Malwarebytes
Rikyou -  
Bonjour, je possède un ordinateur windows xp attaqué par le malware "antimalware doctor". J'ai donc suivi les instructions et j'ai lancé le "scan complet". Jusque là pas de problème mais quand le scan se termine et que je lance la suppression des fichiers "mauvais", malwarebytes ne répond plus...
Par ailleurs, j'ai eu le temps d'enregistrer le rapport mais malheureusement je ne me souviens plus du lieu où je l'ai enregistrer. Sinon les fichiers "mauvais" se trouvent encore sous quarantaine (ce qui n'empêche pas "doctor" de continuer son trafic).
Je voulais savoir comment surmonter se "ne répond plus".
J'ai vu en surfant un coup qu'il est possible de le faire en mode "sans erreur" mais en surfant encore, l'éditeur du logiciel déconseille ce mode car il serait "peu efficace".
De plus mon caractère peu patient me pousse à vous demander : suis-je obliger de relancer le scan en mode "sans erreur" ou puis-je, à partir des scans précédents déjà réalisés reprendre la suppression qui ne répondait plus ?
Merci d'avance. Cordialement... :).

32 réponses

Résumé de la discussion

Une infection par Antimalware Doctor provoque le blocage de la suppression après le scan, Malwarebytes ne répondant plus et laissant des éléments malveillants en quarantaine qui continuent le trafic. Des solutions proposées incluent TDSSKiller pour repérer les rootkits et RogueKiller pour nettoyer les éléments bloqués, réinitialiser proxy et DNS, puis relancer MBAM après mise à jour. Pour maximiser les chances, suivre les étapes des tutoriels fournis et vérifier que le rapport est disponible sur le bureau ou dans le dossier logs, puis coller le contenu. En cas de persistance, démarrer en CD live peut aider à rétablir le système et permettre une suppression hors système avant de redémarrer, puis effectuer un nouveau scan complet après reconnection.

Bobot (l’IA à votre service)
  1. Rikyou Auteur
    Pour le démarrer en cd live il faut un graveur non ?
    1.  juju666 Contributeur sécurité
      oui :)
    2. Rikyou Auteur
      Le probleme c'est que mon seul ordinateur graveur est celui qui est fichu...
    3. juju666 Contributeur sécurité
      ah ben c'est mort :)
    4. Rikyou Auteur
      Dommage :), mais je n'ai qu'a changer de disque dur c'est bien ça ?
    5. juju666 Contributeur sécurité
      bah non trouve un graveur :)
      ou même un lecteur cd usb ...
  2. juju666 Contributeur sécurité
    Salut,

    Désolé du retard (examens de noël !)

    Du coup que fais tu de ton pc ? on peut démarrer en cd live dessus pour tenter de rétablir ça !
    1. Rikyou Auteur
      Merci pour ton aide mais malheureusement, le virus a eu raison de mon ordinateur, il fait un écrant noir au démarrage et je ne peux rien faire, je suis las de tout ces problemes, je te remerci encore une fois pour tout et à bientôt :).
      1.  juju666 Contributeur sécurité
        Bien.

        Nous allons effectuer un diagnostic de ton PC:

        ▶ Télécharge ZHPDiag

        ▶ Laisse toi guider lors de l'installation,coche "Ajouter une icône sur le bureau" et "Exécuter ZHPDiag"

        ▶ Clique sur l'icône représentant un tournevis vert et coche tout, puis sur l'icone représentant une loupe (« Lancer le diagnostic »)

        ▶ Durant le scan, accepte l'installation de SigCheck

        ▶ Une fois le scan aux 100%, ferme ZHPDiag. Héberge le rapport ZHPDiag.txt présent sur ton bureau.

        Voici comment procéder

        ▶ Rends toi sur pjjoint.malekal.com
        ▶ Clique sur le bouton Parcourir
        ▶ Sélectionne le fichier que tu veux héberger et clique sur Ouvrir
        ▶ Clique sur le bouton Envoyer
        ▶ Un message de confirmation s'affiche (L'upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015

        ▶ Copie le lien dans ta prochaine réponse.

