le contenu de SEP, jusqu'à ce qu'il n'en reste qu'un , comme Highlander :-) , je l'ai mis sur le bureau. J'ai redémarré le PC, plus de fenêtre, et j'ai pû enfin supprimé MacLeod.
Donc, tout va bien...;Merci beaucoup, on va pouvoir clore le topic.
Une dernière question tout de même, comment ne pas être abbreuvée de pub en surfant sur le net ???
ps : Je te souhaite une très bonne année ainsi qu'à tes proches...Et encore merci, merci, merci !!
-
-
Contributeur sécurité
Apparemment ce dossier ne sert à rien, il est lié à messenger, mais je n'utilise pas messenger.
Si tu n'utilise pas messenger alors tu peux supprimer : C:\Windows Live -
Contributeur sécurité
-
Contributeur sécuritéTu as cliqué sur le lien : https://www.cjoint.com/?mCuPsQOQkj
-
ça ressemble à quoi ? ça s'appelle peut-etre pas comme ça chez moi ???
-
Contributeur sécurité
-
Contributeur sécurité
Faut-il aller dans SOFTWARE juste après HKEY_LOCAL_MACHINE et avant MICROSOFT????
J'avais éffectivement oublié SOFTWARE ........:(
Tu va te diriger dans le "panneau de configuration" puis tu va cliquer sur "Modifier les programmes de démarrage" .
Voit si tu trouve ce dossier "microsoft" et désactive le . -
Contributeur sécuritéClique sur "éxécuter" ,tape regedit .
Navigue pour trouver cette clé : HKEY_LOCAL_MACHINE\Microsoft\Windows\currentVersion\Run
Dis moi ce que tu vois dans les valeurs a droite ?-
Faut-il aller dans SOFTWARE juste après HKEY_LOCAL_MACHINE et avant MICROSOFT????
Si oui, au bout du chemin indiqué dans Run il y a un autre fichier : OPTIONALCOMPONENTS;
Je suis quand même rester sur run, et à droite un tableau avec 3 colonnes ( nom / type / données )
Première ligne je lis pour nom : petit sigle (ab) (par défaut) ; pour type : REG_SZ ; pour données : (valeur non définie)
-
-
Contributeur sécuritéSuit ce chemin : C:\Program Files\Microsoft\Search Enhancement Pack\ChoiceGuard\CGuard.exe
Supprime le dossier CGuard.exe.
Tiens moi au courant . -
Contributeur sécurité
Pour le problème de windows live je ne comprends pas l'étape suivante : 3. Exécuter la commande suivante en y reconduisant le code trouvé à l'étape précédente: msiexec /x {ProductCode} exemple : msiexec /x {8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E} J'ai le "productcode" mais où trouver msiexec.
Il faut que tu la lance via la commande en ligne :
*Clique sur éxécuter ,tape cmddans la barre de recherche ,une fenetre noire va apparaitre .
*Tape : msiexec /x {xxxxxxx} puis "entrée" .
Par contre je te conseille d'installer le pare-feu ,antivirus ..etc...de creer ton nouveau point de restauration et ensuite lancer cette commande ...Je ne l'ai pas testé -;) OK ?
Combofix se trouve ici :
C:\Mes téléchargements\ComboFix\ComboFix.exe
Tu peux supprimer également tout ce qui est rapport/log .txt
-
Bonjour,
La manoeuvre pour supprimer la fenêtre qui s'ouvre n'a pas fonctionnée. Elle s'ouvre toujours au démarrage du PC;
Pour le reste s'est OK; j'ai lancé avira qui a trouvé pas mal de nuisibles, et j'ai installé online armor.
COmbofix n'était pas à l'endroit indiqué (mais bon, il est supprimé)
J'ai créé un point de restauration via toolscleaner !
Tout à l'air normal maintenant , mis à part, ce problème de fenêtre et internet qui est un peu longuet au démarrage...Si tu as une autre idée je suis preneuse !!
