Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

ordi infecté

brunflarbe

Par brunflarbe
dans Analyses et éradication malwares

 Partager

Messages recommandés

brunflarbe Junior Member

brunflarbe

Posté(e)
  • Auteur
Posté(e)

VOILA C FAIT.... :P

 

========== REGISTRY ==========

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrateur

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 27745625 bytes

->Java cache emptied: 9904774 bytes

->FireFox cache emptied: 34264767 bytes

->Google Chrome cache emptied: 182265510 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 335603 bytes

RecycleBin emptied: 2692245 bytes

 

Total Files Cleaned = 245,00 mb

 

 

OTM by OldTimer - Version 3.1.4.0 log created on 12292009_195516

 

Files moved on Reboot...

 

Registry entries deleted on Reboot...

Apollo Devil Member !

Apollo

Posté(e)
Posté(e) (modifié)

On dirait que tu n'as pas saisi la totalité du code mais ce n'est pas grave ici.

 

As-tu encore ces alertes d'antivir?

 

++

Modifié par Apollo
Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Comprends pas, MBAM et ESET sont muets.

 

On va employer un plus gros calibre alors.

 

Si lui ne trouve rien, il s'agit sûrement de faux-positifs d'antivir mais je n'oserais pas l'affirmer.

 

Télécharge Dr.Web CureIt sur ton Bureau:

ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe

 

Faire l'analyse en mode sans échec

http://www.vista-xp.fr/forum/topic93.html

 

  • Double clique launch.exe et ensuite clique sur Analyse;
  • Clique Ok à l'invite de l'analyse rapide. Ce scan permet l'analyse des processus chargés en mémoire; s'il trouve des processus infectés, clique le bouton Oui pour tout à l'invite.
    **Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction"; vous pouvez quitter en cliquant le "X"
  • Lorsque le scan rapide est terminé, Clique sur le menu Options >> Changer la configuration;
  • Choisis l'onglet "Scanner", et décoche "Analyse heuristique". Clique "Ok"
  • De retour à la fenêtre principale : clique pour activer "Analyse complète";
  • Clique le bouton avec flèche verte sur la droite, et le scan débutera.
  • Clique Oui pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique "Désinfecter".
  • Lorsque le scan sera complété, regarde si tu peux cliquer sur cette icône, adjacente aux fichiers détectés : check.gif
  • Si oui, alors clique dessus et ensuite clique sur l'icône "Suivant", au dessous, et choisis Déplacer en quarantaine l'objet indésirable
  • Du menu principal de l'outil, au haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport
  • Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv Ouvrir le fichier avec le bloc-notes puis sauvegarder ce fichier.
  • Ferme Dr.Web Cureit
  • Redémarre ton ordi (*très important*), car certains fichiers peuvent être déplacés/réparés au redémarrage.
  • Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.

 

@++

brunflarbe Junior Member

brunflarbe

Posté(e)
  • Auteur
Posté(e)

voila le rapport

Processus en mémoire: C:\Windows\system32\svchost.exe:748 BackDoor.Tdss.565 Eradiqué.

Process.exe C:\Windows\system32 Tool.Prockill Quarantaine.

nvstor.sys C:\Windows\system32\drivers BackDoor.Tdss.1365 Désinfecté.

nvstor.sys c:\windows\system32\drivers BackDoor.Tdss.1365 Désinfecté.

SmitfraudFix.exe\SmitfraudFix\Process.exe C:\Documents and Settings\Administrateur\Desktop\SmitfraudFix.exe Tool.Prockill

SmitfraudFix.exe\SmitfraudFix\restart.exe C:\Documents and Settings\Administrateur\Desktop\SmitfraudFix.exe Tool.ShutDown.14

SmitfraudFix.exe C:\Documents and Settings\Administrateur\Desktop L'archive contient des éléments infectés Quarantaine.

UsbFix.exe\Tools\Kill_P.exe C:\Documents and Settings\Administrateur\Desktop\UsbFix.exe Tool.Prockill

UsbFix.exe C:\Documents and Settings\Administrateur\Desktop L'archive contient des éléments infectés Quarantaine.