        Tutoriel : http://forums-fec.be/entraide/viewtopic.php?f=55&t=13

        A bientôt.
        3. Rikyou Auteur
          23:27:46.0796 0840 TDSS rootkit removing tool 2.6.22.0 Dec 7 2011 13:21:06
          23:27:46.0906 0840 ============================================================
          23:27:46.0906 0840 Current date / time: 2011/12/12 23:27:46.0906
          23:27:46.0906 0840 SystemInfo:
          23:27:46.0906 0840
          23:27:46.0906 0840 OS Version: 5.1.2600 ServicePack: 2.0
          23:27:46.0906 0840 Product type: Workstation
          23:27:46.0906 0840 ComputerName: WORKSTATION
          23:27:46.0906 0840 UserName: Propriétaire
          23:27:46.0906 0840 Windows directory: C:\WINDOWS
          23:27:46.0906 0840 System windows directory: C:\WINDOWS
          23:27:46.0906 0840 Processor architecture: Intel x86
          23:27:46.0906 0840 Number of processors: 1
          23:27:46.0906 0840 Page size: 0x1000
          23:27:46.0906 0840 Boot type: Normal boot
          23:27:46.0906 0840 ============================================================
          23:27:48.0406 0840 Initialize success
          23:27:52.0500 3296 ============================================================
          23:27:52.0500 3296 Scan started
          23:27:52.0500 3296 Mode: Manual;
          23:27:52.0500 3296 ============================================================
          23:27:53.0281 3296 Scan interrupted by user!
          23:27:53.0281 3296 Scan interrupted by user!
          23:27:53.0281 3296 Scan interrupted by user!
          23:27:53.0281 3296 ============================================================
          23:27:53.0281 3296 Scan finished
          23:27:53.0281 3296 ============================================================
          23:27:53.0312 3316 Detected object count: 0
          23:27:53.0312 3316 Actual detected object count: 0
          23:27:54.0140 2488 ============================================================
          23:27:54.0140 2488 Scan started
          23:27:54.0140 2488 Mode: Manual;
          23:27:54.0140 2488 ============================================================
          23:27:54.0343 2488 Abiosdsk - ok
          23:27:54.0375 2488 abp480n5 - ok
          23:27:54.0421 2488 ACPI (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
          23:27:54.0421 2488 ACPI - ok
          23:27:54.0500 2488 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
          23:27:54.0515 2488 ACPIEC - ok
          23:27:54.0562 2488 adpu160m - ok
          23:27:54.0609 2488 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
          23:27:54.0640 2488 aec - ok
          23:27:54.0765 2488 AFD (944ca435bfcfc82cc1ed9e3a7d731aa9) C:\WINDOWS\System32\drivers\afd.sys
          23:27:54.0796 2488 AFD - ok
          23:27:54.0859 2488 Aha154x - ok
          23:27:54.0890 2488 aic78u2 - ok
          23:27:54.0921 2488 aic78xx - ok
          23:27:55.0078 2488 ALCXWDM (071757a906c7b3500916548e6fd8870b) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
          23:27:55.0234 2488 ALCXWDM - ok
          23:27:55.0312 2488 AliIde - ok
          23:27:55.0375 2488 AmdK7 (c0f59933070392e662b3c2bb2be77955) C:\WINDOWS\system32\DRIVERS\amdk7.sys
          23:27:55.0406 2488 AmdK7 - ok
          23:27:55.0453 2488 amsint - ok
          23:27:55.0531 2488 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
          23:27:55.0578 2488 Arp1394 - ok
          23:27:55.0625 2488 asc - ok
          23:27:55.0656 2488 asc3350p - ok
          23:27:55.0687 2488 asc3550 - ok
          23:27:55.0781 2488 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
          23:27:55.0812 2488 AsyncMac - ok
          23:27:55.0906 2488 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
          23:27:55.0937 2488 atapi - ok
          23:27:55.0968 2488 Atdisk - ok
          23:27:56.0109 2488 ati2mtag (3b88b6466896cc1a3a7e3287d72aca85) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
          23:27:56.0296 2488 ati2mtag - ok
          23:27:56.0500 2488 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
          23:27:56.0546 2488 Atmarpc - ok
          23:27:56.0765 2488 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
          23:27:56.0796 2488 audstub - ok
          23:27:56.0968 2488 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
          23:27:57.0000 2488 Beep - ok
          23:27:57.0171 2488 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
          23:27:57.0203 2488 cbidf2k - ok
          23:27:57.0281 2488 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
          23:27:57.0296 2488 CCDECODE - ok
          23:27:57.0343 2488 cd20xrnt - ok
          23:27:57.0406 2488 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
          23:27:57.0421 2488 Cdaudio - ok
          23:27:57.0484 2488 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
          23:27:57.0500 2488 Cdfs - ok
          23:27:57.0546 2488 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
          23:27:57.0593 2488 Cdrom - ok
          23:27:57.0625 2488 Changer - ok
          23:27:57.0687 2488 CmdIde - ok
          23:27:57.0734 2488 Cpqarray - ok
          23:27:57.0796 2488 dac2w2k - ok
          23:27:57.0828 2488 dac960nt - ok
          23:27:57.0906 2488 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
          23:27:57.0921 2488 Disk - ok
          23:27:58.0015 2488 dmboot (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
          23:27:58.0109 2488 dmboot - ok
          23:27:58.0218 2488 dmio (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
          23:27:58.0265 2488 dmio - ok
          23:27:58.0328 2488 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
          23:27:58.0359 2488 dmload - ok
          23:27:58.0421 2488 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
          23:27:58.0468 2488 DMusic - ok
          23:27:58.0500 2488 dpti2o - ok
          23:27:58.0609 2488 driverhardwarev2 (aad5b49f2aabeb78f8e37984f475659e) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
          23:27:58.0625 2488 driverhardwarev2 - ok
          23:27:58.0750 2488 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
          23:27:58.0781 2488 drmkaud - ok
          23:27:58.0812 2488 EagleNT - ok
          23:27:58.0890 2488 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
          23:27:58.0921 2488 Fastfat - ok
          23:27:59.0015 2488 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
          23:27:59.0031 2488 Fdc - ok
          23:27:59.0093 2488 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
          23:27:59.0109 2488 FETNDIS - ok
          23:27:59.0187 2488 Fips (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
          23:27:59.0218 2488 Fips - ok
          23:27:59.0265 2488 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
          23:27:59.0281 2488 Flpydisk - ok
          23:27:59.0343 2488 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
          23:27:59.0375 2488 FltMgr - ok
          23:27:59.0468 2488 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
          23:27:59.0468 2488 fssfltr - ok
          23:27:59.0546 2488 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
          23:27:59.0562 2488 Fs_Rec - ok
          23:27:59.0625 2488 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
          23:27:59.0656 2488 Ftdisk - ok
          23:27:59.0750 2488 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
          23:27:59.0765 2488 GEARAspiWDM - ok
          23:27:59.0828 2488 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
          23:27:59.0875 2488 Gpc - ok
          23:27:59.0937 2488 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
          23:27:59.0968 2488 HidUsb - ok
          23:27:59.0984 2488 hpn - ok
          23:28:00.0062 2488 HTTP (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
          23:28:00.0062 2488 HTTP - ok
          23:28:00.0140 2488 i2omgmt - ok
          23:28:00.0171 2488 i2omp - ok
          23:28:00.0203 2488 i8042prt (b4c177f19780948708646d6d124397cd) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
          23:28:00.0218 2488 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\i8042prt.sys. Real md5: b4c177f19780948708646d6d124397cd, Fake md5: f41fff8a2299855dfb8fcb98412a90a7
          23:28:00.0218 2488 i8042prt ( ForgedFile.Multi.Generic ) - warning
          23:28:00.0218 2488 i8042prt - detected ForgedFile.Multi.Generic (1)
          23:28:00.0296 2488 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
          23:28:00.0343 2488 Imapi - ok
          23:28:00.0375 2488 ini910u - ok
          23:28:00.0406 2488 IntelIde - ok
          23:28:00.0468 2488 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
          23:28:00.0484 2488 Ip6Fw - ok
          23:28:00.0578 2488 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
          23:28:00.0593 2488 IpFilterDriver - ok
          23:28:00.0656 2488 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
          23:28:00.0703 2488 IpInIp - ok
          23:28:00.0796 2488 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
          23:28:00.0796 2488 IpNat - ok
          23:28:00.0859 2488 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
          23:28:00.0906 2488 IPSec - ok
          23:28:00.0968 2488 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
          23:28:00.0984 2488 IRENUM - ok
          23:28:01.0046 2488 isapnp (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
          23:28:01.0078 2488 isapnp - ok
          23:28:01.0140 2488 izorex - ok
          23:28:01.0187 2488 Kbdclass (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
          23:28:01.0218 2488 Kbdclass - ok
          23:28:01.0281 2488 kbdhid (62dd5eefcec4ef4163f1168d4262a9e4) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
          23:28:01.0296 2488 kbdhid - ok
          23:28:01.0359 2488 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
          23:28:01.0390 2488 kmixer - ok
          23:28:01.0453 2488 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
          23:28:01.0468 2488 KSecDD - ok
          23:28:01.0515 2488 lbrtfdc - ok
          23:28:01.0578 2488 MBAMSwissArmy - ok
          23:28:01.0656 2488 mfeapfk (b5c306c5b5e7417b9d2b410894678069) C:\WINDOWS\system32\drivers\mfeapfk.sys
          23:28:01.0687 2488 mfeapfk - ok
          23:28:01.0812 2488 mfeavfk (87b28198b308af3469d6e0b81d86c1fa) C:\WINDOWS\system32\drivers\mfeavfk.sys
          23:28:01.0828 2488 mfeavfk - ok
          23:28:01.0890 2488 mfebopk (cf37784dd24c83f62626bc0ea3f5e386) C:\WINDOWS\system32\drivers\mfebopk.sys
          23:28:01.0921 2488 mfebopk - ok
          23:28:01.0984 2488 mfehidk (241c09c7d8c589ea1d72a36e6578e42c) C:\WINDOWS\system32\drivers\mfehidk.sys
          23:28:02.0015 2488 mfehidk - ok
          23:28:02.0125 2488 mferkdk (37b5228bea6b4429ffb90dfa77af4431) C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
          23:28:02.0140 2488 mferkdk - ok
          23:28:02.0234 2488 mfetdik (19c2d8af421e96d12e4004ca2162dbe9) C:\WINDOWS\system32\drivers\mfetdik.sys
          23:28:02.0265 2488 mfetdik - ok
          23:28:02.0328 2488 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
          23:28:02.0359 2488 mnmdd - ok