Merci beaucoup
-
-
Contributeur sécuritéZut...J'ai oublié le pare-feu :(
Installe OnlineArmor :
OnlineArmor:https://www.commentcamarche.net/telecharger/securite/16545-online-armor-personal-firewall/
tutoriels:https://forum.pcastuces.com/sujet.asp?f=25&s=35606
:https://www.malekal.com/tutorial-online-armor-free/
/!\N'oubli pas de désactiver le pare-feu de Xp /!\
-
Contributeur sécuritéJette un oeil ici pour ce probleme de fenetre .
Désinstalle Norton proprement avec cet utilitaire : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
Fait de meme avec AVG : http://download.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe
Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :
· Télécharge ToolsCleaner de A.Roshtein sur ton Bureau.
http://pc-system.fr/
· Clique sur Recherche et laisse le scan se terminer.
· Clique, sur Suppression pour finaliser.
· Tu peux, si tu le souhaites, te servir des Options facultatives.
· Clique sur Quitter, pour que le rapport puisse se créer.
· Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\).
Supprime également C:\Combokill et C:\Qoobox
========================================
Maintenant que ton PC n'est plus infecté, désactive ta "Restauration du système" puis réactive la afin de créer un point de restauration sain.
* Désactivation :
Cliquer droit sur le "Poste de travail" > Propriétés > onglet "Restauration du système" > cocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer patiente jusqu a que cela soit marqué "désactivée" puis Ok.
* Activation :
Suivre le même chemin ; décocher la case "Désactiver la Restauration du système sur tous les lecteurs"
> Appliquer attends que cela soit a nouveau sur "surveillance" puis Ok. Redémarrer l'ordinateur..
========================================
Télécharge ATF Cleaner par Atribune:
http://www.atribune.org/ccount/click.php?id=1
Double-clique ATF-Cleaner.exe afin de lancer le programme.
Sous l'onglet Main, choisis : Select All
Clique sur le bouton Empty Selected
Si tu utilises le navigateur Firefox :
Clique Firefox au haut et choisis : Select All
Clique le bouton Empty Selected
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.
Si tu utilises le navigateur Opera :
Clique Opera au haut et choisis : Select All
Clique le bouton Empty Selected
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.
Clique Exit, du menu prinicipal, afin de fermer le programme.
Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus.
=======================================
Installe Antivir comme antivirus :
*Antivir (d'avira) Gratuit et en français : https://kerio.probb.fr/t3106-tuto-antivir-antivirus-version-franaise
configurer antivir
Tu peux supprimer Adaware (il est devenu obsolete) mais conserve MBAM .
=======================================
Met a jour ta console JAVA : https://www.java.com/fr/download/manual.jsp
Je vois que tu utilise E-Mule ,donc je te conseille de lire ceci :
danger du P2P et des cracks
également un exemple concret ici ou l'internaute ne pouvait plus rien faire de sa machine ...
Bon surf et bonnes fetes de fin d'année .
-
Re JFK President,
Pour le problème de windows live je ne comprends pas l'étape suivante :
3. Exécuter la commande suivante en y reconduisant le code trouvé à l'étape précédente:
msiexec /x {ProductCode}
exemple : msiexec /x {8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
J'ai le "productcode" mais où trouver msiexec. (J'ai pris un pseudo en conséquence ! LOL
Je ne sais pas non plus désactiver le parefeu windows...
J'ai supprimé Norton et AVG, je ne trouve pas combo...dans C\
Par contre il reste sur C\ des rapports.
Voilà le [ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]
--> Recherche:
C:\Combofix.txt: trouvé !
C:\rapport_clean.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\Qoobox: trouvé !
C:\UsbFix: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Béda\Bureau\HijackThis.exe: trouvé !
C:\Documents and Settings\Béda\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Béda\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\Béda\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\Béda\Recent\HijackThis.lnk: trouvé !
C:\Mes téléchargements\HJTInstall.exe: trouvé !
C:\Mes téléchargements\Combofix: trouvé !
C:\Mes téléchargements\ComboFix\ComboFix.exe: trouvé !
C:\Program Files\ZHPDiag: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: trouvé !
C:\QooBox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !
---------------------------------
--> Suppression:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Béda\Bureau\HijackThis.exe: supprimé !
C:\Documents and Settings\Béda\Recent\HijackThis.lnk: supprimé !
C:\Mes téléchargements\HJTInstall.exe: supprimé !