SmitfraudFix.exe\SmitfraudFix\Process.exe C:\Documents and Settings\Administrateur\DoctorWeb\Quarantine\SmitfraudFix.exe Tool.Prockill

SmitfraudFix.exe\SmitfraudFix\restart.exe C:\Documents and Settings\Administrateur\DoctorWeb\Quarantine\SmitfraudFix.exe Tool.ShutDown.14

SmitfraudFix.exe C:\Documents and Settings\Administrateur\DoctorWeb\Quarantine L'archive contient des éléments infectés Quarantaine.

UsbFix.exe\Tools\Kill_P.exe C:\Documents and Settings\Administrateur\DoctorWeb\Quarantine\UsbFix.exe Tool.Prockill

UsbFix.exe C:\Documents and Settings\Administrateur\DoctorWeb\Quarantine L'archive contient des éléments infectés Quarantaine.

keygen.exe C:\Documents and Settings\Administrateur\Downloads\TUNE UP\TuneUp.2010.FR\tune up utilities 2010 français\Keygen Trojan.Packed.654 Supprimé.

4b052dd6.qua/data001\Install.exe C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b052dd6.qua/data001 Trojan.MulDrop.33367

data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED L'archive contient des éléments infectés

4b052dd6.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b3285ee.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b3285ee.qua Win32.HLLM.Beagle.282

4b3285ee.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a441b.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a441b.qua Trojan.NtRootKit.4965

4b6a441b.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a4420.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a4420.qua Trojan.NtRootKit.4965

4b6a4420.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a455e.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a455e.qua Trojan.NtRootKit.4965

4b6a455e.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a47d9.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a47d9.qua Trojan.NtRootKit.4965

4b6a47d9.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a47dd.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a47dd.qua Trojan.NtRootKit.4965

4b6a47dd.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a4ba4.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a4ba4.qua Trojan.NtRootKit.4965

4b6a4ba4.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a50a1.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a50a1.qua Trojan.NtRootKit.4965

4b6a50a1.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a50a3.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a50a3.qua Trojan.NtRootKit.4965

4b6a50a3.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a55df.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a55df.qua Trojan.NtRootKit.4965

4b6a55df.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a55e2.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a55e2.qua Trojan.NtRootKit.4965

4b6a55e2.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a5718.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a5718.qua Trojan.NtRootKit.4965

4b6a5718.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a571a.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a571a.qua Trojan.NtRootKit.4965

4b6a571a.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a5853.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a5853.qua Trojan.NtRootKit.4965

4b6a5853.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b6a5855.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b6a5855.qua Trojan.NtRootKit.4965

4b6a5855.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b8a3adc.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b8a3adc.qua Trojan.Packed.706

4b8a3adc.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4b8d3b21.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4b8d3b21.qua Trojan.Packed.706

4b8d3b21.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

4cb7f795.qua\data001 C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED\4cb7f795.qua Trojan.Packed.706

4cb7f795.qua C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED Conteneur comporte des objets infectés Quarantaine.

RegUBP2b-Administrateur.reg C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2 Trojan.StartPage.1505 Supprimé.

Kill_P.exe C:\UsbFix\Tools Tool.Prockill Quarantaine.

Process.exe C:\Windows\System32 Tool.Prockill Chemin invalide pour le fichier

nvstor.sys C:\Windows\System32\drivers BackDoor.Tdss.1365 Désinfecté.

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Pas mal :P

 

On va voir s'il reste du TDSS...

 

Télécharge load_tdsskiller de Loup Blanc sur ton Bureau en cliquant sur ce lien :

 

http://fradesch.perso.cegetel.net/transf/Load_tdsskiller.exe

 

Cet outil est conçu pour automatiser différentes tâches proposées par TDSSKiller, un fix de Kaspersky.