          23:28:02.0421 2488 Modem (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
          23:28:02.0421 2488 Modem - ok
          23:28:02.0484 2488 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
          23:28:02.0500 2488 MODEMCSA - ok
          23:28:02.0546 2488 Mouclass (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
          23:28:02.0578 2488 Mouclass - ok
          23:28:02.0640 2488 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
          23:28:02.0656 2488 mouhid - ok
          23:28:02.0750 2488 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
          23:28:02.0765 2488 MountMgr - ok
          23:28:02.0812 2488 mraid35x - ok
          23:28:02.0875 2488 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
          23:28:02.0921 2488 MRxDAV - ok
          23:28:02.0984 2488 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
          23:28:03.0062 2488 MRxSmb - ok
          23:28:03.0171 2488 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
          23:28:03.0187 2488 Msfs - ok
          23:28:03.0265 2488 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
          23:28:03.0281 2488 MSKSSRV - ok
          23:28:03.0343 2488 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
          23:28:03.0359 2488 MSPCLOCK - ok
          23:28:03.0406 2488 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
          23:28:03.0437 2488 MSPQM - ok
          23:28:03.0500 2488 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
          23:28:03.0500 2488 mssmbios - ok
          23:28:03.0562 2488 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
          23:28:03.0578 2488 MSTEE - ok
          23:28:03.0656 2488 Mtlmnt5 (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
          23:28:03.0703 2488 Mtlmnt5 - ok
          23:28:03.0843 2488 Mtlstrm (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
          23:28:03.0921 2488 Mtlstrm - ok
          23:28:04.0015 2488 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
          23:28:04.0031 2488 Mup - ok
          23:28:04.0109 2488 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
          23:28:04.0125 2488 NABTSFEC - ok
          23:28:04.0218 2488 NDIS (93b984ecaff503d80c61e76a9959ceea) C:\WINDOWS\system32\drivers\NDIS.sys
          23:28:04.0578 2488 NDIS - ok
          23:28:04.0671 2488 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
          23:28:04.0703 2488 NdisIP - ok
          23:28:04.0796 2488 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
          23:28:04.0812 2488 NdisTapi - ok
          23:28:04.0875 2488 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
          23:28:04.0890 2488 Ndisuio - ok
          23:28:04.0937 2488 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
          23:28:04.0968 2488 NdisWan - ok
          23:28:05.0031 2488 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
          23:28:05.0062 2488 NDProxy - ok
          23:28:05.0109 2488 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
          23:28:05.0125 2488 NetBIOS - ok
          23:28:05.0187 2488 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
          23:28:05.0218 2488 NetBT - ok
          23:28:05.0312 2488 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
          23:28:05.0343 2488 NIC1394 - ok
          23:28:05.0421 2488 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
          23:28:05.0437 2488 nm - ok
          23:28:05.0500 2488 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
          23:28:05.0531 2488 Npfs - ok
          23:28:05.0609 2488 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
          23:28:05.0671 2488 Ntfs - ok
          23:28:05.0796 2488 NtMtlFax (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
          23:28:05.0843 2488 NtMtlFax - ok
          23:28:05.0906 2488 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
          23:28:05.0921 2488 Null - ok
          23:28:05.0984 2488 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
          23:28:06.0000 2488 NwlnkFlt - ok
          23:28:06.0062 2488 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
          23:28:06.0093 2488 NwlnkFwd - ok
          23:28:06.0156 2488 ohci1394 (8800483b09d1a28edae0af60ed24425e) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
          23:28:06.0171 2488 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ohci1394.sys. Real md5: 8800483b09d1a28edae0af60ed24425e, Fake md5: e50531721efcad1323add311425b21fc
          23:28:06.0171 2488 ohci1394 ( ForgedFile.Multi.Generic ) - warning
          23:28:06.0171 2488 ohci1394 - detected ForgedFile.Multi.Generic (1)
          23:28:06.0281 2488 Parport (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\DRIVERS\parport.sys
          23:28:06.0328 2488 Parport - ok
          23:28:06.0390 2488 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
          23:28:06.0421 2488 PartMgr - ok
          23:28:06.0468 2488 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
          23:28:06.0500 2488 ParVdm - ok
          23:28:06.0562 2488 PCI (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
          23:28:06.0578 2488 PCI - ok
          23:28:06.0609 2488 PCIDump - ok
          23:28:06.0656 2488 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
          23:28:06.0671 2488 PCIIde - ok
          23:28:06.0765 2488 Pcmcia (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\drivers\Pcmcia.sys
          23:28:06.0796 2488 Pcmcia - ok
          23:28:06.0859 2488 PDCOMP - ok
          23:28:06.0875 2488 PDFRAME - ok
          23:28:06.0906 2488 PDRELI - ok
          23:28:06.0921 2488 PDRFRAME - ok
          23:28:06.0953 2488 perc2 - ok
          23:28:06.0968 2488 perc2hib - ok
          23:28:07.0062 2488 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
          23:28:07.0093 2488 PptpMiniport - ok
          23:28:07.0187 2488 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
          23:28:07.0218 2488 PSched - ok
          23:28:07.0281 2488 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
          23:28:07.0312 2488 Ptilink - ok
          23:28:07.0359 2488 PxHelp20 (0c8da0a8b0d227319c285e0eae65defd) C:\WINDOWS\system32\Drivers\PxHelp20.sys
          23:28:07.0390 2488 PxHelp20 - ok
          23:28:07.0421 2488 ql1080 - ok
          23:28:07.0453 2488 Ql10wnt - ok
          23:28:07.0468 2488 ql12160 - ok
          23:28:07.0500 2488 ql1240 - ok
          23:28:07.0515 2488 ql1280 - ok
          23:28:07.0578 2488 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
          23:28:07.0593 2488 RasAcd - ok
          23:28:07.0687 2488 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
          23:28:07.0718 2488 Rasl2tp - ok
          23:28:07.0796 2488 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
          23:28:07.0843 2488 RasPppoe - ok
          23:28:07.0890 2488 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
          23:28:07.0921 2488 Raspti - ok
          23:28:08.0000 2488 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
          23:28:08.0046 2488 Rdbss - ok
          23:28:08.0109 2488 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
          23:28:08.0140 2488 RDPCDD - ok
          23:28:08.0218 2488 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
          23:28:08.0281 2488 RDPWD - ok
          23:28:08.0359 2488 RecAgent (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
          23:28:08.0375 2488 RecAgent - ok
          23:28:08.0437 2488 redbook (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERS\redbook.sys
          23:28:08.0484 2488 redbook - ok
          23:28:08.0593 2488 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
          23:28:08.0640 2488 Secdrv - ok
          23:28:08.0734 2488 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
          23:28:08.0765 2488 serenum - ok
          23:28:08.0828 2488 Serial (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\DRIVERS\serial.sys
          23:28:08.0859 2488 Serial - ok
          23:28:08.0906 2488 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
          23:28:08.0953 2488 Sfloppy - ok
          23:28:09.0000 2488 Simbad - ok
          23:28:09.0046 2488 SIS163u (c2299af684920f592d87aa002d072080) C:\WINDOWS\system32\DRIVERS\sis163u.sys
          23:28:09.0078 2488 SIS163u - ok
          23:28:09.0125 2488 sjzfmmz - ok
          23:28:09.0187 2488 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
          23:28:09.0234 2488 SLIP - ok
          23:28:09.0312 2488 Slntamr (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
          23:28:09.0375 2488 Slntamr - ok
          23:28:09.0453 2488 SlNtHal (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
          23:28:09.0484 2488 SlNtHal - ok
          23:28:09.0546 2488 SlWdmSup (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
          23:28:09.0562 2488 SlWdmSup - ok
          23:28:09.0593 2488 Sparrow - ok
          23:28:09.0640 2488 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
          23:28:09.0671 2488 splitter - ok
          23:28:09.0812 2488 sr (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
          23:28:09.0859 2488 sr - ok
          23:28:09.0937 2488 Srv (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINDOWS\system32\DRIVERS\srv.sys
          23:28:09.0984 2488 Srv - ok
          23:28:10.0062 2488 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
          23:28:10.0109 2488 streamip - ok
          23:28:10.0203 2488 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
          23:28:10.0218 2488 swenum - ok
          23:28:10.0281 2488 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
          23:28:10.0312 2488 swmidi - ok
          23:28:10.0359 2488 symc810 - ok
          23:28:10.0375 2488 symc8xx - ok
          23:28:10.0406 2488 sym_hi - ok
          23:28:10.0421 2488 sym_u3 - ok
          23:28:10.0468 2488 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
          23:28:10.0500 2488 sysaudio - ok
          23:28:10.0609 2488 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
          23:28:10.0671 2488 Tcpip - ok
          23:28:10.0781 2488 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
          23:28:10.0812 2488 TDPIPE - ok
          23:28:10.0875 2488 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
          23:28:10.0921 2488 TDTCP - ok
          23:28:10.0984 2488 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
          23:28:11.0015 2488 TermDD - ok
          23:28:11.0062 2488 TosIde - ok
          23:28:11.0109 2488 TrueSight (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys
          23:28:11.0140 2488 TrueSight - ok
          23:28:11.0234 2488 uagp35 (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys
          23:28:11.0265 2488 uagp35 - ok
          23:28:11.0328 2488 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
          23:28:11.0359 2488 Udfs - ok
          23:28:11.0390 2488 ultra - ok
          23:28:11.0453 2488 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
          23:28:11.0484 2488 Update - ok
          23:28:11.0609 2488 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
          23:28:11.0656 2488 USBAAPL - ok
          23:28:11.0750 2488 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
          23:28:11.0781 2488 usbaudio - ok