C:\Mes téléchargements\ComboFix\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\ZHPDiag\ZHPdiag.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\rapport_clean.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Béda\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Béda\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\Béda\Bureau\Rsit.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\QooBox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\UsbFix: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Mes téléchargements\Combofix: supprimé !
C:\Program Files\ZHPDiag: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
Corbeille vidée!
Fichiers temporaires nettoyés !
POur Emule,
Il est vrai que je l'utilise, peu pour les dessins animés mais quand même. Je voulais arrêter avant le nouvel an mais après avoir vu les tuto, je vois que le danger est partout...Donc Merci pour la mise en garde.
Je continue les autres manoeuvres et encore merci
PS : pour la restauration, je vais attendre que tout soit nickel, non???
-
-
oui entre autre
Est-ce grave? -
Contributeur sécuritéS'agit t'il d'un dossier qui porte ce nom : Search enhancement Pack ?
-
J'ai supprimé AVG au début des opérations de nettoyage...
l'explorateur windows s'ouvre sur une fenêtre microsoft à chaque démarrage de l'ordi. Avec 3 dossiers dont windows live. J'ai cru comprendre que c'était un bug pas méchant et facile à résoudre, mais je n'ai pas la procédure. -
Contributeur sécurité
J'ai toujours une fenêtre microsoft qui s'ouvre à chaque démarrage de l'ordi.
C'est a dire ?
J'ai également un fichier texte nommé EULA sur le bureau (???)
Tu peux le supprimer si il t'est inconnu .
Tu as toujours AVG antivirus d'actif ? -
Contributeur sécuritéTu as utilisé TDSSKiller ,peut tu me collé le rapport qui se trouve ici : C:\TDSSKiller (log.txt)
Tu va passer également ce fichier sur VirusTotal (comme indiqué post#33) : C:\WINDOWS\PEV.exe
Dis moi si ton pc va mieux ?-
Le PC va mieux d'une manière générale. J'ai toujours une fenêtre microsoft qui s'ouvre à chaque démarrage de l'ordi. J'ai également un fichier texte nommé EULA sur le bureau (???)
Dois je garder tous les programmes téléchargés sur le bureau : usbfix, combo, seaf, rsit, mbam,..;
Comment protéger efficament mon PC ? Quel antivirus ou antispyware, parefeu dois-je installer ???
Merci
VOici le rapport TDSSKILLER
22:45:21:109 3548 TDSSKiller 2.1.1 Dec 20 2009 02:40:02
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 SystemInfo:
22:45:21:109 3548 OS Version: 5.1.2600 ServicePack: 3.0
22:45:21:109 3548 Product type: Workstation
22:45:21:109 3548 ComputerName: ACER-FE8B363750
22:45:21:109 3548 UserName: Béda
22:45:21:109 3548 Windows directory: C:\WINDOWS
22:45:21:109 3548 Processor architecture: Intel x86
22:45:21:109 3548 Number of processors: 1
22:45:21:109 3548 Page size: 0x1000
22:45:21:109 3548 Boot type: Normal boot
22:45:21:109 3548 ================================================================================
22:45:21:109 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 ForceUnloadDriver: NtUnloadDriver error 2
22:45:21:125 3548 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\Drivers\KLMD.sys) returned status 0
22:45:21:125 3548 main: Driver KLMD successfully dropped
22:45:21:125 3548 main: Driver KLMD successfully loaded
22:45:21:125 3548
Scanning Registry ...
22:45:21:125 3548 ScanServices: Searching service UACd.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service TDSSserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gaopdxserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service gxvxcserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 ScanServices: Searching service MSIVXserv.sys
22:45:21:125 3548 ScanServices: Open/Create key error 2
22:45:21:125 3548 UnhookRegistry: Kernel module file name: C:\windows\system32\ntoskrnl.exe, base addr: 804D7000
22:45:21:140 3548 UnhookRegistry: Kernel local addr: A40000
22:45:21:140 3548 UnhookRegistry: KeServiceDescriptorTable addr: ACB520
22:45:21:140 3548 UnhookRegistry: KiServiceTable addr: A4D8B0
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (local): 47
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey local addr: AE1E14
22:45:21:140 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:140 3548 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E380F[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey service number (kernel): 47
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x804E49CC[0x4]
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey real addr: 80578E14
22:45:21:140 3548 UnhookRegistry: NtEnumerateKey calc addr: 80578E14
22:45:21:140 3548 UnhookRegistry: No SDT hooks found on NtEnumerateKey
22:45:21:140 3548 KLMD_ReadMem: Trying to ReadMemory 0x80578E14[0xA]
22:45:21:140 3548 UnhookRegistry: No splicing found on NtEnumerateKey
22:45:21:140 3548
Scanning Kernel memory ...
