Windows ne parvient pas à accéderRésolu/Fermé

Question

Bonjour, 



Configuration: Windows XP / Firefox 6.0.2

J'ai voulu installer un programme de fax, et apparemment, malgré le scan via AVG, je me suis chopé un virus qui me bloque complètement. La poisse, c'est que je ne parviens pas à savoir de quel virus il s'agit.

J'ai installé "HijackThis", mais lorsque je clique dessus, ça m'indique "Windows ne parvient pas à accéder au périphérique, au chemin d'accès ou au fichier spécifié. Vous ne disposez peut-être pas des autorisations appropriées pour avoir accès à l'élément.".

J'ai tenté de faire un scan antivirus en ligne par "Secuser.com" via "Internet explorer", mais depuis, j'ai le même message d'erreur lorsque j'essaie d'accéder à Internet Explorer.

Dans la configuration d'AVG, l'identity protection a été désactivée, et impossible de la réactiver. J'obtiens le message "Une erreur s'est produite au cours de l'enregistrement de la configuration. Une erreur innatendue s'est produite dans le composant "IDP".

J'ai tenté de faire une restauration XP à une date antérieure, mais à chaque fois la restauration n'a pu se faire.

Maintenant, l'UC du pc est non stop à 100%.

Merci d'avance de toute l'aide que vous pourrez m'apporter, car mon pc est quasiment inutilisable.

juju666 · Answer

Bonjour

ça sent mauvais (rootkit max++)

&#9654 Télécharge Reload_TDSSKiller  

&#9654 Lance le   

choisis : lancer le nettoyage  

l'outil va automatiquement télécharger la derniere version puis   

TDSSKiller va s'ouvrir , clique sur "Start Scan"  Clique ici pour l'aide en image  

Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut.   
Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée.   
Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée.   
Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas  
Si Suspicious file est indiqué, laisse l''option cochée sur Skip    
une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer  

sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau  

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

dubitoph · Answer

Bonjour et un tout rand merci pour ton aide.

Dans cette réponse, je vais coller le rapport émis par "Reload_TDSSKiller ". Malgré le message de demande de redémarrage du pc que ce logiciel m'indiquait à la fin de l'opération, je n'ai pas redémarrer le pc (pour que la cure soit complète). Dois-je le faire?

Dans une seconde réponse, je vais coller le rapport émis par "RogueKiller".

Voici celui émis par émis par "Reload_TDSSKiller " : 