          23:28:11.0859 2488 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
          23:28:11.0875 2488 usbccgp - ok
          23:28:11.0937 2488 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
          23:28:11.0968 2488 usbehci - ok
          23:28:12.0031 2488 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
          23:28:12.0078 2488 usbhub - ok
          23:28:12.0140 2488 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
          23:28:12.0156 2488 usbscan - ok
          23:28:12.0218 2488 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
          23:28:12.0250 2488 USBSTOR - ok
          23:28:12.0296 2488 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
          23:28:12.0343 2488 usbuhci - ok
          23:28:12.0406 2488 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
          23:28:12.0421 2488 VgaSave - ok
          23:28:12.0484 2488 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
          23:28:12.0531 2488 ViaIde - ok
          23:28:12.0578 2488 VolSnap (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
          23:28:12.0609 2488 VolSnap - ok
          23:28:12.0671 2488 w200bus (34923e278eac7ddcea717ae1fcf592f6) C:\WINDOWS\system32\DRIVERS\w200bus.sys
          23:28:12.0687 2488 w200bus - ok
          23:28:12.0781 2488 w200mdfl (eff90a983cd3deab05922242e8072dc6) C:\WINDOWS\system32\DRIVERS\w200mdfl.sys
          23:28:12.0796 2488 w200mdfl - ok
          23:28:12.0859 2488 w200mdm (f03da4fbb2708a0b5409ea63e88c0f50) C:\WINDOWS\system32\DRIVERS\w200mdm.sys
          23:28:12.0890 2488 w200mdm - ok
          23:28:12.0953 2488 w200mgmt (1522d6387e6bb54aef9824b1733832db) C:\WINDOWS\system32\DRIVERS\w200mgmt.sys
          23:28:12.0984 2488 w200mgmt - ok
          23:28:13.0046 2488 w200obex (8405be0bba1ccf26d0fbdd26be03c816) C:\WINDOWS\system32\DRIVERS\w200obex.sys
          23:28:13.0078 2488 w200obex - ok
          23:28:13.0156 2488 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
          23:28:13.0187 2488 Wanarp - ok
          23:28:13.0234 2488 WDICA - ok
          23:28:13.0281 2488 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
          23:28:13.0296 2488 wdmaud - ok
          23:28:13.0421 2488 WmBEnum (1abfd1399436e81c9d857f5fc76eaf98) C:\WINDOWS\system32\drivers\WmBEnum.sys
          23:28:13.0437 2488 WmBEnum - ok
          23:28:13.0515 2488 WmFilter (b3cfcbcc91ff61ef82fc693b8b57e7f0) C:\WINDOWS\system32\drivers\WmFilter.sys
          23:28:13.0531 2488 WmFilter - ok
          23:28:13.0609 2488 WmVirHid (a40d2dd0f019423ef6c363f1295eb38d) C:\WINDOWS\system32\drivers\WmVirHid.sys
          23:28:13.0625 2488 WmVirHid - ok
          23:28:13.0687 2488 WmXlCore (2bf505424f469155cd90d7b3301d7adc) C:\WINDOWS\system32\drivers\WmXlCore.sys
          23:28:13.0703 2488 WmXlCore - ok
          23:28:13.0796 2488 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
          23:28:13.0828 2488 WSTCODEC - ok
          23:28:13.0890 2488 zqvvdbvyy9 - ok
          23:28:13.0937 2488 ZSMC301b (73b6b26943db1660e35b99254336e2c8) C:\WINDOWS\system32\Drivers\usbVM31b.sys
          23:28:13.0968 2488 ZSMC301b - ok
          23:28:14.0015 2488 MBR (0x1B8) (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
          23:28:14.0093 2488 \Device\Harddisk0\DR0 - ok
          23:28:14.0109 2488 Boot (0x1200) (1c204c6158ac013f45bb8f7e0d051c99) \Device\Harddisk0\DR0\Partition0
          23:28:14.0109 2488 \Device\Harddisk0\DR0\Partition0 - ok
          23:28:14.0156 2488 Boot (0x1200) (830ff424407abe83c7e40ab2846408ce) \Device\Harddisk0\DR0\Partition1
          23:28:14.0156 2488 \Device\Harddisk0\DR0\Partition1 - ok
          23:28:14.0156 2488 ============================================================
          23:28:14.0156 2488 Scan finished
          23:28:14.0156 2488 ============================================================
          23:28:14.0187 3476 Detected object count: 2
          23:28:14.0187 3476 Actual detected object count: 2
          23:28:31.0500 3476 HKLM\SYSTEM\ControlSet002\services\i8042prt - will be deleted on reboot
          23:28:31.0500 3476 HKLM\SYSTEM\ControlSet003\services\i8042prt - will be deleted on reboot
          23:28:31.0500 3476 HKLM\SYSTEM\ControlSet004\services\i8042prt - will be deleted on reboot
          23:28:31.0531 3476 C:\WINDOWS\system32\DRIVERS\i8042prt.sys - will be deleted on reboot
          23:28:31.0531 3476 i8042prt ( ForgedFile.Multi.Generic ) - User select action: Delete
          23:28:31.0531 3476 HKLM\SYSTEM\ControlSet002\services\ohci1394 - will be deleted on reboot
          23:28:31.0531 3476 HKLM\SYSTEM\ControlSet003\services\ohci1394 - will be deleted on reboot
          23:28:31.0531 3476 HKLM\SYSTEM\ControlSet004\services\ohci1394 - will be deleted on reboot
          23:28:31.0546 3476 C:\WINDOWS\system32\DRIVERS\ohci1394.sys - will be deleted on reboot
          23:28:31.0546 3476 ohci1394 ( ForgedFile.Multi.Generic ) - User select action: Delete
          23:28:39.0390 0832 Deinitialize success--
          Everything I do, I do it big. Wiz Khalifa.
          2. juju666 Contributeur sécurité
            relance le scan mais fais cure si tu peux, si pas delete ;)
            1.  Rikyou Auteur
              22:50:48.0046 3140 TDSS rootkit removing tool 2.6.22.0 Dec 7 2011 13:21:06
              22:50:48.0171 3140 ============================================================
              22:50:48.0171 3140 Current date / time: 2011/12/12 22:50:48.0171
              22:50:48.0171 3140 SystemInfo:
              22:50:48.0171 3140
              22:50:48.0171 3140 OS Version: 5.1.2600 ServicePack: 2.0
              22:50:48.0171 3140 Product type: Workstation
              22:50:48.0171 3140 ComputerName: WORKSTATION
              22:50:48.0171 3140 UserName: Propriétaire
              22:50:48.0171 3140 Windows directory: C:\WINDOWS
              22:50:48.0171 3140 System windows directory: C:\WINDOWS
              22:50:48.0171 3140 Processor architecture: Intel x86
              22:50:48.0171 3140 Number of processors: 1
              22:50:48.0171 3140 Page size: 0x1000
              22:50:48.0171 3140 Boot type: Normal boot
              22:50:48.0171 3140 ============================================================
              22:50:48.0375 3140 Initialize success
              22:50:49.0781 3408 ============================================================
              22:50:49.0781 3408 Scan started
              22:50:49.0781 3408 Mode: Manual;
              22:50:49.0781 3408 ============================================================
              22:50:51.0203 3408 Abiosdsk - ok
              22:50:51.0234 3408 abp480n5 - ok
              22:50:51.0421 3408 ACPI (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys
              22:50:51.0546 3408 ACPI - ok
              22:50:51.0937 3408 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\drivers\ACPIEC.sys
              22:50:51.0968 3408 ACPIEC - ok
              22:50:52.0093 3408 adpu160m - ok
              22:50:52.0500 3408 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
              22:50:52.0531 3408 aec - ok
              22:50:52.0781 3408 AFD (944ca435bfcfc82cc1ed9e3a7d731aa9) C:\WINDOWS\System32\drivers\afd.sys
              22:50:52.0828 3408 AFD - ok
              22:50:53.0078 3408 Aha154x - ok
              22:50:53.0218 3408 aic78u2 - ok
              22:50:53.0281 3408 aic78xx - ok
              22:50:54.0562 3408 ALCXWDM (071757a906c7b3500916548e6fd8870b) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
              22:50:55.0578 3408 ALCXWDM - ok
              22:50:55.0765 3408 AliIde - ok
              22:50:55.0906 3408 AmdK7 (c0f59933070392e662b3c2bb2be77955) C:\WINDOWS\system32\DRIVERS\amdk7.sys
              22:50:55.0921 3408 AmdK7 - ok
              22:50:56.0109 3408 amsint - ok
              22:50:56.0406 3408 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
              22:50:56.0406 3408 Arp1394 - ok
              22:50:56.0625 3408 asc - ok
              22:50:56.0812 3408 asc3350p - ok
              22:50:57.0093 3408 asc3550 - ok
              22:50:57.0296 3408 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
              22:50:57.0296 3408 AsyncMac - ok
              22:50:57.0406 3408 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
              22:50:57.0406 3408 atapi - ok
              22:50:57.0500 3408 Atdisk - ok
              22:50:58.0390 3408 ati2mtag (3b88b6466896cc1a3a7e3287d72aca85) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
              22:50:59.0640 3408 ati2mtag - ok
              22:51:00.0156 3408 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
              22:51:00.0187 3408 Atmarpc - ok
              22:51:00.0687 3408 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
              22:51:00.0734 3408 audstub - ok
              22:51:01.0187 3408 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
              22:51:01.0218 3408 Beep - ok
              22:51:01.0359 3408 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
              22:51:01.0375 3408 cbidf2k - ok
              22:51:01.0609 3408 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
              22:51:01.0609 3408 CCDECODE - ok
              22:51:01.0781 3408 cd20xrnt - ok
              22:51:02.0000 3408 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
              22:51:02.0031 3408 Cdaudio - ok
              22:51:02.0218 3408 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
              22:51:02.0234 3408 Cdfs - ok
              22:51:02.0468 3408 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
              22:51:02.0484 3408 Cdrom - ok
              22:51:02.0765 3408 Changer - ok
              22:51:03.0015 3408 CmdIde - ok
              22:51:03.0125 3408 Cpqarray - ok
              22:51:03.0296 3408 dac2w2k - ok
              22:51:03.0421 3408 dac960nt - ok
              22:51:03.0656 3408 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
              22:51:03.0671 3408 Disk - ok
              22:51:03.0984 3408 dmboot (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys
              22:51:04.0125 3408 dmboot - ok
              22:51:04.0437 3408 dmio (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys
              22:51:04.0468 3408 dmio - ok
              22:51:04.0640 3408 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
              22:51:04.0656 3408 dmload - ok
              22:51:04.0859 3408 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
              22:51:04.0875 3408 DMusic - ok
              22:51:05.0125 3408 dpti2o - ok
              22:51:05.0312 3408 driverhardwarev2 (aad5b49f2aabeb78f8e37984f475659e) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
              22:51:05.0328 3408 driverhardwarev2 - ok
              22:51:05.0515 3408 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
              22:51:05.0531 3408 drmkaud - ok
              22:51:05.0687 3408 EagleNT - ok
              22:51:05.0921 3408 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
              22:51:06.0000 3408 Fastfat - ok
              22:51:06.0281 3408 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
              22:51:06.0281 3408 Fdc - ok