22:45:21:156 3548 KLMD_OpenDevice: Trying to open KLMD device
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
22:45:21:156 3548 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 84F98F38
22:45:21:156 3548 DetectCureTDL3: KLMD_GetDeviceObjectList returned 16 DevObjects
22:45:21:156 3548 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 84D8BC68
22:45:21:156 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D8BC68
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D8BC68[0x38]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:156 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:156 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:156 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:156 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:156 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:156 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:156 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:156 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:156 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:156 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:156 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:156 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:156 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:156 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:156 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:156 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:156 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:171 3548 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 84D63130
22:45:21:171 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D63130
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D63130[0x38]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:171 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:171 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:171 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:171 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:171 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:171 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:171 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:171 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:187 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:187 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:187 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:187 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:187 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:187 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:187 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:187 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:187 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:187 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:187 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:187 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84D95510
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D95510
22:45:21:203 3548 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 84CF1030
22:45:21:203 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CF1030
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CF1030[0x38]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:203 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:203 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:203 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:203 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:203 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:203 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:203 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:203 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:203 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:203 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:203 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:203 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:203 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:203 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:203 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:218 3548 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 84D96C68
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D96C68
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D96C68[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:218 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:218 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:218 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:218 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:218 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:218 3548 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 84DF6170
22:45:21:218 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84DF6170
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84DF6170[0x38]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:218 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:218 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:218 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:218 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:218 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:218 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:218 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:218 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:218 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:218 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:218 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 84D7EA08
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D7EA08
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D7EA08[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:234 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:234 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:234 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:234 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:234 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:234 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:234 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:234 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:234 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:234 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:234 3548 DetectCureTDL3: 6 Curr stack PDEVICE_OBJECT: 84D44988
22:45:21:234 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D44988
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84D44988[0x38]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:234 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:234 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:234 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:234 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:234 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:234 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:250 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:250 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:250 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CD1AB8