  • Lance load_tdsskiller en double-cliquant dessus : l'outil va se connecter au Net pour télécharger une copie à jour de TDSSKiller, puis va lancer le scan
  • A la fin du scan, appuie sur une touche pour continuer, comme l'indique le message dans la fenêtre noire d'invite de commande
  • Le rapport s'affichera automatiquement : copie-colle son contenu dans ta prochaine réponse (le fichier est également présent ici : C:\tdsskiller\report.txt)
  • Fais redémarrer ton PC

 

@++

brunflarbe Junior Member

brunflarbe

Posté(e)
  • Auteur
Posté(e)

VOILA C FAIT

 

00:57:00:193 3912 TDSSKiller 2.1.1 Dec 20 2009 02:40:02

00:57:00:193 3912 ================================================================================

00:57:00:193 3912 SystemInfo:

 

00:57:00:193 3912 OS Version: 6.0.6001 ServicePack: 1.0

00:57:00:193 3912 Product type: Workstation

00:57:00:193 3912 ComputerName: LHSWEET-VY4PEH2

00:57:00:193 3912 UserName: Administrateur

00:57:00:193 3912 Windows directory: C:\Windows

00:57:00:193 3912 Processor architecture: Intel x86

00:57:00:193 3912 Number of processors: 2

00:57:00:193 3912 Page size: 0x1000

00:57:00:193 3912 Boot type: Normal boot

00:57:00:193 3912 ================================================================================

00:57:00:193 3912 ForceUnloadDriver: NtUnloadDriver error 2

00:57:00:193 3912 ForceUnloadDriver: NtUnloadDriver error 2

00:57:00:193 3912 ForceUnloadDriver: NtUnloadDriver error 2

00:57:00:209 3912 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\Drivers\KLMD.sys) returned status 0

00:57:00:209 3912 main: Driver KLMD successfully dropped

00:57:00:271 3912 main: Driver KLMD successfully loaded

00:57:00:271 3912

Scanning Registry ...

00:57:00:271 3912 ScanServices: Searching service UACd.sys

00:57:00:271 3912 ScanServices: Open/Create key error 2

00:57:00:271 3912 ScanServices: Searching service TDSSserv.sys

00:57:00:271 3912 ScanServices: Open/Create key error 2

00:57:00:271 3912 ScanServices: Searching service gaopdxserv.sys

00:57:00:271 3912 ScanServices: Open/Create key error 2

00:57:00:271 3912 ScanServices: Searching service gxvxcserv.sys

00:57:00:271 3912 ScanServices: Open/Create key error 2

00:57:00:271 3912 ScanServices: Searching service MSIVXserv.sys

00:57:00:271 3912 ScanServices: Open/Create key error 2

00:57:00:271 3912 UnhookRegistry: Kernel module file name: C:\Windows\system32\ntkrnlpa.exe, base addr: 81E1A000

00:57:00:302 3912 UnhookRegistry: Kernel local addr: 1D60000

00:57:00:302 3912 UnhookRegistry: KeServiceDescriptorTable addr: 1E97B00

00:57:00:380 3912 UnhookRegistry: KiServiceTable addr: 1E188E0

00:57:00:380 3912 UnhookRegistry: NtEnumerateKey service number (local): 85

00:57:00:380 3912 UnhookRegistry: NtEnumerateKey local addr: 1F67BAC

00:57:00:380 3912 KLMD_OpenDevice: Trying to open KLMD device

00:57:00:380 3912 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey

00:57:00:380 3912 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x81E6FAAD[0x4]

00:57:00:380 3912 UnhookRegistry: NtEnumerateKey service number (kernel): 85

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x81ED2AF4[0x4]

00:57:00:380 3912 UnhookRegistry: NtEnumerateKey real addr: 82021BAC

00:57:00:380 3912 UnhookRegistry: NtEnumerateKey calc addr: 82021BAC

00:57:00:380 3912 UnhookRegistry: No SDT hooks found on NtEnumerateKey

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x82021BAC[0xA]

00:57:00:380 3912 UnhookRegistry: No splicing found on NtEnumerateKey

00:57:00:380 3912

Scanning Kernel memory ...