              22:51:06.0515 3408 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
              22:51:06.0546 3408 FETNDIS - ok
              22:51:06.0812 3408 Fips (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys
              22:51:06.0843 3408 Fips - ok
              22:51:07.0125 3408 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
              22:51:07.0156 3408 Flpydisk - ok
              22:51:07.0390 3408 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
              22:51:07.0437 3408 FltMgr - ok
              22:51:07.0703 3408 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys
              22:51:07.0734 3408 fssfltr - ok
              22:51:08.0015 3408 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
              22:51:08.0031 3408 Fs_Rec - ok
              22:51:08.0218 3408 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
              22:51:08.0281 3408 Ftdisk - ok
              22:51:08.0562 3408 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
              22:51:08.0593 3408 GEARAspiWDM - ok
              22:51:08.0812 3408 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
              22:51:08.0828 3408 Gpc - ok
              22:51:09.0093 3408 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
              22:51:09.0109 3408 HidUsb - ok
              22:51:09.0265 3408 hpn - ok
              22:51:09.0656 3408 HTTP (cb77bb47e67e84deb17ba29632501730) C:\WINDOWS\system32\Drivers\HTTP.sys
              22:51:09.0703 3408 HTTP - ok
              22:51:09.0906 3408 i2omgmt - ok
              22:51:10.0046 3408 i2omp - ok
              22:51:10.0140 3408 i8042prt (b4c177f19780948708646d6d124397cd) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
              22:51:10.0140 3408 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\i8042prt.sys. Real md5: b4c177f19780948708646d6d124397cd, Fake md5: f41fff8a2299855dfb8fcb98412a90a7
              22:51:10.0140 3408 i8042prt ( ForgedFile.Multi.Generic ) - warning
              22:51:10.0140 3408 i8042prt - detected ForgedFile.Multi.Generic (1)
              22:51:10.0312 3408 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
              22:51:10.0343 3408 Imapi - ok
              22:51:10.0515 3408 ini910u - ok
              22:51:10.0609 3408 IntelIde - ok
              22:51:10.0750 3408 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
              22:51:10.0750 3408 Ip6Fw - ok
              22:51:10.0953 3408 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
              22:51:10.0953 3408 IpFilterDriver - ok
              22:51:11.0187 3408 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
              22:51:11.0187 3408 IpInIp - ok
              22:51:11.0421 3408 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
              22:51:11.0453 3408 IpNat - ok
              22:51:11.0734 3408 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
              22:51:11.0734 3408 IPSec - ok
              22:51:11.0921 3408 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
              22:51:11.0937 3408 IRENUM - ok
              22:51:12.0140 3408 isapnp (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys
              22:51:12.0140 3408 isapnp - ok
              22:51:12.0359 3408 izorex - ok
              22:51:12.0562 3408 Kbdclass (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
              22:51:12.0578 3408 Kbdclass - ok
              22:51:12.0734 3408 kbdhid (62dd5eefcec4ef4163f1168d4262a9e4) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
              22:51:12.0734 3408 kbdhid - ok
              22:51:12.0968 3408 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
              22:51:13.0000 3408 kmixer - ok
              22:51:13.0187 3408 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys
              22:51:13.0187 3408 KSecDD - ok
              22:51:13.0375 3408 lbrtfdc - ok
              22:51:13.0781 3408 MBAMSwissArmy (0905dc0814d738cff53577a59ccd81e0) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
              22:51:13.0812 3408 MBAMSwissArmy - ok
              22:51:14.0015 3408 mfeapfk (b5c306c5b5e7417b9d2b410894678069) C:\WINDOWS\system32\drivers\mfeapfk.sys
              22:51:14.0046 3408 mfeapfk - ok
              22:51:14.0500 3408 mfeavfk (87b28198b308af3469d6e0b81d86c1fa) C:\WINDOWS\system32\drivers\mfeavfk.sys
              22:51:14.0515 3408 mfeavfk - ok
              22:51:14.0843 3408 mfebopk (cf37784dd24c83f62626bc0ea3f5e386) C:\WINDOWS\system32\drivers\mfebopk.sys
              22:51:14.0890 3408 mfebopk - ok
              22:51:15.0078 3408 mfehidk (241c09c7d8c589ea1d72a36e6578e42c) C:\WINDOWS\system32\drivers\mfehidk.sys
              22:51:15.0187 3408 mfehidk - ok
              22:51:15.0437 3408 mferkdk (37b5228bea6b4429ffb90dfa77af4431) C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
              22:51:15.0468 3408 mferkdk - ok
              22:51:15.0796 3408 mfetdik (19c2d8af421e96d12e4004ca2162dbe9) C:\WINDOWS\system32\drivers\mfetdik.sys
              22:51:15.0843 3408 mfetdik - ok
              22:51:16.0109 3408 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
              22:51:16.0140 3408 mnmdd - ok
              22:51:16.0375 3408 Modem (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys
              22:51:16.0390 3408 Modem - ok
              22:51:16.0609 3408 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
              22:51:16.0625 3408 MODEMCSA - ok
              22:51:16.0843 3408 Mouclass (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\DRIVERS\mouclass.sys
              22:51:16.0843 3408 Mouclass - ok
              22:51:17.0078 3408 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
              22:51:17.0093 3408 mouhid - ok
              22:51:17.0312 3408 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
              22:51:17.0343 3408 MountMgr - ok
              22:51:17.0468 3408 mraid35x - ok
              22:51:17.0718 3408 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
              22:51:17.0750 3408 MRxDAV - ok
              22:51:18.0093 3408 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
              22:51:18.0156 3408 MRxSmb - ok
              22:51:18.0390 3408 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
              22:51:18.0421 3408 Msfs - ok
              22:51:18.0703 3408 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
              22:51:18.0718 3408 MSKSSRV - ok
              22:51:18.0937 3408 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
              22:51:18.0937 3408 MSPCLOCK - ok
              22:51:19.0187 3408 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
              22:51:19.0187 3408 MSPQM - ok
              22:51:19.0390 3408 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
              22:51:19.0406 3408 mssmbios - ok
              22:51:19.0484 3408 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
              22:51:19.0500 3408 MSTEE - ok
              22:51:19.0578 3408 Mtlmnt5 (c53775780148884ac87c455489a0c070) C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys
              22:51:19.0578 3408 Mtlmnt5 - ok
              22:51:19.0921 3408 Mtlstrm (54886a652bf5685192141df304e923fd) C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys
              22:51:20.0250 3408 Mtlstrm - ok
              22:51:20.0546 3408 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
              22:51:20.0593 3408 Mup - ok
              22:51:20.0843 3408 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
              22:51:20.0859 3408 NABTSFEC - ok
              22:51:21.0171 3408 NDIS (93b984ecaff503d80c61e76a9959ceea) C:\WINDOWS\system32\drivers\NDIS.sys
              22:51:21.0187 3408 NDIS - ok
              22:51:21.0343 3408 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
              22:51:21.0343 3408 NdisIP - ok
              22:51:21.0500 3408 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
              22:51:21.0500 3408 NdisTapi - ok
              22:51:21.0562 3408 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
              22:51:21.0593 3408 Ndisuio - ok
              22:51:21.0687 3408 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
              22:51:21.0703 3408 NdisWan - ok
              22:51:21.0812 3408 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
              22:51:21.0828 3408 NDProxy - ok
              22:51:21.0968 3408 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
              22:51:21.0984 3408 NetBIOS - ok
              22:51:22.0140 3408 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
              22:51:22.0140 3408 NetBT - ok
              22:51:22.0375 3408 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
              22:51:22.0375 3408 NIC1394 - ok
              22:51:22.0500 3408 nm (60cf8c7192b3614f240838ddbaa4a245) C:\WINDOWS\system32\DRIVERS\NMnt.sys
              22:51:22.0500 3408 nm - ok
              22:51:22.0671 3408 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
              22:51:22.0671 3408 Npfs - ok
              22:51:22.0875 3408 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
              22:51:22.0921 3408 Ntfs - ok
              22:51:23.0031 3408 NtMtlFax (576b34ceae5b7e5d9fd2775e93b3db53) C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys
              22:51:23.0062 3408 NtMtlFax - ok
              22:51:23.0203 3408 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
              22:51:23.0203 3408 Null - ok
              22:51:23.0343 3408 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
              22:51:23.0343 3408 NwlnkFlt - ok
              22:51:23.0437 3408 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
              22:51:23.0437 3408 NwlnkFwd - ok
              22:51:23.0640 3408 ohci1394 (8800483b09d1a28edae0af60ed24425e) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
              22:51:23.0656 3408 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ohci1394.sys. Real md5: 8800483b09d1a28edae0af60ed24425e, Fake md5: e50531721efcad1323add311425b21fc
              22:51:23.0656 3408 ohci1394 ( ForgedFile.Multi.Generic ) - warning
              22:51:23.0656 3408 ohci1394 - detected ForgedFile.Multi.Generic (1)
              22:51:23.0796 3408 Parport (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\DRIVERS\parport.sys
              22:51:23.0796 3408 Parport - ok
              22:51:23.0906 3408 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
              22:51:23.0906 3408 PartMgr - ok
              22:51:24.0093 3408 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
              22:51:24.0125 3408 ParVdm - ok
              22:51:24.0234 3408 PCI (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys
              22:51:24.0234 3408 PCI - ok
              22:51:24.0375 3408 PCIDump - ok
              22:51:24.0671 3408 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
              22:51:24.0671 3408 PCIIde - ok
              22:51:24.0921 3408 Pcmcia (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\drivers\Pcmcia.sys
              22:51:24.0953 3408 Pcmcia - ok
              22:51:25.0062 3408 PDCOMP - ok
              22:51:25.0218 3408 PDFRAME - ok
              22:51:25.0468 3408 PDRELI - ok
              22:51:25.0515 3408 PDRFRAME - ok