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CD1AB8
22:45:21:250 3548 DetectCureTDL3: 7 Curr stack PDEVICE_OBJECT: 84CBC030
22:45:21:250 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CBC030
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CBC030[0x38]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:250 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:250 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:250 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:250 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:250 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:250 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:250 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:250 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:250 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:250 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:250 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:250 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:250 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:250 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:250 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84D3EAB8
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D3EAB8
22:45:21:265 3548 DetectCureTDL3: 8 Curr stack PDEVICE_OBJECT: 84F5F540
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F540
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F540[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:265 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:265 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:265 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:265 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:265 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:265 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84A0F3E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A0F3E0
22:45:21:265 3548 DetectCureTDL3: 9 Curr stack PDEVICE_OBJECT: 84CB38E0
22:45:21:265 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CB38E0
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CB38E0[0x38]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:265 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:265 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:265 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:265 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:265 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:265 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:265 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:265 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84D40030
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84D40030
22:45:21:281 3548 DetectCureTDL3: 10 Curr stack PDEVICE_OBJECT: 84F5F1D8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F5F1D8
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F5F1D8[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:281 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:281 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:281 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:281 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:281 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:281 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:281 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:281 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:281 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:281 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:281 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84A127F8
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84A127F8
22:45:21:281 3548 DetectCureTDL3: 11 Curr stack PDEVICE_OBJECT: 84CA5748
22:45:21:281 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84CA5748
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84CA5748[0x38]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84A79B10
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0x84A79B10[0xA8]
22:45:21:281 3548 KLMD_ReadMem: Trying to ReadMemory 0xE15E0AC0[0x208]
22:45:21:281 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
22:45:21:281 3548 DetectCureTDL3: IrpHandler (0) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F7A16218
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7A1623C
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F7A16180
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F7A119E6
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F7A155F0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F7A13A6E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xF7A12F26[0x400]
22:45:21:296 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 0, 0
22:45:21:296 3548 TDL3_FileDetect: Processing driver: USBSTOR
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\usbstor.sys, C:\WINDOWS\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\usbstor.sys
22:45:21:296 3548 DetectCureTDL3: 12 Curr stack PDEVICE_OBJECT: 84F48C68
22:45:21:296 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48C68
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48C68[0x38]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:296 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:296 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:296 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:296 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:296 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:296 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:296 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:296 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:296 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:296 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:296 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:296 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:296 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:296 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:296 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:296 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:296 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 13 Curr stack PDEVICE_OBJECT: 84F48030
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F48030
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F48030[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:312 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:312 3548 DetectCureTDL3: 14 Curr stack PDEVICE_OBJECT: 84F977E8
22:45:21:312 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F977E8
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F977E8[0x38]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F98F38
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F98F38[0xA8]