16:20:01.0265 1636	TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
16:20:01.0406 1636	============================================================
16:20:01.0406 1636	Current date / time: 2011/09/27 16:20:01.0406
16:20:01.0406 1636	SystemInfo:
16:20:01.0406 1636	
16:20:01.0406 1636	OS Version: 5.1.2600 ServicePack: 3.0
16:20:01.0406 1636	Product type: Workstation
16:20:01.0406 1636	ComputerName: CHR
16:20:01.0406 1636	UserName: dmi
16:20:01.0406 1636	Windows directory: C:\WINDOWS
16:20:01.0406 1636	System windows directory: C:\WINDOWS
16:20:01.0406 1636	Processor architecture: Intel x86
16:20:01.0406 1636	Number of processors: 2
16:20:01.0406 1636	Page size: 0x1000
16:20:01.0406 1636	Boot type: Normal boot
16:20:01.0406 1636	============================================================
16:20:01.0671 1636	Initialize success
16:20:07.0843 3836	============================================================
16:20:07.0843 3836	Scan started
16:20:07.0843 3836	Mode: Manual; 
16:20:07.0843 3836	============================================================
16:20:08.0156 3836	a347bus         (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
16:20:08.0156 3836	a347bus - ok
16:20:08.0187 3836	a347scsi        (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
16:20:08.0187 3836	a347scsi - ok
16:20:08.0203 3836	Abiosdsk - ok
16:20:08.0218 3836	abp480n5 - ok
16:20:08.0281 3836	Accelerometer   (6c2e405d98e6342a9d66a2493e7ab15e) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
16:20:08.0281 3836	Accelerometer - ok
16:20:08.0359 3836	ACPI            (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:20:08.0359 3836	ACPI - ok
16:20:08.0390 3836	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
16:20:08.0406 3836	ACPIEC - ok
16:20:08.0515 3836	ADIHdAudAddService (ff60db2aca88543c025eacba25cee5c1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
16:20:08.0515 3836	ADIHdAudAddService - ok
16:20:08.0531 3836	adpu160m - ok
16:20:08.0562 3836	AEAudio         (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
16:20:08.0562 3836	AEAudio - ok
16:20:08.0656 3836	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:20:08.0656 3836	aec - ok
16:20:08.0734 3836	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
16:20:08.0734 3836	AFD - ok
16:20:08.0859 3836	AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
16:20:08.0906 3836	AgereSoftModem - ok
16:20:08.0937 3836	Aha154x - ok
16:20:08.0953 3836	aic78u2 - ok
16:20:08.0984 3836	aic78xx - ok
16:20:09.0000 3836	AliIde - ok
16:20:09.0031 3836	amsint - ok
16:20:09.0109 3836	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:20:09.0109 3836	Arp1394 - ok
16:20:09.0140 3836	asc - ok
16:20:09.0171 3836	asc3350p - ok
16:20:09.0187 3836	asc3550 - ok
16:20:09.0250 3836	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:20:09.0250 3836	AsyncMac - ok
16:20:09.0281 3836	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
16:20:09.0281 3836	atapi - ok
16:20:09.0296 3836	Atdisk - ok
16:20:09.0343 3836	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:20:09.0343 3836	Atmarpc - ok
16:20:09.0453 3836	ATSwpWDF        (a9f9d1d24441889beb1aa2b917457e23) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
16:20:09.0468 3836	ATSwpWDF - ok
16:20:09.0546 3836	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:20:09.0546 3836	audstub - ok
16:20:09.0625 3836	AVGIDSDriver    (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
16:20:09.0625 3836	AVGIDSDriver - ok
16:20:09.0703 3836	AVGIDSEH        (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
16:20:09.0703 3836	AVGIDSEH - ok
16:20:09.0734 3836	AVGIDSFilter    (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
16:20:09.0734 3836	AVGIDSFilter - ok
16:20:09.0781 3836	AVGIDSShim      (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
16:20:09.0781 3836	AVGIDSShim - ok
16:20:09.0843 3836	Avgldx86        (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
16:20:09.0843 3836	Avgldx86 - ok
16:20:09.0859 3836	Avgmfx86        (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
16:20:09.0859 3836	Avgmfx86 - ok
16:20:09.0890 3836	Avgrkx86        (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
16:20:09.0890 3836	Avgrkx86 - ok
16:20:09.0937 3836	Avgtdix         (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
16:20:09.0937 3836	Avgtdix - ok
16:20:10.0031 3836	b57w2k          (ea377a8e8e1000877210259750cbbf5f) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
16:20:10.0031 3836	b57w2k - ok
16:20:10.0093 3836	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:20:10.0093 3836	Beep - ok
16:20:10.0171 3836	BTKRNL          (ef5e0de0a7ca2977a9255f36f4d915ab) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
16:20:10.0171 3836	BTKRNL - ok
16:20:10.0187 3836	BTWUSB          (053dc5be74621b63bb48c2b86bafc7b0) C:\WINDOWS\system32\Drivers\btwusb.sys
16:20:10.0187 3836	BTWUSB - ok
16:20:10.0218 3836	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:20:10.0218 3836	cbidf2k - ok
16:20:10.0281 3836	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
16:20:10.0281 3836	CCDECODE - ok
16:20:10.0312 3836	cd20xrnt - ok
16:20:10.0343 3836	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:20:10.0343 3836	Cdaudio - ok
16:20:10.0406 3836	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:20:10.0421 3836	Cdfs - ok
16:20:10.0437 3836	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:20:10.0453 3836	Cdrom - ok
16:20:10.0484 3836	Changer - ok
16:20:10.0500 3836	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
16:20:10.0500 3836	CmBatt - ok
16:20:10.0531 3836	CmdIde - ok
16:20:10.0562 3836	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
16:20:10.0562 3836	Compbatt - ok
16:20:10.0593 3836	Cpqarray - ok
16:20:10.0718 3836	CrystalSysInfo  (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
16:20:10.0734 3836	CrystalSysInfo - ok
16:20:10.0781 3836	dac2w2k - ok
16:20:10.0796 3836	dac960nt - ok
16:20:10.0875 3836	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:20:10.0875 3836	Disk - ok
16:20:10.0921 3836	dmboot          (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
16:20:10.0953 3836	dmboot - ok
16:20:10.0984 3836	dmio            (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
16:20:10.0984 3836	dmio - ok
16:20:11.0015 3836	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:20:11.0015 3836	dmload - ok
16:20:11.0109 3836	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:20:11.0109 3836	DMusic - ok
16:20:11.0171 3836	dpti2o - ok
16:20:11.0187 3836	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:20:11.0187 3836	drmkaud - ok
16:20:11.0250 3836	dsNcAdpt        (b2c3f71b86e25c3df78339ddb40a7562) C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
16:20:11.0250 3836	dsNcAdpt - ok
16:20:11.0281 3836	f7bd01a7        (814f20ada863444953f10261740cf4b1) C:\WINDOWS\2801909239:138608216.exe
16:20:11.0281 3836	Suspicious file (Hidden): C:\WINDOWS\2801909239:138608216.exe. md5: 814f20ada863444953f10261740cf4b1
16:20:11.0281 3836	f7bd01a7 ( HiddenFile.Multi.Generic ) - warning
16:20:11.0281 3836	f7bd01a7 - detected HiddenFile.Multi.Generic (1)
16:20:11.0343 3836	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:20:11.0343 3836	Fastfat - ok
16:20:11.0406 3836	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
16:20:11.0406 3836	Fdc - ok
16:20:11.0421 3836	Fips            (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
16:20:11.0437 3836	Fips - ok
16:20:11.0453 3836	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:20:11.0468 3836	Flpydisk - ok
16:20:11.0515 3836	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
16:20:11.0531 3836	FltMgr - ok
16:20:11.0562 3836	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:20:11.0562 3836	Fs_Rec - ok
16:20:11.0609 3836	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:20:11.0609 3836	Ftdisk - ok
16:20:11.0703 3836	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:20:11.0718 3836	Gpc - ok
16:20:11.0781 3836	HBtnKey         (407e41ddb2bfece109132aec296e0d98) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
16:20:11.0781 3836	HBtnKey - ok
16:20:11.0859 3836	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:20:11.0859 3836	HDAudBus - ok
16:20:11.0906 3836	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:20:11.0906 3836	HidUsb - ok
16:20:11.0968 3836	hpdskflt        (e8a95df23097bca840814d42f2ee5164) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
16:20:11.0968 3836	hpdskflt - ok
16:20:11.0984 3836	hpn - ok
16:20:12.0031 3836	HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
16:20:12.0046 3836	HpqKbFiltr - ok
16:20:12.0125 3836	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:20:12.0140 3836	HTTP - ok
16:20:12.0171 3836	i2omgmt - ok
16:20:12.0203 3836	i2omp - ok
16:20:12.0218 3836	i8042prt        (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:20:12.0234 3836	i8042prt - ok
16:20:12.0468 3836	ialm            (f592a1b020723cfbd3d2722514066449) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
16:20:12.0609 3836	ialm - ok
16:20:12.0703 3836	iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\DRIVERS\iaStor.sys
16:20:12.0703 3836	iaStor - ok
16:20:12.0765 3836	IFXTPM          (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
16:20:12.0765 3836	IFXTPM - ok
16:20:12.0859 3836	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:20:12.0859 3836	Imapi - ok
16:20:12.0906 3836	ini910u - ok
16:20:12.0953 3836	IntelIde - ok
16:20:12.0984 3836	intelppm        (ad340800c35a42d4de1641a37feea34c) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:20:12.0984 3836	intelppm - ok
16:20:13.0031 3836	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
16:20:13.0031 3836	Ip6Fw - ok
16:20:13.0062 3836	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:20:13.0062 3836	IpFilterDriver - ok
16:20:13.0078 3836	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:20:13.0078 3836	IpInIp - ok
16:20:13.0109 3836	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:20:13.0109 3836	IpNat - ok
16:20:13.0187 3836	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:20:13.0187 3836	IPSec - ok
16:20:13.0218 3836	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:20:13.0218 3836	IRENUM - ok
16:20:13.0265 3836	isapnp          (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:20:13.0265 3836	isapnp - ok
16:20:13.0328 3836	Kbdclass        (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:20:13.0328 3836	Kbdclass - ok
16:20:13.0359 3836	kbdhid          (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:20:13.0359 3836	kbdhid - ok
16:20:13.0421 3836	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:20:13.0421 3836	kmixer - ok
16:20:13.0484 3836	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:20:13.0484 3836	KSecDD - ok
16:20:13.0546 3836	Lavasoft Kernexplorer - ok
16:20:13.0640 3836	Lbd             (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys
16:20:13.0640 3836	Lbd - ok
16:20:13.0656 3836	lbrtfdc - ok
16:20:13.0750 3836	LMIInfo         (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
16:20:13.0765 3836	LMIInfo - ok
16:20:13.0796 3836	lmimirr         (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
16:20:13.0796 3836	lmimirr - ok
16:20:13.0812 3836	LMIRfsClientNP - ok
16:20:13.0859 3836	LMIRfsDriver    (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
16:20:13.0859 3836	LMIRfsDriver - ok
16:20:13.0953 3836	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:20:13.0953 3836	mnmdd - ok
16:20:14.0031 3836	Modem           (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
16:20:14.0031 3836	Modem - ok
16:20:14.0093 3836	Mouclass        (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:20:14.0093 3836	Mouclass - ok
16:20:14.0156 3836	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:20:14.0156 3836	mouhid - ok
16:20:14.0171 3836	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:20:14.0171 3836	MountMgr - ok
16:20:14.0171 3836	mraid35x - ok