              22:51:25.0578 3408 perc2 - ok
              22:51:25.0765 3408 perc2hib - ok
              22:51:26.0109 3408 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
              22:51:26.0125 3408 PptpMiniport - ok
              22:51:26.0281 3408 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
              22:51:26.0281 3408 PSched - ok
              22:51:26.0453 3408 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
              22:51:26.0453 3408 Ptilink - ok
              22:51:26.0625 3408 PxHelp20 (0c8da0a8b0d227319c285e0eae65defd) C:\WINDOWS\system32\Drivers\PxHelp20.sys
              22:51:26.0656 3408 PxHelp20 - ok
              22:51:26.0765 3408 ql1080 - ok
              22:51:27.0062 3408 Ql10wnt - ok
              22:51:27.0218 3408 ql12160 - ok
              22:51:27.0328 3408 ql1240 - ok
              22:51:27.0484 3408 ql1280 - ok
              22:51:27.0750 3408 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
              22:51:27.0765 3408 RasAcd - ok
              22:51:27.0921 3408 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
              22:51:27.0937 3408 Rasl2tp - ok
              22:51:28.0218 3408 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
              22:51:28.0218 3408 RasPppoe - ok
              22:51:28.0390 3408 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
              22:51:28.0406 3408 Raspti - ok
              22:51:28.0671 3408 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys
              22:51:28.0687 3408 Rdbss - ok
              22:51:28.0953 3408 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
              22:51:28.0953 3408 RDPCDD - ok
              22:51:29.0328 3408 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
              22:51:29.0328 3408 RDPWD - ok
              22:51:29.0531 3408 RecAgent (e9aaa0092d74a9d371659c4c38882e12) C:\WINDOWS\system32\DRIVERS\RecAgent.sys
              22:51:29.0531 3408 RecAgent - ok
              22:51:29.0703 3408 redbook (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERS\redbook.sys
              22:51:29.0718 3408 redbook - ok
              22:51:29.0937 3408 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
              22:51:29.0953 3408 Secdrv - ok
              22:51:30.0062 3408 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
              22:51:30.0078 3408 serenum - ok
              22:51:30.0187 3408 Serial (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\DRIVERS\serial.sys
              22:51:30.0187 3408 Serial - ok
              22:51:30.0406 3408 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
              22:51:30.0421 3408 Sfloppy - ok
              22:51:30.0578 3408 Simbad - ok
              22:51:30.0671 3408 SIS163u (c2299af684920f592d87aa002d072080) C:\WINDOWS\system32\DRIVERS\sis163u.sys
              22:51:30.0703 3408 SIS163u - ok
              22:51:30.0906 3408 sjzfmmz - ok
              22:51:31.0062 3408 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
              22:51:31.0078 3408 SLIP - ok
              22:51:31.0437 3408 Slntamr (2c1779c0feb1f4a6033600305eba623a) C:\WINDOWS\system32\DRIVERS\slntamr.sys
              22:51:31.0437 3408 Slntamr - ok
              22:51:31.0687 3408 SlNtHal (f9b8e30e82ee95cf3e1d3e495599b99c) C:\WINDOWS\system32\DRIVERS\Slnthal.sys
              22:51:31.0718 3408 SlNtHal - ok
              22:51:31.0953 3408 SlWdmSup (db56bb2c55723815cf549d7fc50cfceb) C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys
              22:51:31.0953 3408 SlWdmSup - ok
              22:51:32.0140 3408 Sparrow - ok
              22:51:32.0359 3408 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
              22:51:32.0390 3408 splitter - ok
              22:51:32.0687 3408 sr (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys
              22:51:32.0687 3408 sr - ok
              22:51:33.0078 3408 Srv (ea554a3ffc3f536fe8320eb38f5e4843) C:\WINDOWS\system32\DRIVERS\srv.sys
              22:51:33.0156 3408 Srv - ok
              22:51:33.0390 3408 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
              22:51:33.0406 3408 streamip - ok
              22:51:33.0656 3408 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
              22:51:33.0671 3408 swenum - ok
              22:51:33.0906 3408 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
              22:51:33.0921 3408 swmidi - ok
              22:51:34.0093 3408 symc810 - ok
              22:51:34.0125 3408 symc8xx - ok
              22:51:34.0140 3408 sym_hi - ok
              22:51:34.0187 3408 sym_u3 - ok
              22:51:34.0296 3408 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
              22:51:34.0312 3408 sysaudio - ok
              22:51:34.0687 3408 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
              22:51:34.0750 3408 Tcpip - ok
              22:51:35.0078 3408 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
              22:51:35.0078 3408 TDPIPE - ok
              22:51:35.0375 3408 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
              22:51:35.0375 3408 TDTCP - ok
              22:51:35.0562 3408 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
              22:51:35.0578 3408 TermDD - ok
              22:51:35.0718 3408 TosIde - ok
              22:51:35.0843 3408 TrueSight (f69641efdb19acb4753b0155f7fdeed5) c:\windows\system32\drivers\TrueSight.sys
              22:51:35.0875 3408 TrueSight - ok
              22:51:36.0031 3408 uagp35 (49c805d42d75eddc9b6a7130999c9054) C:\WINDOWS\system32\DRIVERS\uagp35.sys
              22:51:36.0062 3408 uagp35 - ok
              22:51:36.0218 3408 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
              22:51:36.0234 3408 Udfs - ok
              22:51:36.0343 3408 ultra - ok
              22:51:36.0531 3408 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys
              22:51:36.0546 3408 Update - ok
              22:51:36.0734 3408 USBAAPL (1df89c499bf45d878b87ebd4421d462d) C:\WINDOWS\system32\Drivers\usbaapl.sys
              22:51:36.0734 3408 USBAAPL - ok
              22:51:36.0921 3408 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
              22:51:36.0937 3408 usbaudio - ok
              22:51:37.0203 3408 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
              22:51:37.0234 3408 usbccgp - ok
              22:51:37.0406 3408 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
              22:51:37.0421 3408 usbehci - ok
              22:51:37.0625 3408 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
              22:51:37.0640 3408 usbhub - ok
              22:51:37.0906 3408 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
              22:51:37.0906 3408 usbscan - ok
              22:51:38.0171 3408 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
              22:51:38.0203 3408 USBSTOR - ok
              22:51:38.0375 3408 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
              22:51:38.0390 3408 usbuhci - ok
              22:51:38.0640 3408 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
              22:51:38.0656 3408 VgaSave - ok
              22:51:38.0859 3408 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
              22:51:38.0906 3408 ViaIde - ok
              22:51:39.0171 3408 VolSnap (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys
              22:51:39.0187 3408 VolSnap - ok
              22:51:39.0453 3408 w200bus (34923e278eac7ddcea717ae1fcf592f6) C:\WINDOWS\system32\DRIVERS\w200bus.sys
              22:51:39.0484 3408 w200bus - ok
              22:51:39.0656 3408 w200mdfl (eff90a983cd3deab05922242e8072dc6) C:\WINDOWS\system32\DRIVERS\w200mdfl.sys
              22:51:39.0671 3408 w200mdfl - ok
              22:51:39.0906 3408 w200mdm (f03da4fbb2708a0b5409ea63e88c0f50) C:\WINDOWS\system32\DRIVERS\w200mdm.sys
              22:51:39.0953 3408 w200mdm - ok
              22:51:40.0203 3408 w200mgmt (1522d6387e6bb54aef9824b1733832db) C:\WINDOWS\system32\DRIVERS\w200mgmt.sys
              22:51:40.0203 3408 w200mgmt - ok
              22:51:40.0453 3408 w200obex (8405be0bba1ccf26d0fbdd26be03c816) C:\WINDOWS\system32\DRIVERS\w200obex.sys
              22:51:40.0515 3408 w200obex - ok
              22:51:40.0796 3408 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
              22:51:40.0812 3408 Wanarp - ok
              22:51:40.0953 3408 WDICA - ok
              22:51:41.0218 3408 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
              22:51:41.0218 3408 wdmaud - ok
              22:51:41.0781 3408 WmBEnum (1abfd1399436e81c9d857f5fc76eaf98) C:\WINDOWS\system32\drivers\WmBEnum.sys
              22:51:41.0796 3408 WmBEnum - ok
              22:51:42.0187 3408 WmFilter (b3cfcbcc91ff61ef82fc693b8b57e7f0) C:\WINDOWS\system32\drivers\WmFilter.sys
              22:51:42.0203 3408 WmFilter - ok
              22:51:42.0640 3408 WmVirHid (a40d2dd0f019423ef6c363f1295eb38d) C:\WINDOWS\system32\drivers\WmVirHid.sys
              22:51:42.0718 3408 WmVirHid - ok
              22:51:43.0031 3408 WmXlCore (2bf505424f469155cd90d7b3301d7adc) C:\WINDOWS\system32\drivers\WmXlCore.sys
              22:51:43.0046 3408 WmXlCore - ok
              22:51:43.0375 3408 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
              22:51:43.0406 3408 WSTCODEC - ok
              22:51:43.0671 3408 zqvvdbvyy9 - ok
              22:51:43.0921 3408 ZSMC301b (73b6b26943db1660e35b99254336e2c8) C:\WINDOWS\system32\Drivers\usbVM31b.sys
              22:51:43.0937 3408 ZSMC301b - ok
              22:51:44.0000 3408 MBR (0x1B8) (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
              22:51:48.0453 3408 \Device\Harddisk0\DR0 - ok
              22:51:48.0484 3408 Boot (0x1200) (1c204c6158ac013f45bb8f7e0d051c99) \Device\Harddisk0\DR0\Partition0
              22:51:48.0484 3408 \Device\Harddisk0\DR0\Partition0 - ok
              22:51:48.0515 3408 Boot (0x1200) (830ff424407abe83c7e40ab2846408ce) \Device\Harddisk0\DR0\Partition1
              22:51:48.0531 3408 \Device\Harddisk0\DR0\Partition1 - ok
              22:51:48.0531 3408 ============================================================
              22:51:48.0531 3408 Scan finished
              22:51:48.0531 3408 ============================================================
              22:51:48.0562 3412 Detected object count: 2
              22:51:48.0562 3412 Actual detected object count: 2
              22:59:47.0718 3412 i8042prt ( ForgedFile.Multi.Generic ) - skipped by user
              22:59:47.0718 3412 i8042prt ( ForgedFile.Multi.Generic ) - User select action: Skip
              22:59:47.0718 3412 ohci1394 ( ForgedFile.Multi.Generic ) - skipped by user
              22:59:47.0734 3412 ohci1394 ( ForgedFile.Multi.Generic ) - User select action: Skip
              23:00:27.0453 2868 Deinitialize success--
              Everything I do, I do it big. Wiz Khalifa.
              2. Rikyou Auteur
                quand le scan se termine j'arrive sur "threats detected" et j'ai 2 choses, 2 "forged file" dont le type est kernel driver, je ne comprend rien mais ca ne corespond pas à ce que tu m'as écrit, sauf peut etre le fait qu'il y est écrit "suspicious object".
                1.  juju666 Contributeur sécurité
                  joli tout ça ^^