00:57:00:380 3912 KLMD_OpenDevice: Trying to open KLMD device

00:57:00:380 3912 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk

00:57:00:380 3912 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk

00:57:00:380 3912 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 860A14F8

00:57:00:380 3912 DetectCureTDL3: KLMD_GetDeviceObjectList returned 6 DevObjects

00:57:00:380 3912 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 873FCAC8

00:57:00:380 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 873FCAC8

00:57:00:380 3912 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 8746ECD0

00:57:00:380 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8746ECD0

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746ECD0[0x38]

00:57:00:380 3912 DetectCureTDL3: DRIVER_OBJECT addr: 87471D30

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x87471D30[0xA8]

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746B338[0x208]

00:57:00:380 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR

00:57:00:380 3912 DetectCureTDL3: IrpHandler (0) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (1) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (2) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (3) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (4) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (5) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (6) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (7) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (:P addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (9) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (10) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (11) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (12) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (13) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (14) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (15) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (16) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (17) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (18) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (19) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (20) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (21) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (22) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (23) addr: 86A3E1E8

00:57:00:380 3912 DetectCureTDL3: IrpHandler (24) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (25) addr: 81E3FFE3

00:57:00:380 3912 DetectCureTDL3: IrpHandler (26) addr: 81E3FFE3

00:57:00:380 3912 KLMD_ReadMem: Trying to ReadMemory 0x89DEDA44[0x400]

00:57:00:380 3912 TDL3_StartIoHookDetect: CheckParameters: 5, 89DF1000, 0, 0

00:57:00:380 3912 TDL3_FileDetect: Processing driver: USBSTOR

00:57:00:396 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\usbstor.sys, C:\Windows\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk

00:57:00:396 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\usbstor.sys

00:57:00:396 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\usbstor.sys

00:57:00:396 3912 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 87446030

00:57:00:396 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 87446030

00:57:00:396 3912 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 8746E3E8

00:57:00:396 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8746E3E8

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746E3E8[0x38]

00:57:00:396 3912 DetectCureTDL3: DRIVER_OBJECT addr: 87471D30

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x87471D30[0xA8]

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746B338[0x208]

00:57:00:396 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR

00:57:00:396 3912 DetectCureTDL3: IrpHandler (0) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (1) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (2) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (3) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (4) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (5) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (6) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (7) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (:P addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (9) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (10) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (11) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (12) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (13) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (14) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (15) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (16) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (17) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (18) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (19) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (20) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (21) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (22) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (23) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (24) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (25) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (26) addr: 81E3FFE3

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x89DEDA44[0x400]

00:57:00:396 3912 TDL3_StartIoHookDetect: CheckParameters: 5, 89DF1000, 0, 0

00:57:00:396 3912 TDL3_FileDetect: Processing driver: USBSTOR

00:57:00:396 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\usbstor.sys, C:\Windows\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk

00:57:00:396 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\usbstor.sys

00:57:00:396 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\usbstor.sys

00:57:00:396 3912 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 873FC030

00:57:00:396 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 873FC030

00:57:00:396 3912 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 873DF9A8

00:57:00:396 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 873DF9A8

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x873DF9A8[0x38]

00:57:00:396 3912 DetectCureTDL3: DRIVER_OBJECT addr: 87471D30

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x87471D30[0xA8]

00:57:00:396 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746B338[0x208]

00:57:00:396 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR

00:57:00:396 3912 DetectCureTDL3: IrpHandler (0) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (1) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (2) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (3) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (4) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (5) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (6) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (7) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (:P addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (9) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (10) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (11) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (12) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (13) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (14) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (15) addr: 86A3E1E8

00:57:00:396 3912 DetectCureTDL3: IrpHandler (16) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (17) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (18) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (19) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (20) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (21) addr: 81E3FFE3

00:57:00:396 3912 DetectCureTDL3: IrpHandler (22) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (23) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (24) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (25) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (26) addr: 81E3FFE3

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x89DEDA44[0x400]