16:20:14.0218 3836	MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:20:14.0218 3836	MRxDAV - ok
16:20:14.0265 3836	MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:20:14.0281 3836	MRxSmb - ok
16:20:14.0343 3836	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:20:14.0343 3836	Msfs - ok
16:20:14.0390 3836	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:20:14.0406 3836	MSKSSRV - ok
16:20:14.0468 3836	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:20:14.0484 3836	MSPCLOCK - ok
16:20:14.0546 3836	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:20:14.0546 3836	MSPQM - ok
16:20:14.0609 3836	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:20:14.0609 3836	mssmbios - ok
16:20:14.0656 3836	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
16:20:14.0656 3836	MSTEE - ok
16:20:14.0750 3836	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
16:20:14.0750 3836	Mup - ok
16:20:14.0812 3836	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
16:20:14.0812 3836	NABTSFEC - ok
16:20:14.0875 3836	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:20:14.0875 3836	NDIS - ok
16:20:14.0921 3836	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
16:20:14.0937 3836	NdisIP - ok
16:20:15.0000 3836	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys
16:20:15.0000 3836	NdisTapi - ok
16:20:15.0078 3836	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys
16:20:15.0078 3836	Ndisuio - ok
16:20:15.0125 3836	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys
16:20:15.0125 3836	NdisWan - ok
16:20:15.0500 3836	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:20:15.0500 3836	NDProxy - ok
16:20:15.0531 3836	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys
16:20:15.0546 3836	NetBIOS - ok
16:20:15.0640 3836	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys
16:20:15.0656 3836	NetBT - ok
16:20:15.0843 3836	NETw5x32        (05743fffc2bc88cc8e426321bc6a762e) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
16:20:15.0937 3836	NETw5x32 - ok
16:20:15.0968 3836	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS
ic1394.sys
16:20:15.0968 3836	NIC1394 - ok
16:20:16.0015 3836	nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
16:20:16.0015 3836	nm - ok
16:20:16.0093 3836	NPF             (243126da7ba441d7c7c3262dcf435a9c) C:\WINDOWS\system32\drivers
pf.sys
16:20:16.0093 3836	NPF - ok
16:20:16.0171 3836	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:20:16.0171 3836	Npfs - ok
16:20:16.0203 3836	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:20:16.0234 3836	Ntfs - ok
16:20:16.0296 3836	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:20:16.0296 3836	Null - ok
16:20:16.0343 3836	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
16:20:16.0359 3836	NwlnkFlt - ok
16:20:16.0406 3836	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
16:20:16.0406 3836	NwlnkFwd - ok
16:20:16.0453 3836	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:20:16.0453 3836	ohci1394 - ok
16:20:16.0546 3836	Parport         (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
16:20:16.0546 3836	Parport - ok
16:20:16.0578 3836	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:20:16.0578 3836	PartMgr - ok
16:20:16.0640 3836	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
16:20:16.0640 3836	ParVdm - ok
16:20:16.0718 3836	PCI             (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
16:20:16.0718 3836	PCI - ok
16:20:16.0750 3836	PCIDump - ok
16:20:16.0765 3836	PCIIde - ok
16:20:16.0828 3836	Pcmcia          (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:20:16.0828 3836	Pcmcia - ok
16:20:16.0875 3836	PDCOMP - ok
16:20:16.0890 3836	PDFRAME - ok
16:20:16.0906 3836	PDRELI - ok
16:20:16.0984 3836	PDRFRAME - ok
16:20:17.0000 3836	perc2 - ok
16:20:17.0031 3836	perc2hib - ok
16:20:17.0078 3836	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys
16:20:17.0078 3836	PptpMiniport - ok
16:20:17.0109 3836	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:20:17.0109 3836	PSched - ok
16:20:17.0125 3836	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:20:17.0125 3836	Ptilink - ok
16:20:17.0140 3836	ql1080 - ok
16:20:17.0156 3836	Ql10wnt - ok
16:20:17.0156 3836	ql12160 - ok
16:20:17.0171 3836	ql1240 - ok
16:20:17.0187 3836	ql1280 - ok
16:20:17.0218 3836	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
16:20:17.0218 3836	RasAcd - ok
16:20:17.0281 3836	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys
16:20:17.0281 3836	Rasl2tp - ok
16:20:17.0296 3836	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys
16:20:17.0296 3836	RasPppoe - ok
16:20:17.0312 3836	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
16:20:17.0312 3836	Raspti - ok
16:20:17.0359 3836	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys
16:20:17.0359 3836	Rdbss - ok
16:20:17.0375 3836	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:20:17.0375 3836	RDPCDD - ok
16:20:17.0437 3836	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys
16:20:17.0437 3836	rdpdr - ok
16:20:17.0515 3836	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
16:20:17.0515 3836	RDPWD - ok
16:20:17.0546 3836	redbook         (bdefd9d248add5d35dfb36485d58ef52) C:\WINDOWS\system32\DRIVERSedbook.sys
16:20:17.0562 3836	Suspicious file (Forged): C:\WINDOWS\system32\DRIVERSedbook.sys. Real md5: bdefd9d248add5d35dfb36485d58ef52, Fake md5: d8eb2a7904db6c916eb5361878ddcbae
16:20:17.0562 3836	redbook ( Rootkit.Win32.ZAccess.e ) - infected
16:20:17.0562 3836	redbook - detected Rootkit.Win32.ZAccess.e (0)
16:20:17.0640 3836	SCR3XX2K        (fc87d5e0328afa97bf6d39df96d5d356) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys
16:20:17.0656 3836	SCR3XX2K - ok
16:20:17.0718 3836	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:20:17.0718 3836	Secdrv - ok
16:20:17.0765 3836	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:20:17.0765 3836	serenum - ok
16:20:17.0796 3836	Serial          (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
16:20:17.0796 3836	Serial - ok
16:20:17.0875 3836	SFAUDIO         (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
16:20:17.0875 3836	SFAUDIO - ok
16:20:17.0968 3836	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
16:20:17.0968 3836	Sfloppy - ok
16:20:18.0015 3836	Simbad - ok
16:20:18.0062 3836	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
16:20:18.0062 3836	SLIP - ok
16:20:18.0203 3836	SNP2UVC         (cf9cde12fbc19dba8de528b7511a2f4f) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
16:20:18.0250 3836	SNP2UVC - ok
16:20:18.0281 3836	Sparrow - ok
16:20:18.0343 3836	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:20:18.0343 3836	splitter - ok
16:20:18.0437 3836	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
16:20:18.0437 3836	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
16:20:18.0437 3836	sptd ( LockedFile.Multi.Generic ) - warning
16:20:18.0437 3836	sptd - detected LockedFile.Multi.Generic (1)
16:20:18.0531 3836	sr              (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
16:20:18.0531 3836	sr - ok
16:20:18.0625 3836	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
16:20:18.0625 3836	Srv - ok
16:20:18.0687 3836	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
16:20:18.0687 3836	streamip - ok
16:20:18.0765 3836	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:20:18.0781 3836	swenum - ok
16:20:18.0843 3836	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:20:18.0843 3836	swmidi - ok
16:20:18.0906 3836	symc810 - ok
16:20:18.0968 3836	symc8xx - ok
16:20:18.0984 3836	sym_hi - ok
16:20:19.0015 3836	sym_u3 - ok
16:20:19.0093 3836	SynTP           (f08667f79bbd339547f477c75c3ed0b9) C:\WINDOWS\system32\DRIVERS\SynTP.sys
16:20:19.0093 3836	SynTP - ok
16:20:19.0125 3836	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:20:19.0125 3836	sysaudio - ok
16:20:19.0203 3836	tap0801         (846b7c0e3f6370cdcce157a5b36e70cd) C:\WINDOWS\system32\DRIVERS	ap0801.sys
16:20:19.0203 3836	tap0801 - ok
16:20:19.0296 3836	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys
16:20:19.0296 3836	Tcpip - ok
16:20:19.0406 3836	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:20:19.0406 3836	TDPIPE - ok
16:20:19.0453 3836	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:20:19.0453 3836	TDTCP - ok
16:20:19.0500 3836	teamviewervpn   (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS	eamviewervpn.sys
16:20:19.0515 3836	teamviewervpn - ok
16:20:19.0562 3836	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS	ermdd.sys
16:20:19.0562 3836	TermDD - ok
16:20:19.0656 3836	tmcomm          (eb2283c0a4dfbd2e53d14f2c4d5a1e89) C:\WINDOWS\system32\drivers	mcomm.sys
16:20:19.0656 3836	tmcomm - ok
16:20:19.0687 3836	TosIde - ok
16:20:19.0875 3836	TrueSight       (ddbf8e194041469f26fc6cbc8264beb0) C:\Documents and Settings\dmi\Bureau\TrueSight.sys
16:20:19.0890 3836	TrueSight - ok
16:20:19.0984 3836	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:20:19.0984 3836	Udfs - ok
16:20:20.0031 3836	ultra - ok
16:20:20.0093 3836	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:20:20.0109 3836	Update - ok
16:20:20.0171 3836	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:20:20.0171 3836	usbccgp - ok
16:20:20.0265 3836	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:20:20.0265 3836	usbehci - ok
16:20:20.0296 3836	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:20:20.0312 3836	usbhub - ok
16:20:20.0375 3836	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:20:20.0375 3836	usbprint - ok
16:20:20.0437 3836	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:20:20.0437 3836	usbscan - ok
16:20:20.0500 3836	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:20:20.0515 3836	USBSTOR - ok
16:20:20.0593 3836	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:20:20.0593 3836	usbuhci - ok
16:20:20.0656 3836	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
16:20:20.0656 3836	usbvideo - ok
16:20:20.0750 3836	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:20:20.0765 3836	VgaSave - ok
16:20:20.0781 3836	ViaIde - ok
16:20:20.0812 3836	VolSnap         (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
16:20:20.0812 3836	VolSnap - ok
16:20:20.0859 3836	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:20:20.0859 3836	Wanarp - ok
16:20:20.0937 3836	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
16:20:20.0937 3836	Wdf01000 - ok
16:20:21.0000 3836	WDICA - ok
16:20:21.0062 3836	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:20:21.0062 3836	wdmaud - ok
16:20:21.0156 3836	WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
16:20:21.0156 3836	WmiAcpi - ok
16:20:21.0218 3836	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
16:20:21.0234 3836	WSTCODEC - ok
16:20:21.0312 3836	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:20:21.0312 3836	WudfPf - ok
16:20:21.0390 3836	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:20:21.0390 3836	WudfRd - ok
16:20:21.0437 3836	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
16:20:21.0593 3836	\Device\Harddisk0\DR0 - ok
16:20:21.0609 3836	Boot (0x1200)   (7c8d0dcb31f179aff5003f6445918649) \Device\Harddisk0\DR0\Partition0
16:20:21.0609 3836	\Device\Harddisk0\DR0\Partition0 - ok
16:20:21.0609 3836	============================================================
16:20:21.0609 3836	Scan finished
16:20:21.0609 3836	============================================================
16:20:21.0625 3224	Detected object count: 3
16:20:21.0625 3224	Actual detected object count: 3
16:22:46.0453 3224	f7bd01a7 ( HiddenFile.Multi.Generic ) - skipped by user
16:22:46.0453 3224	f7bd01a7 ( HiddenFile.Multi.Generic ) - User select action: Skip 
16:22:48.0203 3224	Backup copy found, using it..
16:22:48.0218 3224	C:\WINDOWS\system32\DRIVERSedbook.sys - will be cured on reboot
16:22:48.0218 3224	redbook ( Rootkit.Win32.ZAccess.e ) - User select action: Cure 
16:22:48.0234 3224	sptd ( LockedFile.Multi.Generic ) - skipped by user
16:22:48.0234 3224	sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
16:23:12.0718 1036	Deinitialize success