                  j'crois qu'il se cache encore pas mal de choses :p

                  ▶ Télécharge Reload_TDSSKiller

                  ▶ Lance le

                  choisis : lancer le nettoyage

                  l'outil va automatiquement télécharger la derniere version puis

                  TDSSKiller va s'ouvrir , clique sur "Start Scan" Clique ici pour l'aide en image

                  Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut.
                  Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée.
                  Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée.
                  Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas
                  Si Suspicious file est indiqué, laisse l''option cochée sur Skip
                  une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer

                  sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau

                  ▶ Copie/Colle son contenu dans ta prochaine réponse.

                  Tutoriel : http://forums-fec.be/entraide/viewtopic.php?f=55&t=15
                  1. Rikyou Auteur
                    Autant pour moi, c'est que c'est pas tout petit :p :
                    Malwarebytes' Anti-Malware 1.51.2.1300
                    www.malwarebytes.org

                    Version de la base de données: 8352

                    Windows 5.1.2600 Service Pack 2
                    Internet Explorer 6.0.2900.2180

                    12/12/2011 22:15:29
                    mbam-log-2011-12-12 (22-15-29).txt

                    Type d'examen: Examen rapide
                    Elément(s) analysé(s): 179381
                    Temps écoulé: 13 minute(s), 51 seconde(s)

                    Processus mémoire infecté(s): 5
                    Module(s) mémoire infecté(s): 2
                    Clé(s) du Registre infectée(s): 27
                    Valeur(s) du Registre infectée(s): 12
                    Elément(s) de données du Registre infecté(s): 3
                    Dossier(s) infecté(s): 2
                    Fichier(s) infecté(s): 71

                    Processus mémoire infecté(s):
                    c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> 644 -> Unloaded process successfully.
                    c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3716 -> Unloaded process successfully.
                    c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3848 -> Unloaded process successfully.
                    c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 3856 -> Unloaded process successfully.
                    c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> 4008 -> Unloaded process successfully.