00:57:00:412 3912 TDL3_StartIoHookDetect: CheckParameters: 5, 89DF1000, 0, 0

00:57:00:412 3912 TDL3_FileDetect: Processing driver: USBSTOR

00:57:00:412 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\usbstor.sys, C:\Windows\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk

00:57:00:412 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\usbstor.sys

00:57:00:412 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\usbstor.sys

00:57:00:412 3912 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 8746E768

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8746E768

00:57:00:412 3912 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 8746E030

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8746E030

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746E030[0x38]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT addr: 87471D30

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x87471D30[0xA8]

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x8746B338[0x208]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR

00:57:00:412 3912 DetectCureTDL3: IrpHandler (0) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (1) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (2) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (3) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (4) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (5) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (6) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (7) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (:P addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (9) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (10) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (11) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (12) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (13) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (14) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (15) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (16) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (17) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (18) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (19) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (20) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (21) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (22) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (23) addr: 86A3E1E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (24) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (25) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (26) addr: 81E3FFE3

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x89DEDA44[0x400]

00:57:00:412 3912 TDL3_StartIoHookDetect: CheckParameters: 5, 89DF1000, 0, 0

00:57:00:412 3912 TDL3_FileDetect: Processing driver: USBSTOR

00:57:00:412 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\usbstor.sys, C:\Windows\system32\Drivers\usbstor.tsk, SYSTEM\CurrentControlSet\Services\USBSTOR, system32\Drivers\usbstor.tsk

00:57:00:412 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\usbstor.sys

00:57:00:412 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\usbstor.sys

00:57:00:412 3912 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 862A7AC8

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 862A7AC8

00:57:00:412 3912 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 853BEB68

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 853BEB68

00:57:00:412 3912 DetectCureTDL3: 4 Curr stack PDEVICE_OBJECT: 853BEC90

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 853BEC90

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853BEC90[0x38]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT addr: 853D4F38

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853D4F38[0xA8]

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853A2630[0x208]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\nvstor, Driver Name: nvstor

00:57:00:412 3912 DetectCureTDL3: IrpHandler (0) addr: 849C11E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (1) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (2) addr: 849C11E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (3) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (4) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (5) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (6) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (7) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (:) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (9) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (10) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (11) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (12) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (13) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (14) addr: 828626CB

00:57:00:412 3912 DetectCureTDL3: IrpHandler (15) addr: 849C11E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (16) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (17) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (18) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (19) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (20) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (21) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (22) addr: 849C11E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (23) addr: 849C11E8

00:57:00:412 3912 DetectCureTDL3: IrpHandler (24) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (25) addr: 81E3FFE3

00:57:00:412 3912 DetectCureTDL3: IrpHandler (26) addr: 81E3FFE3

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x854264BF[0x400]

00:57:00:412 3912 TDL3_StartIoHookDetect: CheckParameters: 7, FFDF0308, 334, 1

00:57:00:412 3912 Driver "nvstor" StartIo handler infected by TDSS rootkit ... 00:57:00:412 3912 TDL3_StartIoHookCure: Number of patches 1

00:57:00:412 3912 KLMD_WriteMem: Trying to WriteMemory 0x854265B6[0x6]

00:57:00:412 3912 cured

00:57:00:412 3912 TDL3_FileDetect: Processing driver: nvstor

00:57:00:412 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\nvstor.sys, C:\Windows\system32\Drivers\nvstor.tsk, SYSTEM\CurrentControlSet\Services\nvstor, system32\Drivers\nvstor.tsk

00:57:00:412 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\nvstor.sys

00:57:00:412 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\nvstor.sys

00:57:00:412 3912 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 861A4860

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 861A4860

00:57:00:412 3912 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 853B93E8

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 853B93E8

00:57:00:412 3912 DetectCureTDL3: 5 Curr stack PDEVICE_OBJECT: 853B9030

00:57:00:412 3912 KLMD_GetLowerDeviceObject: Trying to get lower device object for 853B9030

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853B9030[0x38]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT addr: 869945D8

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x869945D8[0xA8]

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853A0958[0x38]

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853D4F38[0xA8]