dubitoph · Answer

Voici le rapport émis par "RogueKiller" : RogueKiller V6.1.0 [22/09/2011] par Tigzy contact sur http://www.sur-la-toile.com mail: tigzyRKgmailcom Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version Demarrage : Mode normal Utilisateur: dmi [Droits d'admin] Mode: Recherche -- Date : 27/09/2011 16:11:16 Processus malicieux: 2 [SUSP PATH] 2801909239:138608216.exe -- c:\windows\2801909239:138608216.exe -> KILLED [TermProc] [RESIDUE] 2801909239:138608216.exe -- c:\windows\2801909239:138608216.exe -> KILLED [TermProc] Entrees de registre: 1 [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND Fichiers / Dossiers particuliers: Driver: [LOADED] SSDT[277] : NtWriteVirtualMemory @ 0x805B43CC -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB431A914) SSDT[258] : NtTerminateThread @ 0x805D2BDC -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB431A878) SSDT[257] : NtTerminateProcess @ 0x805D29E2 -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB431A7DC) SSDT[247] : NtSetValueKey @ 0x80622662 -> HOOKED (Lbd.sys @ 0xBA118BFE) SSDT[241] : NtSetSystemPowerState @ 0x80653E18 -> HOOKED (a347bus.sys @ 0xB9E73550) SSDT[177] : NtQueryValueKey @ 0x80622314 -> HOOKED (a347bus.sys @ 0xB9E74076) SSDT[160] : NtQueryKey @ 0x80625810 -> HOOKED (a347bus.sys @ 0xB9E685FC) SSDT[122] : NtOpenProcess @ 0x805CB440 -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB431A738) SSDT[119] : NtOpenKey @ 0x806254CE -> HOOKED (a347bus.sys @ 0xB9E73FA4) SSDT[116] : NtOpenFile @ 0x8057A1A6 -> HOOKED (a347bus.sys @ 0xB9E67B40) SSDT[73] : NtEnumerateValueKey @ 0x80624BA6 -> HOOKED (a347bus.sys @ 0xB9E74120) SSDT[71] : NtEnumerateKey @ 0x8062493C -> HOOKED (a347bus.sys @ 0xB9E685DC) SSDT[45] : NtCreatePagingFile @ 0x805AB9EE -> HOOKED (a347bus.sys @ 0xB9E67B00) SSDT[41] : NtCreateKey @ 0x806240F0 -> HOOKED (Lbd.sys @ 0xBA11887E) SSDT[25] : NtClose @ 0x805BC530 -> HOOKED (a347bus.sys @ 0xB9E74028) S_SSDT[549] : Unknown -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB4319CBA) S_SSDT[416] : Unknown -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB4319D90) S_SSDT[414] : Unknown -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB4319D3C) S_SSDT[383] : Unknown -> HOOKED (\SystemRoot\system32\DRIVERS\AVGIDSShim.Sys @ 0xB4319DFC) Fichier HOSTS: Termine : << RKreport[1].txt >> RKreport[1].txt

juju666 · Answer

Pourquoi as-tu fait RogueKiller ? On te l'a demandé ? 