                    Module(s) mémoire infecté(s):
                    c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
                    c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.

                    Clé(s) du Registre infectée(s):
                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspimgr (Trojan.Spambot) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Delete on reboot.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Delete on reboot.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{10467BA9-92F6-47DC-BF84-CAF34C5BE324} (Trojan.Downloader) -> Quarantined and deleted successfully.
                    HKEY_CLASSES_ROOT\CLSID\{315547D4-976F-486B-9A97-378AE6F23AF4} (Trojan.Downloader) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Downloader) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\INSTALL.EXE (Trojan.Downloader) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Sft (Backdoor.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASPIMGR (Trojan.Agent) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SPService (TrojanProxy.Agent) -> Quarantined and deleted successfully.

                    Valeur(s) du Registre infectée(s):
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Value: {A2BA40A0-74F1-52BD-F411-00B15A2C8953} -> Delete on reboot.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\GootkitSSO (Trojan.Downloader) -> Value: GootkitSSO -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Dropper) -> Value: userini -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net (Trojan.Downloader) -> Value: net -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{A2BA40A0-74F1-52BD-F411-00B15A2C8953} (Trojan.Ertfor) -> Value: {A2BA40A0-74F1-52BD-F411-00B15A2C8953} -> Delete on reboot.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> Value: WINID -> Quarantined and deleted successfully.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Value: idstrf -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Value: UID -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> Quarantined and deleted successfully.

                    Elément(s) de données du Registre infecté(s):
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Meredrop) -> Bad: (C:\WINDOWS\system32\sdra64.exe) Good: () -> Delete on reboot.
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
                    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.

                    Dossier(s) infecté(s):
                    c:\documents and settings\propriétaire\application data\systemproc (Trojan.Agent) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

                    Fichier(s) infecté(s):
                    c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
                    c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.
                    c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\sdra64.exe (Trojan.Meredrop) -> Delete on reboot.
                    c:\documents and settings\propriétaire\application data\sdra64.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\0045.DLL (Trojan.Witkinat) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\cooper.mine (Trojan.Dropper) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\glmf3232.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\sshnas21.dll (Trojan.Inject) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\rx6zjwmd.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\drivers\zqvvdbvyy9.sys (Rootkit.Tent) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\wbem\grpconv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\janfw.exe (Malware.Gen) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\smanxrocwe.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\smss.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\system.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\notepad.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\mexcosanwr.tmp (Trojan.Tracur.S) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\mhq49i8w.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\debug.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\dm9540y0q.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\wasmeorxcn.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\khvcol.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\lpmv6hmn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\ukhfw5q.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\urt1a1.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\Uvb.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\Uvc.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\uvono.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\~TM5D.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\ccl9ke.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\wgvyd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\win.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\win32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\wzhuglnue.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\grb4dg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\jczqq47i3y5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\WINDOWS\Temp\wpv381274835170.exe (Trojan.Insain) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\application data\asam.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\application data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\temporary internet files\Content.IE5\47SL61YJ\yptozgozmu[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\temporary internet files\Content.IE5\WD2VCLUJ\gnemtrzxsn[1].htm (Malware.Gen) -> Quarantined and deleted successfully.
                    c:\WINDOWS\Unapua.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\02000000bb25252c922c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\02000000bb25252c922o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\02000000bb25252c922p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\02000000bb25252c922s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\all users\application data\Adobe\sp.DLL (TrojanProxy.Agent) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\systemproc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\h7t.wt (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\hgtd.ruy (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\nmklo.dll (Worm.MarioFev) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\WORK.DAT (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\local settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                    c:\WINDOWS\Temp\wpv271274835423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    c:\WINDOWS\explorer.exe:userini.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
                    c:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.
                    c:\documents and settings\propriétaire\application data\systemproc\upd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                    c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
                    c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
                    c:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.
                    2. Rikyou Auteur
                      Dossier(s) infecté(s):
                      c:\documents and settings\propriétaire\application data\systemproc (Trojan.Agent) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

                      Fichier(s) infecté(s):
                      c:\WINDOWS\system32\aspimgr.exe (Trojan.Spambot) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\ktx56.dll (Trojan.Ertfor) -> Delete on reboot.
                      c:\WINDOWS\system32\msxsltsso.dll (Trojan.Downloader) -> Delete on reboot.
                      c:\WINDOWS\system32\userini.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\sdra64.exe (Trojan.Meredrop) -> Delete on reboot.
                      c:\documents and settings\propriétaire\application data\sdra64.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\0045.DLL (Trojan.Witkinat) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\cooper.mine (Trojan.Dropper) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\glmf3232.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\sshnas21.dll (Trojan.Inject) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\rx6zjwmd.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\drivers\zqvvdbvyy9.sys (Rootkit.Tent) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\wbem\grpconv.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\install.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\janfw.exe (Malware.Gen) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\smanxrocwe.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\smss.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\system.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\notepad.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\mexcosanwr.tmp (Trojan.Tracur.S) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\mhq49i8w.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\debug.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\dm9540y0q.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\wasmeorxcn.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\khvcol.exe (Trojan.Meredrop) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\lpmv6hmn.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\ukhfw5q.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\urt1a1.exe (Trojan.Ertfor) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\Uvb.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\Uvc.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\uvono.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\~TM5D.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\ccl9ke.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\wgvyd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\win.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\win32.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\wzhuglnue.dll (Trojan.Ertfor) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\grb4dg.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\hexdump.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\jczqq47i3y5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\WINDOWS\Temp\wpv381274835170.exe (Trojan.Insain) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\application data\asam.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\application data\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\temporary internet files\Content.IE5\47SL61YJ\yptozgozmu[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\temporary internet files\Content.IE5\WD2VCLUJ\gnemtrzxsn[1].htm (Malware.Gen) -> Quarantined and deleted successfully.
                      c:\WINDOWS\Unapua.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\02000000bb25252c922c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\02000000bb25252c922o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\02000000bb25252c922p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\02000000bb25252c922s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\all users\application data\Adobe\sp.DLL (TrojanProxy.Agent) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\systemproc\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\fjhdyfhsn.bat (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\h7t.wt (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\hgtd.ruy (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\nmklo.dll (Worm.MarioFev) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\WORK.DAT (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\local settings\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
                      c:\WINDOWS\Temp\wpv271274835423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      c:\WINDOWS\explorer.exe:userini.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
                      c:\WINDOWS\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\WINDOWS\s32.txt (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\WINDOWS\ws386.ini (Malware.Trace) -> Quarantined and deleted successfully.
                      c:\documents and settings\propriétaire\application data\systemproc\upd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
                      c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
                      c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
                      c:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.--
                      Everything I do, I do it big. Wiz Khalifa.
                      1. juju666 Contributeur sécurité
                        tu redémarres, au redémarrage si le rapport s'ouvre pas tu vas dans mbam, onglet rapports/logs, tu le colle ici :)
                        1.  Rikyou Auteur
                          Je viens de finir mais un rapport bloc notes : "Impossible de supprimer certains éléments. Un fichier rapport a été enregistré dans le dossier logs." Que dois-je faire?
                          1.  juju666 Contributeur sécurité
                            oui c'est un rogue (faux logiciel de sécurité) :)
                            certains l'appellent ransomware ou un truc du genre ^^
                            1. Rikyou Auteur
                              Antimalware doctor est un rogue :) ? Sinon je suis entrain de scanner là :) merci beaucoup.
                              1.  juju666 Contributeur sécurité
                                voilà qui est tout de suite mieux ^^

                                allé go mise à jour mbam puis scan rapide, ça va shooter le rogue une bonne fois pour toutes.
                                • 1
                                • 2

                                Discussions similaires

                                Malwarebytes reste gratuit dans quelle condition ?
                                Bocdan

                                12 réponses
                                rendre malwarebyte ou avast en clès usb portable avec portableapps ou cameyo
                                david88700

                                43 réponses
                                retrouver son n° de licence malwarebytes
                                Granmimiche

                                1 réponse
                                compte malwarebytes
                                claudius40

                                4 réponses
                                malwarebytes gratuit mais au fiinal payant
                                Awdeline

                                5 réponses