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x853A2630[0x208]

00:57:00:412 3912 DetectCureTDL3: DRIVER_OBJECT name: \Driver\nvstor, Driver Name: nvstor

00:57:00:412 3912 DetectCureTDL3: IrpHandler (0) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (1) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (2) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (3) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (4) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (5) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (6) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (7) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (;) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (9) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (10) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (11) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (12) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (13) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (14) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (15) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (16) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (17) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (18) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (19) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (20) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (21) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (22) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (23) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (24) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (25) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: IrpHandler (26) addr: 85426618

00:57:00:412 3912 DetectCureTDL3: All IRP handlers pointed to one addr: 85426618

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x85426618[0x400]

00:57:00:412 3912 TDL3_IrpHookDetect: CheckParameters: 4, FFDF0308, 313, 101, 3, 89

00:57:00:412 3912 Driver "nvstor" Irp handler infected by TDSS rootkit ... 00:57:00:412 3912 KLMD_WriteMem: Trying to WriteMemory 0x8542667D[0xD]

00:57:00:412 3912 cured

00:57:00:412 3912 KLMD_ReadMem: Trying to ReadMemory 0x854264BF[0x400]

00:57:00:412 3912 TDL3_StartIoHookDetect: CheckParameters: 7, FFDF0308, 334, 0

00:57:00:412 3912 TDL3_FileDetect: Processing driver: nvstor

00:57:00:412 3912 TDL3_FileDetect: Parameters: C:\Windows\system32\drivers\nvstor.sys, C:\Windows\system32\Drivers\nvstor.tsk, SYSTEM\CurrentControlSet\Services\nvstor, system32\Drivers\nvstor.tsk

00:57:00:412 3912 TDL3_FileDetect: Processing driver file: C:\Windows\system32\drivers\nvstor.sys

00:57:00:412 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\nvstor.sys

00:57:00:427 3912 File C:\Windows\system32\drivers\nvstor.sys infected by TDSS rootkit ... 00:57:00:427 3912 TDL3_FileCure: Processing driver file: C:\Windows\system32\drivers\nvstor.sys

00:57:00:427 3912 KLMD_CreateFileW: Trying to open file C:\Windows\system32\drivers\nvstor.sys

00:57:00:427 3912 TDL3_FileCure: Dumping cured buffer to file C:\Windows\system32\Drivers\nvstor.tsk

00:57:00:458 3912 TDL3_FileCure: Image path (system32\Drivers\nvstor.tsk) was set for service (SYSTEM\CurrentControlSet\Services\nvstor)

00:57:00:458 3912 TDL3_FileCure: KLMD_PendCopyFileW (C:\Windows\system32\Drivers\nvstor.tsk, C:\Windows\system32\drivers\nvstor.sys) success

00:57:00:458 3912 will be cured on next reboot

00:57:00:458 3912

Completed

 

Results:

00:57:00:458 3912 Infected objects in memory: 2

00:57:00:458 3912 Cured objects in memory: 2

00:57:00:458 3912 Infected objects on disk: 1

00:57:00:458 3912 Objects on disk cured on reboot: 1

00:57:00:458 3912 Objects on disk deleted on reboot: 0

00:57:00:458 3912 Registry nodes deleted on reboot: 0

00:57:00:458 3912

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

Comment se comporte la machine?

 

Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

  • Double-clique sur RSIT.exe afin de lancer RSIT.
     
    Sous VISTA: clic droit/exécuter en temps qu'administrateur.
  • Clique Continue à l'écran Disclaimer.
  • Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
  • Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
    ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

 

@++

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

Uh? C'est la 2e fois que je vois ce message d'erreur depuis hier; je vais me renseigner.

 

Ton problème semble résolu mais à l'avenir, ne conserve jamais d'outils spéciaux car ils peuvent faire réagir certains antivirus.

 

Ce ne sont pas des menaces mais certains processus qui dérangent les AV.

Et puis ces outils sont vite obsolètes en fonction de l'actualité et des modifications apportées par leurs créateurs.

 

@++

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...