Refais TDSS Killer, et cette fois supprime ces 2 détections: f7bd01a7 

Ensuite redémarre et fais à nouveau TDSS Killer

dubitoph · Answer

Vraiment un tout grand merci pour ton aide....

J'avais exécuter RogueKiller car, avant de voir ta réponse, sur un autre forum, j'avais lu que c'était un préalable avant de de poster un message.

Voici maintenant le rapport de TDSS Killer après avoir redémarré le pc : 

16:43:08.0859 2856	TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
16:43:08.0968 2856	============================================================
16:43:08.0968 2856	Current date / time: 2011/09/27 16:43:08.0968
16:43:08.0968 2856	SystemInfo:
16:43:08.0968 2856	
16:43:08.0968 2856	OS Version: 5.1.2600 ServicePack: 3.0
16:43:08.0968 2856	Product type: Workstation
16:43:08.0968 2856	ComputerName: CHR
16:43:08.0968 2856	UserName: dmi
16:43:08.0968 2856	Windows directory: C:\WINDOWS
16:43:08.0968 2856	System windows directory: C:\WINDOWS
16:43:08.0968 2856	Processor architecture: Intel x86
16:43:08.0968 2856	Number of processors: 2
16:43:08.0968 2856	Page size: 0x1000
16:43:08.0968 2856	Boot type: Normal boot
16:43:08.0968 2856	============================================================
16:43:09.0375 2856	Initialize success
16:43:11.0203 2888	============================================================
16:43:11.0203 2888	Scan started
16:43:11.0203 2888	Mode: Manual; 
16:43:11.0203 2888	============================================================
16:43:11.0828 2888	a347bus         (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
16:43:11.0828 2888	a347bus - ok
16:43:11.0859 2888	a347scsi        (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
16:43:11.0859 2888	a347scsi - ok
16:43:11.0875 2888	Abiosdsk - ok
16:43:11.0906 2888	abp480n5 - ok
16:43:11.0953 2888	Accelerometer   (6c2e405d98e6342a9d66a2493e7ab15e) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
16:43:11.0953 2888	Accelerometer - ok
16:43:12.0000 2888	ACPI            (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:43:12.0015 2888	ACPI - ok
16:43:12.0062 2888	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
16:43:12.0062 2888	ACPIEC - ok
16:43:12.0156 2888	ADIHdAudAddService (ff60db2aca88543c025eacba25cee5c1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
16:43:12.0156 2888	ADIHdAudAddService - ok
16:43:12.0187 2888	adpu160m - ok
16:43:12.0218 2888	AEAudio         (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
16:43:12.0218 2888	AEAudio - ok
16:43:12.0281 2888	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:43:12.0296 2888	aec - ok
16:43:12.0375 2888	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
16:43:12.0375 2888	AFD - ok
16:43:12.0468 2888	AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
16:43:12.0515 2888	AgereSoftModem - ok
16:43:12.0546 2888	Aha154x - ok
16:43:12.0562 2888	aic78u2 - ok
16:43:12.0593 2888	aic78xx - ok
16:43:12.0625 2888	AliIde - ok
16:43:12.0640 2888	amsint - ok
16:43:12.0718 2888	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:43:12.0718 2888	Arp1394 - ok
16:43:12.0750 2888	asc - ok
16:43:12.0765 2888	asc3350p - ok
16:43:12.0796 2888	asc3550 - ok
16:43:12.0843 2888	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:43:12.0843 2888	AsyncMac - ok
16:43:12.0875 2888	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
16:43:12.0890 2888	atapi - ok
16:43:12.0906 2888	Atdisk - ok
16:43:12.0953 2888	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:43:12.0968 2888	Atmarpc - ok
16:43:13.0062 2888	ATSwpWDF        (a9f9d1d24441889beb1aa2b917457e23) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
16:43:13.0062 2888	ATSwpWDF - ok
16:43:13.0140 2888	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:43:13.0140 2888	audstub - ok
16:43:13.0218 2888	AVGIDSDriver    (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
16:43:13.0234 2888	AVGIDSDriver - ok
16:43:13.0312 2888	AVGIDSEH        (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
16:43:13.0312 2888	AVGIDSEH - ok
16:43:13.0343 2888	AVGIDSFilter    (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
16:43:13.0343 2888	AVGIDSFilter - ok
16:43:13.0406 2888	AVGIDSShim      (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
16:43:13.0421 2888	AVGIDSShim - ok
16:43:13.0484 2888	Avgldx86        (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
16:43:13.0484 2888	Avgldx86 - ok
16:43:13.0515 2888	Avgmfx86        (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
16:43:13.0515 2888	Avgmfx86 - ok
16:43:13.0546 2888	Avgrkx86        (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
16:43:13.0562 2888	Avgrkx86 - ok
16:43:13.0609 2888	Avgtdix         (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
16:43:13.0609 2888	Avgtdix - ok
16:43:13.0703 2888	b57w2k          (ea377a8e8e1000877210259750cbbf5f) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
16:43:13.0718 2888	b57w2k - ok
16:43:13.0781 2888	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:43:13.0796 2888	Beep - ok
16:43:13.0937 2888	BTKRNL          (ef5e0de0a7ca2977a9255f36f4d915ab) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
16:43:13.0953 2888	BTKRNL - ok
16:43:13.0984 2888	BTWUSB          (053dc5be74621b63bb48c2b86bafc7b0) C:\WINDOWS\system32\Drivers\btwusb.sys
16:43:13.0984 2888	BTWUSB - ok
16:43:14.0031 2888	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:43:14.0031 2888	cbidf2k - ok
16:43:14.0109 2888	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
16:43:14.0109 2888	CCDECODE - ok
16:43:14.0140 2888	cd20xrnt - ok
16:43:14.0187 2888	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:43:14.0187 2888	Cdaudio - ok
16:43:14.0296 2888	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:43:14.0296 2888	Cdfs - ok
16:43:14.0328 2888	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:43:14.0328 2888	Cdrom - ok
16:43:14.0359 2888	Changer - ok
16:43:14.0421 2888	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
16:43:14.0421 2888	CmBatt - ok
16:43:14.0453 2888	CmdIde - ok
16:43:14.0484 2888	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
16:43:14.0500 2888	Compbatt - ok
16:43:14.0546 2888	Cpqarray - ok
16:43:14.0656 2888	CrystalSysInfo  (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
16:43:14.0656 2888	CrystalSysInfo - ok
16:43:14.0703 2888	dac2w2k - ok
16:43:14.0718 2888	dac960nt - ok
16:43:14.0796 2888	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:43:14.0812 2888	Disk - ok
16:43:14.0875 2888	dmboot          (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
16:43:14.0906 2888	dmboot - ok
16:43:14.0968 2888	dmio            (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
16:43:14.0984 2888	dmio - ok
16:43:15.0015 2888	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:43:15.0015 2888	dmload - ok
16:43:15.0109 2888	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:43:15.0125 2888	DMusic - ok
16:43:15.0140 2888	dpti2o - ok
16:43:15.0171 2888	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:43:15.0171 2888	drmkaud - ok
16:43:15.0218 2888	dsNcAdpt        (b2c3f71b86e25c3df78339ddb40a7562) C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
16:43:15.0218 2888	dsNcAdpt - ok
16:43:15.0281 2888	f7bd01a7        (814f20ada863444953f10261740cf4b1) C:\WINDOWS\2801909239:138608216.exe
16:43:16.0062 2888	Suspicious file (Hidden): C:\WINDOWS\2801909239:138608216.exe. md5: 814f20ada863444953f10261740cf4b1
16:43:16.0062 2888	f7bd01a7 ( HiddenFile.Multi.Generic ) - warning
16:43:16.0062 2888	f7bd01a7 - detected HiddenFile.Multi.Generic (1)
16:43:16.0156 2888	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:43:16.0156 2888	Fastfat - ok
16:43:16.0203 2888	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
16:43:16.0203 2888	Fdc - ok
16:43:16.0234 2888	Fips            (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
16:43:16.0234 2888	Fips - ok
16:43:16.0250 2888	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:43:16.0250 2888	Flpydisk - ok
16:43:16.0312 2888	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
16:43:16.0312 2888	FltMgr - ok
16:43:16.0343 2888	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:43:16.0359 2888	Fs_Rec - ok
16:43:16.0390 2888	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:43:16.0406 2888	Ftdisk - ok
16:43:16.0500 2888	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:43:16.0500 2888	Gpc - ok
16:43:16.0562 2888	HBtnKey         (407e41ddb2bfece109132aec296e0d98) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
16:43:16.0578 2888	HBtnKey - ok
16:43:16.0640 2888	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:43:16.0640 2888	HDAudBus - ok
16:43:16.0687 2888	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:43:16.0687 2888	HidUsb - ok
16:43:16.0734 2888	hpdskflt        (e8a95df23097bca840814d42f2ee5164) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
16:43:16.0734 2888	hpdskflt - ok
16:43:16.0765 2888	hpn - ok
16:43:16.0828 2888	HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
16:43:16.0843 2888	HpqKbFiltr - ok
16:43:16.0937 2888	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:43:16.0937 2888	HTTP - ok
16:43:16.0984 2888	i2omgmt - ok
16:43:17.0015 2888	i2omp - ok
16:43:17.0062 2888	i8042prt        (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:43:17.0062 2888	i8042prt - ok
16:43:17.0343 2888	ialm            (f592a1b020723cfbd3d2722514066449) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
16:43:17.0562 2888	ialm - ok
16:43:17.0703 2888	iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\DRIVERS\iaStor.sys
16:43:17.0703 2888	iaStor - ok
16:43:17.0781 2888	IFXTPM          (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
16:43:17.0781 2888	IFXTPM - ok
16:43:17.0843 2888	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:43:17.0843 2888	Imapi - ok
16:43:17.0875 2888	ini910u - ok
16:43:17.0906 2888	IntelIde - ok
16:43:17.0968 2888	intelppm        (ad340800c35a42d4de1641a37feea34c) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:43:17.0968 2888	intelppm - ok
16:43:18.0031 2888	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
16:43:18.0031 2888	Ip6Fw - ok
16:43:18.0093 2888	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:43:18.0109 2888	IpFilterDriver - ok
16:43:18.0140 2888	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:43:18.0140 2888	IpInIp - ok
16:43:18.0203 2888	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:43:18.0203 2888	IpNat - ok
16:43:18.0250 2888	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:43:18.0250 2888	IPSec - ok
16:43:18.0296 2888	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:43:18.0296 2888	IRENUM - ok
16:43:18.0390 2888	isapnp          (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:43:18.0390 2888	isapnp - ok
16:43:18.0453 2888	Kbdclass        (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:43:18.0453 2888	Kbdclass - ok
16:43:18.0515 2888	kbdhid          (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:43:18.0531 2888	kbdhid - ok
16:43:18.0578 2888	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:43:18.0593 2888	kmixer - ok
16:43:18.0640 2888	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:43:18.0640 2888	KSecDD - ok
16:43:18.0687 2888	Lavasoft Kernexplorer - ok
16:43:18.0781 2888	Lbd             (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys
16:43:18.0781 2888	Lbd - ok
16:43:18.0796 2888	lbrtfdc - ok
16:43:18.0906 2888	LMIInfo         (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
16:43:18.0906 2888	LMIInfo - ok
16:43:18.0953 2888	lmimirr         (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
16:43:18.0953 2888	lmimirr - ok
16:43:18.0984 2888	LMIRfsClientNP - ok
16:43:19.0000 2888	LMIRfsDriver    (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
16:43:19.0000 2888	LMIRfsDriver - ok
16:43:19.0093 2888	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:43:19.0093 2888	mnmdd - ok
16:43:19.0171 2888	Modem           (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