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0xE16390C8[0x208]
22:45:21:312 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:45:21:312 3548 DetectCureTDL3: IrpHandler (0) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (2) addr: F778FBB0
22:45:21:312 3548 DetectCureTDL3: IrpHandler (3) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (4) addr: F7789D1F
22:45:21:312 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (9) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (14) addr: F778A3BB
22:45:21:312 3548 DetectCureTDL3: IrpHandler (15) addr: F778DF28
22:45:21:312 3548 DetectCureTDL3: IrpHandler (16) addr: F778A2E2
22:45:21:312 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (22) addr: F778BC82
22:45:21:312 3548 DetectCureTDL3: IrpHandler (23) addr: F779099E
22:45:21:312 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:312 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:312 3548 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400]
22:45:21:312 3548 KLMD_ReadMem: DeviceIoControl error 1
22:45:21:312 3548 TDL3_StartIoHookDetect: Unable to get StartIo handler code
22:45:21:312 3548 TDL3_FileDetect: Processing driver: Disk
22:45:21:312 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F98810
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F98810
22:45:21:328 3548 DetectCureTDL3: 15 Curr stack PDEVICE_OBJECT: 84F8C580
22:45:21:328 3548 KLMD_GetLowerDeviceObject: Trying to get lower device object for 84F8C580
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8C580[0x38]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT addr: 84F8CF38
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0x84F8CF38[0xA8]
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xE163A8E8[0x208]
22:45:21:328 3548 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
22:45:21:328 3548 DetectCureTDL3: IrpHandler (0) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (1) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (2) addr: F76AB6F2
22:45:21:328 3548 DetectCureTDL3: IrpHandler (3) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (4) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (5) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (6) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (7) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (8) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (9) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (10) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (11) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (12) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (13) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (14) addr: F76AB712
22:45:21:328 3548 DetectCureTDL3: IrpHandler (15) addr: F76A7852
22:45:21:328 3548 DetectCureTDL3: IrpHandler (16) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (17) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (18) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (19) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (20) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (21) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (22) addr: F76AB73C
22:45:21:328 3548 DetectCureTDL3: IrpHandler (23) addr: F76B2336
22:45:21:328 3548 DetectCureTDL3: IrpHandler (24) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (25) addr: 804F9739
22:45:21:328 3548 DetectCureTDL3: IrpHandler (26) addr: 804F9739
22:45:21:328 3548 KLMD_ReadMem: Trying to ReadMemory 0xF76A8864[0x400]
22:45:21:328 3548 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 316, 0
22:45:21:328 3548 TDL3_FileDetect: Processing driver: atapi
22:45:21:328 3548 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\atapi.sys, C:\WINDOWS\system32\Drivers\atapi.tsk, SYSTEM\CurrentControlSet\Services\atapi, system32\Drivers\atapi.tsk
22:45:21:328 3548 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:328 3548 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys
22:45:21:343 3548
Completed
Results:
22:45:21:343 3548 Infected objects in memory: 0
22:45:21:343 3548 Cured objects in memory: 0
22:45:21:343 3548 Infected objects on disk: 0
22:45:21:343 3548 Objects on disk cured on reboot: 0
22:45:21:343 3548 Objects on disk deleted on reboot: 0
22:45:21:343 3548 Registry nodes deleted on reboot: 0
22:45:21:343 3548
VOICI LE RAPPORT VIRUS TOTAL
Fichier PEV.exe reçu le 2009.12.26 12:56:34 (UTC)
Situation actuelle: terminé
Résultat: 4/41 (9.76%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.43 2009.12.26 -
AhnLab-V3 5.0.0.2 2009.12.26 -
AntiVir 7.9.1.122 2009.12.25 -
Antiy-AVL 2.0.3.7 2009.12.25 -
Authentium 5.2.0.5 2009.12.26 -
Avast 4.8.1351.0 2009.12.26 -
AVG 8.5.0.430 2009.12.26 -
BitDefender 7.2 2009.12.26 -
CAT-QuickHeal 10.00 2009.12.26 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.12.26 -
Comodo 3375 2009.12.26 -
DrWeb 5.0.1.12222 2009.12.26 -
eSafe 7.0.17.0 2009.12.24 Suspicious File
eTrust-Vet 35.1.7198 2009.12.25 -
F-Prot 4.5.1.85 2009.12.26 -
F-Secure 9.0.15370.0 2009.12.26 -
Fortinet 4.0.14.0 2009.12.26 -
GData 19 2009.12.26 -
Ikarus T3.1.1.79.0 2009.12.26 -
Jiangmin 13.0.900 2009.12.26 -
K7AntiVirus 7.10.931 2009.12.26 -
Kaspersky 7.0.0.125 2009.12.26 -
McAfee 5842 2009.12.24 -
McAfee+Artemis 5842 2009.12.24 -
McAfee-GW-Edition 6.8.5 2009.12.26 Heuristic.LooksLike.Win32.Suspicious.C
Microsoft 1.5302 2009.12.26 -
NOD32 4716 2009.12.25 -
Norman 6.04.03 2009.12.26 -
nProtect 2009.1.8.0 2009.12.26 -
Panda 10.0.2.2 2009.12.15 Suspicious file
PCTools 7.0.3.5 2009.12.26 -
Prevx 3.0 2009.12.26 -
Rising 22.27.05.04 2009.12.26 -
Sophos 4.49.0 2009.12.25 -
Sunbelt 3.2.1858.2 2009.12.26 -
Symantec 1.4.4.12 2009.12.26 -
TheHacker 6.5.0.3.111 2009.12.25 -
TrendMicro 9.120.0.1004 2009.12.26 -
VBA32 3.12.12.0 2009.12.26 -
ViRobot 2009.12.26.2109 2009.12.26 -
VirusBuster 5.0.21.0 2009.12.25 -
Information additionnelle
File size: 261632 bytes
MD5 : 4e20f3b27b334e9273fc3890b7948bd8
SHA1 : ff937b7eb12048f227d35d42efe3375dc5d7d1a0
SHA256: afb212b270e325888c330e97ef93fe5399e0ab6b0870c624ab28231fc8ee8c72
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x4B1FB9AD (Wed Dec 9 15:52:29 2009)
machinetype.......: 0x14C (Intel I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xD1000 0x3E600 8.00 aa60f3c16e3b0fab6e082459c3701555
.rsrc 0xD2000 0x2000 0x1200 7.23 7dd9c5b051360dcd9867eb9ac7e54706
.reloc 0xD4000 0x200 0x200 0.22 b2653d9ffb17cc053523a34099297f53
( 1 imports )
> kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree
( 0 exports )
TrID : File type identification
Win32 EXE PECompact compressed (v2.x) (48.9%)
Win32 EXE PECompact compressed (generic) (34.4%)
Win32 Executable Generic (7.0%)
Win32 Dynamic Link Library (generic) (6.2%)
Generic Win/DOS Executable (1.6%)
ssdeep: 6144:Lb0Cz2tkTv92ga9kLs9VCmm+9ah0jdWWG6tLoack7Z1Q:LbzitE92kLP9+98Iw6tTT1Q
PEiD : -
packers (Kaspersky): PE_Patch.PECompact, PecBundle
packers (F-Prot): PecBundle, PECompact
RDS : NSRL Reference Data Set
-
-
- 1
- 2
Suivant