16:43:19.0171 2888	Modem - ok
16:43:19.0234 2888	Mouclass        (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:43:19.0250 2888	Mouclass - ok
16:43:19.0312 2888	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:43:19.0312 2888	mouhid - ok
16:43:19.0359 2888	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:43:19.0359 2888	MountMgr - ok
16:43:19.0375 2888	mraid35x - ok
16:43:19.0437 2888	MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:43:19.0437 2888	MRxDAV - ok
16:43:19.0531 2888	MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:43:19.0546 2888	MRxSmb - ok
16:43:19.0625 2888	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:43:19.0625 2888	Msfs - ok
16:43:19.0703 2888	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:43:19.0703 2888	MSKSSRV - ok
16:43:19.0718 2888	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:43:19.0718 2888	MSPCLOCK - ok
16:43:19.0734 2888	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:43:19.0750 2888	MSPQM - ok
16:43:19.0781 2888	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:43:19.0781 2888	mssmbios - ok
16:43:19.0828 2888	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
16:43:19.0843 2888	MSTEE - ok
16:43:19.0859 2888	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
16:43:19.0906 2888	Mup - ok
16:43:19.0937 2888	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
16:43:19.0953 2888	NABTSFEC - ok
16:43:19.0984 2888	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:43:20.0000 2888	NDIS - ok
16:43:20.0078 2888	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
16:43:20.0078 2888	NdisIP - ok
16:43:20.0140 2888	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys
16:43:20.0156 2888	NdisTapi - ok
16:43:20.0203 2888	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys
16:43:20.0203 2888	Ndisuio - ok
16:43:20.0234 2888	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys
16:43:20.0250 2888	NdisWan - ok
16:43:20.0281 2888	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:43:20.0281 2888	NDProxy - ok
16:43:20.0312 2888	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys
16:43:20.0328 2888	NetBIOS - ok
16:43:20.0359 2888	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys
16:43:20.0359 2888	NetBT - ok
16:43:20.0546 2888	NETw5x32        (05743fffc2bc88cc8e426321bc6a762e) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
16:43:20.0671 2888	NETw5x32 - ok
16:43:20.0687 2888	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS
ic1394.sys
16:43:20.0687 2888	NIC1394 - ok
16:43:20.0750 2888	nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
16:43:20.0750 2888	nm - ok
16:43:20.0828 2888	NPF             (243126da7ba441d7c7c3262dcf435a9c) C:\WINDOWS\system32\drivers
pf.sys
16:43:20.0828 2888	NPF - ok
16:43:20.0921 2888	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:43:20.0921 2888	Npfs - ok
16:43:21.0015 2888	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:43:21.0046 2888	Ntfs - ok
16:43:21.0125 2888	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:43:21.0125 2888	Null - ok
16:43:21.0171 2888	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
16:43:21.0171 2888	NwlnkFlt - ok
16:43:21.0218 2888	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
16:43:21.0218 2888	NwlnkFwd - ok
16:43:21.0265 2888	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:43:21.0265 2888	ohci1394 - ok
16:43:21.0328 2888	Parport         (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
16:43:21.0343 2888	Parport - ok
16:43:21.0375 2888	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:43:21.0375 2888	PartMgr - ok
16:43:21.0421 2888	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
16:43:21.0421 2888	ParVdm - ok
16:43:21.0500 2888	PCI             (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
16:43:21.0515 2888	PCI - ok
16:43:21.0531 2888	PCIDump - ok
16:43:21.0562 2888	PCIIde - ok
16:43:21.0609 2888	Pcmcia          (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:43:21.0625 2888	Pcmcia - ok
16:43:21.0656 2888	PDCOMP - ok
16:43:21.0671 2888	PDFRAME - ok
16:43:21.0718 2888	PDRELI - ok
16:43:21.0765 2888	PDRFRAME - ok
16:43:21.0828 2888	perc2 - ok
16:43:21.0843 2888	perc2hib - ok
16:43:21.0890 2888	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys
16:43:21.0906 2888	PptpMiniport - ok
16:43:21.0921 2888	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:43:21.0921 2888	PSched - ok
16:43:21.0968 2888	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:43:21.0968 2888	Ptilink - ok
16:43:22.0015 2888	ql1080 - ok
16:43:22.0031 2888	Ql10wnt - ok
16:43:22.0062 2888	ql12160 - ok
16:43:22.0093 2888	ql1240 - ok
16:43:22.0125 2888	ql1280 - ok
16:43:22.0187 2888	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
16:43:22.0187 2888	RasAcd - ok
16:43:22.0265 2888	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys
16:43:22.0265 2888	Rasl2tp - ok
16:43:22.0296 2888	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys
16:43:22.0312 2888	RasPppoe - ok
16:43:22.0375 2888	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
16:43:22.0375 2888	Raspti - ok
16:43:22.0406 2888	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys
16:43:22.0421 2888	Rdbss - ok
16:43:22.0453 2888	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:43:22.0453 2888	RDPCDD - ok
16:43:22.0515 2888	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys
16:43:22.0515 2888	rdpdr - ok
16:43:22.0578 2888	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
16:43:22.0578 2888	RDPWD - ok
16:43:22.0640 2888	redbook         (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERSedbook.sys
16:43:22.0656 2888	redbook - ok
16:43:22.0750 2888	SCR3XX2K        (fc87d5e0328afa97bf6d39df96d5d356) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys
16:43:22.0765 2888	SCR3XX2K - ok
16:43:22.0843 2888	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:43:22.0843 2888	Secdrv - ok
16:43:22.0906 2888	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:43:22.0906 2888	serenum - ok
16:43:22.0968 2888	Serial          (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
16:43:22.0968 2888	Serial - ok
16:43:23.0062 2888	SFAUDIO         (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
16:43:23.0062 2888	SFAUDIO - ok
16:43:23.0109 2888	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
16:43:23.0109 2888	Sfloppy - ok
16:43:23.0156 2888	Simbad - ok
16:43:23.0203 2888	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
16:43:23.0203 2888	SLIP - ok
16:43:23.0359 2888	SNP2UVC         (cf9cde12fbc19dba8de528b7511a2f4f) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
16:43:23.0437 2888	SNP2UVC - ok
16:43:23.0500 2888	Sparrow - ok
16:43:23.0562 2888	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:43:23.0562 2888	splitter - ok
16:43:23.0671 2888	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
16:43:23.0671 2888	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
16:43:23.0671 2888	sptd ( LockedFile.Multi.Generic ) - warning
16:43:23.0671 2888	sptd - detected LockedFile.Multi.Generic (1)
16:43:23.0718 2888	sr              (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
16:43:23.0734 2888	sr - ok
16:43:23.0828 2888	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
16:43:23.0875 2888	Srv - ok
16:43:23.0984 2888	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
16:43:23.0984 2888	streamip - ok
16:43:24.0093 2888	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:43:24.0093 2888	swenum - ok
16:43:24.0171 2888	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:43:24.0171 2888	swmidi - ok
16:43:24.0203 2888	symc810 - ok
16:43:24.0218 2888	symc8xx - ok
16:43:24.0250 2888	sym_hi - ok
16:43:24.0265 2888	sym_u3 - ok
16:43:24.0359 2888	SynTP           (f08667f79bbd339547f477c75c3ed0b9) C:\WINDOWS\system32\DRIVERS\SynTP.sys
16:43:24.0359 2888	SynTP - ok
16:43:24.0421 2888	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:43:24.0421 2888	sysaudio - ok
16:43:24.0500 2888	tap0801         (846b7c0e3f6370cdcce157a5b36e70cd) C:\WINDOWS\system32\DRIVERS	ap0801.sys
16:43:24.0500 2888	tap0801 - ok
16:43:24.0593 2888	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys
16:43:24.0609 2888	Tcpip - ok
16:43:24.0671 2888	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:43:24.0671 2888	TDPIPE - ok
16:43:24.0718 2888	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:43:24.0734 2888	TDTCP - ok
16:43:24.0781 2888	teamviewervpn   (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS	eamviewervpn.sys
16:43:24.0781 2888	teamviewervpn - ok
16:43:24.0875 2888	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS	ermdd.sys
16:43:24.0875 2888	TermDD - ok
16:43:24.0953 2888	tmcomm          (eb2283c0a4dfbd2e53d14f2c4d5a1e89) C:\WINDOWS\system32\drivers	mcomm.sys
16:43:24.0953 2888	tmcomm - ok
16:43:24.0984 2888	TosIde - ok
16:43:25.0171 2888	TrueSight       (ddbf8e194041469f26fc6cbc8264beb0) C:\Documents and Settings\dmi\Bureau\TrueSight.sys
16:43:25.0171 2888	TrueSight - ok
16:43:25.0281 2888	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:43:25.0296 2888	Udfs - ok
16:43:25.0328 2888	ultra - ok
16:43:25.0390 2888	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:43:25.0421 2888	Update - ok
16:43:25.0484 2888	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:43:25.0484 2888	usbccgp - ok
16:43:25.0562 2888	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:43:25.0578 2888	usbehci - ok
16:43:25.0640 2888	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:43:25.0640 2888	usbhub - ok
16:43:25.0687 2888	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:43:25.0703 2888	usbprint - ok
16:43:25.0765 2888	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:43:25.0765 2888	usbscan - ok
16:43:25.0828 2888	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:43:25.0828 2888	USBSTOR - ok
16:43:25.0875 2888	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:43:25.0875 2888	usbuhci - ok
16:43:25.0921 2888	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
16:43:25.0937 2888	usbvideo - ok
16:43:26.0046 2888	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:43:26.0046 2888	VgaSave - ok
16:43:26.0078 2888	ViaIde - ok
16:43:26.0109 2888	VolSnap         (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
16:43:26.0109 2888	VolSnap - ok
16:43:26.0156 2888	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:43:26.0171 2888	Wanarp - ok
16:43:26.0250 2888	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
16:43:26.0250 2888	Wdf01000 - ok
16:43:26.0265 2888	WDICA - ok
16:43:26.0343 2888	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:43:26.0343 2888	wdmaud - ok
16:43:26.0421 2888	WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
16:43:26.0421 2888	WmiAcpi - ok
16:43:26.0468 2888	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
16:43:26.0468 2888	WSTCODEC - ok
16:43:26.0546 2888	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:43:26.0546 2888	WudfPf - ok
16:43:26.0593 2888	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:43:26.0593 2888	WudfRd - ok
16:43:26.0625 2888	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
16:43:26.0765 2888	\Device\Harddisk0\DR0 - ok
16:43:26.0765 2888	Boot (0x1200)   (7c8d0dcb31f179aff5003f6445918649) \Device\Harddisk0\DR0\Partition0
16:43:26.0765 2888	\Device\Harddisk0\DR0\Partition0 - ok
16:43:26.0765 2888	============================================================
16:43:26.0765 2888	Scan finished
16:43:26.0765 2888	============================================================
16:43:26.0781 2680	Detected object count: 2
16:43:26.0781 2680	Actual detected object count: 2
16:43:31.0046 2680	f7bd01a7 ( HiddenFile.Multi.Generic ) - skipped by user
16:43:31.0046 2680	f7bd01a7 ( HiddenFile.Multi.Generic ) - User select action: Skip 
16:43:31.0046 2680	sptd ( LockedFile.Multi.Generic ) - skipped by user
16:43:31.0046 2680	sptd ( LockedFile.Multi.Generic ) - User select action: Skip

juju666 · Answer

16:43:31.0046 2680 f7bd01a7 ( HiddenFile.Multi.Generic ) - skipped by user

Tu n'as que cette possibilité ? 
Tu ne peux pas cure ou delete ? 
Réessaie stp.

~~

 /!\ Ne pas utiliser ce logiciel en dehors du cadre de cette désinfection : DANGEREUX /!\  

&#9654 /!\ IMPORTANT /!\  
Désactive ton Antivirus, antispyware et Pare feu avant le scan avec Combofix :
Protections résidentes : https://forum.pcastuces.com/default.asp
 et https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/ 
~~
Pare feu Windows XP : http://support.microsoft.com/kb/283673/fr
Pare feu Windows Vista/7 : https://support.microsoft.com/en-us/windows?ui=en-US&rs=en-001&ad=US
~~ 
Windows Defender : https://support.microsoft.com/en-us/windows?ui=en-US&rs=en-001&ad=US
_______________________________________________________________

&#9654 Fais un clic droit sur le lien ci dessous, choisi "Enregistrer la cible du lien sous", comme destination : ton Bureau, change son nom (ton_pseudo.exe par exemple) :  

http://download.bleepingcomputer.com/sUBs/ComboFix.exe  

&#9654 Double-clique sur ComboFix.exe  
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter  

&#9654 &#9654 SI TU ES SOUS WINDOWS XP, SURTOUT INSTALLES LA CONSOLE DE RÉCUPÉRATION [Si tu travailles avec Vista ou seven ne tiens pas compte de cet avertissement]
&#9654 &#9654 Ne touche à rien (souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC  

&#9654 En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.  
&#9654 Une fois le scan achevé, un rapport va s''afficher : Poste son contenu  
&#9654 &#9654 /!\ Réactive la protection en temps réel de ton antivirus avant de te reconnecter à Internet. /!\  

Notes: 
-> Le rapport se trouve également là : C:\ComboFix.txt   
-> tutoriel combofix

dubitoph · Answer

J'ai remarqué que j'avais oublié de supprimer le f7bd01a7. Je l'ai donc supprimé. Je n'ai pas supprimé le lokked file. Fallait-il le faire également?

Voici don le rapport après avoir supprimé le f7bd01a7 et avoir redémarrer le pc : 

16:58:54.0390 3396	TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
16:58:54.0500 3396	============================================================
16:58:54.0500 3396	Current date / time: 2011/09/27 16:58:54.0500
16:58:54.0500 3396	SystemInfo:
16:58:54.0500 3396	
16:58:54.0500 3396	OS Version: 5.1.2600 ServicePack: 3.0
16:58:54.0500 3396	Product type: Workstation
16:58:54.0500 3396	ComputerName: CHR
16:58:54.0500 3396	UserName: dmi
16:58:54.0500 3396	Windows directory: C:\WINDOWS
16:58:54.0500 3396	System windows directory: C:\WINDOWS
16:58:54.0500 3396	Processor architecture: Intel x86
16:58:54.0500 3396	Number of processors: 2
16:58:54.0500 3396	Page size: 0x1000
16:58:54.0500 3396	Boot type: Normal boot
16:58:54.0500 3396	============================================================
16:58:55.0078 3396	Initialize success
16:58:56.0359 2080	============================================================
16:58:56.0359 2080	Scan started
16:58:56.0359 2080	Mode: Manual; 
16:58:56.0359 2080	============================================================
16:58:57.0078 2080	a347bus         (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
16:58:57.0078 2080	a347bus - ok
16:58:57.0109 2080	a347scsi        (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
16:58:57.0109 2080	a347scsi - ok
16:58:57.0140 2080	Abiosdsk - ok
16:58:57.0156 2080	abp480n5 - ok
16:58:57.0218 2080	Accelerometer   (6c2e405d98e6342a9d66a2493e7ab15e) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
16:58:57.0218 2080	Accelerometer - ok
16:58:57.0265 2080	ACPI            (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
16:58:57.0281 2080	ACPI - ok
16:58:57.0328 2080	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
16:58:57.0328 2080	ACPIEC - ok
16:58:57.0437 2080	ADIHdAudAddService (ff60db2aca88543c025eacba25cee5c1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
16:58:57.0437 2080	ADIHdAudAddService - ok
16:58:57.0468 2080	adpu160m - ok
16:58:57.0484 2080	AEAudio         (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
16:58:57.0484 2080	AEAudio - ok
16:58:57.0546 2080	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
16:58:57.0562 2080	aec - ok
16:58:57.0625 2080	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
16:58:57.0625 2080	AFD - ok
16:58:57.0718 2080	AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
16:58:57.0750 2080	AgereSoftModem - ok
16:58:57.0781 2080	Aha154x - ok
16:58:57.0796 2080	aic78u2 - ok
16:58:57.0828 2080	aic78xx - ok
16:58:57.0843 2080	AliIde - ok
16:58:57.0859 2080	amsint - ok
16:58:57.0906 2080	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
16:58:57.0906 2080	Arp1394 - ok
16:58:57.0937 2080	asc - ok
16:58:57.0968 2080	asc3350p - ok
16:58:57.0984 2080	asc3550 - ok
16:58:58.0031 2080	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
16:58:58.0031 2080	AsyncMac - ok
16:58:58.0062 2080	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
16:58:58.0062 2080	atapi - ok
16:58:58.0093 2080	Atdisk - ok
16:58:58.0140 2080	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
16:58:58.0140 2080	Atmarpc - ok
16:58:58.0234 2080	ATSwpWDF        (a9f9d1d24441889beb1aa2b917457e23) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
16:58:58.0250 2080	ATSwpWDF - ok
16:58:58.0312 2080	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
16:58:58.0312 2080	audstub - ok
16:58:58.0406 2080	AVGIDSDriver    (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
16:58:58.0406 2080	AVGIDSDriver - ok
16:58:58.0453 2080	AVGIDSEH        (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
16:58:58.0453 2080	AVGIDSEH - ok
16:58:58.0484 2080	AVGIDSFilter    (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
16:58:58.0484 2080	AVGIDSFilter - ok
16:58:58.0515 2080	AVGIDSShim      (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
16:58:58.0515 2080	AVGIDSShim - ok
16:58:58.0562 2080	Avgldx86        (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
16:58:58.0578 2080	Avgldx86 - ok
16:58:58.0578 2080	Avgmfx86        (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
16:58:58.0593 2080	Avgmfx86 - ok
16:58:58.0625 2080	Avgrkx86        (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
16:58:58.0625 2080	Avgrkx86 - ok
16:58:58.0656 2080	Avgtdix         (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
16:58:58.0671 2080	Avgtdix - ok
16:58:58.0734 2080	b57w2k          (ea377a8e8e1000877210259750cbbf5f) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
16:58:58.0734 2080	b57w2k - ok
16:58:58.0781 2080	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
16:58:58.0796 2080	Beep - ok
16:58:58.0890 2080	BTKRNL          (ef5e0de0a7ca2977a9255f36f4d915ab) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
16:58:58.0906 2080	BTKRNL - ok
16:58:58.0953 2080	BTWUSB          (053dc5be74621b63bb48c2b86bafc7b0) C:\WINDOWS\system32\Drivers\btwusb.sys
16:58:58.0953 2080	BTWUSB - ok
16:58:59.0000 2080	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
16:58:59.0015 2080	cbidf2k - ok
16:58:59.0078 2080	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
16:58:59.0078 2080	CCDECODE - ok
16:58:59.0125 2080	cd20xrnt - ok
16:58:59.0140 2080	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
16:58:59.0156 2080	Cdaudio - ok
16:58:59.0218 2080	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
16:58:59.0218 2080	Cdfs - ok
16:58:59.0234 2080	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
16:58:59.0250 2080	Cdrom - ok
16:58:59.0265 2080	Changer - ok
16:58:59.0296 2080	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
16:58:59.0296 2080	CmBatt - ok
16:58:59.0343 2080	CmdIde - ok
16:58:59.0390 2080	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
16:58:59.0406 2080	Compbatt - ok
16:58:59.0437 2080	Cpqarray - ok
16:58:59.0562 2080	CrystalSysInfo  (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
16:58:59.0562 2080	CrystalSysInfo - ok
16:58:59.0609 2080	dac2w2k - ok
16:58:59.0640 2080	dac960nt - ok
16:58:59.0718 2080	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
16:58:59.0718 2080	Disk - ok
16:58:59.0781 2080	dmboot          (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
16:58:59.0812 2080	dmboot - ok
16:58:59.0875 2080	dmio            (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
16:58:59.0890 2080	dmio - ok
16:58:59.0921 2080	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
16:58:59.0937 2080	dmload - ok
16:59:00.0000 2080	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
16:59:00.0000 2080	DMusic - ok
16:59:00.0031 2080	dpti2o - ok
16:59:00.0062 2080	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
16:59:00.0062 2080	drmkaud - ok
16:59:00.0109 2080	dsNcAdpt        (b2c3f71b86e25c3df78339ddb40a7562) C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
16:59:00.0109 2080	dsNcAdpt - ok
16:59:00.0187 2080	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
16:59:00.0187 2080	Fastfat - ok
16:59:00.0281 2080	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
16:59:00.0281 2080	Fdc - ok
16:59:00.0312 2080	Fips            (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
16:59:00.0312 2080	Fips - ok
16:59:00.0343 2080	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
16:59:00.0343 2080	Flpydisk - ok
16:59:00.0406 2080	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
16:59:00.0421 2080	FltMgr - ok
16:59:00.0468 2080	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
16:59:00.0468 2080	Fs_Rec - ok
16:59:00.0515 2080	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
16:59:00.0515 2080	Ftdisk - ok
16:59:00.0578 2080	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
16:59:00.0578 2080	Gpc - ok
16:59:00.0687 2080	HBtnKey         (407e41ddb2bfece109132aec296e0d98) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
16:59:00.0687 2080	HBtnKey - ok
16:59:00.0765 2080	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
16:59:00.0765 2080	HDAudBus - ok
16:59:00.0796 2080	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
16:59:00.0796 2080	HidUsb - ok
16:59:00.0875 2080	hpdskflt        (e8a95df23097bca840814d42f2ee5164) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
16:59:00.0875 2080	hpdskflt - ok
16:59:00.0906 2080	hpn - ok
16:59:00.0937 2080	HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
16:59:00.0937 2080	HpqKbFiltr - ok
16:59:01.0015 2080	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
16:59:01.0031 2080	HTTP - ok
16:59:01.0093 2080	i2omgmt - ok
16:59:01.0109 2080	i2omp - ok
16:59:01.0156 2080	i8042prt        (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
16:59:01.0156 2080	i8042prt - ok
16:59:01.0437 2080	ialm            (f592a1b020723cfbd3d2722514066449) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
16:59:01.0671 2080	ialm - ok
16:59:01.0765 2080	iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\DRIVERS\iaStor.sys
16:59:01.0781 2080	iaStor - ok
16:59:01.0843 2080	IFXTPM          (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
16:59:01.0843 2080	IFXTPM - ok
16:59:01.0937 2080	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
16:59:01.0937 2080	Imapi - ok
16:59:01.0968 2080	ini910u - ok
16:59:01.0984 2080	IntelIde - ok
16:59:02.0015 2080	intelppm        (ad340800c35a42d4de1641a37feea34c) C:\WINDOWS\system32\DRIVERS\intelppm.sys
16:59:02.0015 2080	intelppm - ok
16:59:02.0062 2080	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
16:59:02.0062 2080	Ip6Fw - ok
16:59:02.0125 2080	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
16:59:02.0140 2080	IpFilterDriver - ok
16:59:02.0234 2080	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
16:59:02.0234 2080	IpInIp - ok
16:59:02.0296 2080	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
16:59:02.0296 2080	IpNat - ok
16:59:02.0328 2080	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
16:59:02.0343 2080	IPSec - ok
16:59:02.0390 2080	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
16:59:02.0406 2080	IRENUM - ok
16:59:02.0484 2080	isapnp          (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
16:59:02.0484 2080	isapnp - ok
16:59:02.0562 2080	Kbdclass        (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
16:59:02.0562 2080	Kbdclass - ok
16:59:02.0609 2080	kbdhid          (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
16:59:02.0609 2080	kbdhid - ok
16:59:02.0671 2080	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
16:59:02.0671 2080	kmixer - ok
16:59:02.0718 2080	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
16:59:02.0718 2080	KSecDD - ok
16:59:02.0781 2080	Lavasoft Kernexplorer - ok
16:59:02.0859 2080	Lbd             (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys
16:59:02.0859 2080	Lbd - ok
16:59:02.0937 2080	lbrtfdc - ok
16:59:03.0046 2080	LMIInfo         (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
16:59:03.0046 2080	LMIInfo - ok
16:59:03.0140 2080	lmimirr         (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
16:59:03.0140 2080	lmimirr - ok
16:59:03.0171 2080	LMIRfsClientNP - ok
16:59:03.0203 2080	LMIRfsDriver    (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
16:59:03.0203 2080	LMIRfsDriver - ok
16:59:03.0265 2080	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
16:59:03.0265 2080	mnmdd - ok
16:59:03.0343 2080	Modem           (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
16:59:03.0359 2080	Modem - ok
16:59:03.0421 2080	Mouclass        (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
16:59:03.0421 2080	Mouclass - ok
16:59:03.0500 2080	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
16:59:03.0500 2080	mouhid - ok
16:59:03.0531 2080	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
16:59:03.0531 2080	MountMgr - ok
16:59:03.0562 2080	mraid35x - ok
16:59:03.0640 2080	MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
16:59:03.0656 2080	MRxDAV - ok
16:59:03.0734 2080	MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
16:59:03.0750 2080	MRxSmb - ok
16:59:03.0812 2080	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
16:59:03.0812 2080	Msfs - ok
16:59:03.0890 2080	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
16:59:03.0890 2080	MSKSSRV - ok
16:59:03.0953 2080	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
16:59:03.0953 2080	MSPCLOCK - ok
16:59:04.0015 2080	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
16:59:04.0015 2080	MSPQM - ok
16:59:04.0062 2080	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
16:59:04.0062 2080	mssmbios - ok
16:59:04.0109 2080	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
16:59:04.0109 2080	MSTEE - ok
16:59:04.0218 2080	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
16:59:04.0234 2080	Mup - ok
16:59:04.0296 2080	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
16:59:04.0296 2080	NABTSFEC - ok
16:59:04.0390 2080	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
16:59:04.0406 2080	NDIS - ok
16:59:04.0468 2080	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
16:59:04.0468 2080	NdisIP - ok
16:59:04.0531 2080	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys
16:59:04.0531 2080	NdisTapi - ok
16:59:04.0578 2080	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys
16:59:04.0578 2080	Ndisuio - ok
16:59:04.0609 2080	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys
16:59:04.0609 2080	NdisWan - ok
16:59:04.0671 2080	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
16:59:04.0671 2080	NDProxy - ok
16:59:04.0765 2080	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys
16:59:04.0765 2080	NetBIOS - ok
16:59:04.0796 2080	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys
16:59:04.0812 2080	NetBT - ok
16:59:05.0015 2080	NETw5x32        (05743fffc2bc88cc8e426321bc6a762e) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
16:59:05.0125 2080	NETw5x32 - ok
16:59:05.0156 2080	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS
ic1394.sys
16:59:05.0156 2080	NIC1394 - ok
16:59:05.0203 2080	nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
16:59:05.0218 2080	nm - ok
16:59:05.0296 2080	NPF             (243126da7ba441d7c7c3262dcf435a9c) C:\WINDOWS\system32\drivers
pf.sys
16:59:05.0296 2080	NPF - ok
16:59:05.0375 2080	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
16:59:05.0375 2080	Npfs - ok
16:59:05.0437 2080	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
16:59:05.0453 2080	Ntfs - ok
16:59:05.0531 2080	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
16:59:05.0531 2080	Null - ok
16:59:05.0609 2080	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
16:59:05.0609 2080	NwlnkFlt - ok
16:59:05.0671 2080	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
16:59:05.0671 2080	NwlnkFwd - ok
16:59:05.0750 2080	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
16:59:05.0750 2080	ohci1394 - ok
16:59:05.0859 2080	Parport         (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
16:59:05.0859 2080	Parport - ok
16:59:05.0890 2080	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
16:59:05.0890 2080	PartMgr - ok
16:59:05.0984 2080	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
16:59:05.0984 2080	ParVdm - ok
16:59:06.0031 2080	PCI             (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
16:59:06.0031 2080	PCI - ok
16:59:06.0078 2080	PCIDump - ok
16:59:06.0093 2080	PCIIde - ok
16:59:06.0156 2080	Pcmcia          (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
16:59:06.0156 2080	Pcmcia - ok
16:59:06.0203 2080	PDCOMP - ok
16:59:06.0218 2080	PDFRAME - ok
16:59:06.0250 2080	PDRELI - ok
16:59:06.0265 2080	PDRFRAME - ok
16:59:06.0281 2080	perc2 - ok
16:59:06.0328 2080	perc2hib - ok
16:59:06.0421 2080	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys
16:59:06.0421 2080	PptpMiniport - ok
16:59:06.0484 2080	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
16:59:06.0500 2080	PSched - ok
16:59:06.0546 2080	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
16:59:06.0546 2080	Ptilink - ok
16:59:06.0578 2080	ql1080 - ok
16:59:06.0593 2080	Ql10wnt - ok
16:59:06.0625 2080	ql12160 - ok
16:59:06.0640 2080	ql1240 - ok
16:59:06.0671 2080	ql1280 - ok
16:59:06.0703 2080	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
16:59:06.0718 2080	RasAcd - ok
16:59:06.0828 2080	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys
16:59:06.0828 2080	Rasl2tp - ok
16:59:06.0968 2080	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys
16:59:06.0984 2080	RasPppoe - ok
16:59:07.0234 2080	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
16:59:07.0250 2080	Raspti - ok
16:59:07.0468 2080	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys
16:59:07.0500 2080	Rdbss - ok
16:59:07.0781 2080	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
16:59:07.0796 2080	RDPCDD - ok
16:59:08.0031 2080	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys
16:59:08.0062 2080	rdpdr - ok
16:59:08.0328 2080	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
16:59:08.0390 2080	RDPWD - ok
16:59:08.0625 2080	redbook         (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERSedbook.sys
16:59:08.0656 2080	redbook - ok
16:59:08.0828 2080	SCR3XX2K        (fc87d5e0328afa97bf6d39df96d5d356) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys
16:59:08.0859 2080	SCR3XX2K - ok
16:59:09.0046 2080	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
16:59:09.0062 2080	Secdrv - ok
16:59:09.0109 2080	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
16:59:09.0109 2080	serenum - ok
16:59:09.0250 2080	Serial          (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
16:59:09.0312 2080	Serial - ok
16:59:09.0578 2080	SFAUDIO         (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
16:59:09.0578 2080	SFAUDIO - ok
16:59:09.0718 2080	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
16:59:09.0718 2080	Sfloppy - ok
16:59:09.0812 2080	Simbad - ok
16:59:09.0937 2080	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
16:59:09.0937 2080	SLIP - ok
16:59:10.0109 2080	SNP2UVC         (cf9cde12fbc19dba8de528b7511a2f4f) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
16:59:10.0171 2080	SNP2UVC - ok
16:59:10.0203 2080	Sparrow - ok
16:59:10.0265 2080	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
16:59:10.0265 2080	splitter - ok
16:59:10.0390 2080	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
16:59:10.0390 2080	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
16:59:10.0390 2080	sptd ( LockedFile.Multi.Generic ) - warning
16:59:10.0390 2080	sptd - detected LockedFile.Multi.Generic (1)
16:59:10.0437 2080	sr              (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
16:59:10.0453 2080	sr - ok
16:59:10.0546 2080	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
16:59:10.0593 2080	Srv - ok
16:59:10.0687 2080	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
16:59:10.0687 2080	streamip - ok
16:59:10.0781 2080	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
16:59:10.0781 2080	swenum - ok
16:59:10.0875 2080	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
16:59:10.0875 2080	swmidi - ok
16:59:10.0906 2080	symc810 - ok
16:59:10.0921 2080	symc8xx - ok
16:59:10.0937 2080	sym_hi - ok
16:59:10.0953 2080	sym_u3 - ok
16:59:11.0015 2080	SynTP           (f08667f79bbd339547f477c75c3ed0b9) C:\WINDOWS\system32\DRIVERS\SynTP.sys
16:59:11.0015 2080	SynTP - ok
16:59:11.0046 2080	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
16:59:11.0046 2080	sysaudio - ok
16:59:11.0093 2080	tap0801         (846b7c0e3f6370cdcce157a5b36e70cd) C:\WINDOWS\system32\DRIVERS	ap0801.sys
16:59:11.0093 2080	tap0801 - ok
16:59:11.0171 2080	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys
16:59:11.0203 2080	Tcpip - ok
16:59:11.0250 2080	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
16:59:11.0250 2080	TDPIPE - ok
16:59:11.0265 2080	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
16:59:11.0265 2080	TDTCP - ok
16:59:11.0281 2080	teamviewervpn   (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS	eamviewervpn.sys
16:59:11.0281 2080	teamviewervpn - ok
16:59:11.0375 2080	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS	ermdd.sys
16:59:11.0390 2080	TermDD - ok
16:59:11.0484 2080	tmcomm          (eb2283c0a4dfbd2e53d14f2c4d5a1e89) C:\WINDOWS\system32\drivers	mcomm.sys
16:59:11.0484 2080	tmcomm - ok
16:59:11.0515 2080	TosIde - ok
16:59:11.0687 2080	TrueSight       (ddbf8e194041469f26fc6cbc8264beb0) C:\Documents and Settings\dmi\Bureau\TrueSight.sys
16:59:11.0703 2080	TrueSight - ok
16:59:11.0765 2080	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
16:59:11.0781 2080	Udfs - ok
16:59:11.0859 2080	ultra - ok
16:59:11.0953 2080	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
16:59:11.0968 2080	Update - ok
16:59:12.0031 2080	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
16:59:12.0031 2080	usbccgp - ok
16:59:12.0125 2080	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
16:59:12.0125 2080	usbehci - ok
16:59:12.0156 2080	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
16:59:12.0156 2080	usbhub - ok
16:59:12.0218 2080	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
16:59:12.0218 2080	usbprint - ok
16:59:12.0281 2080	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
16:59:12.0281 2080	usbscan - ok
16:59:12.0375 2080	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
16:59:12.0375 2080	USBSTOR - ok
16:59:12.0390 2080	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
16:59:12.0390 2080	usbuhci - ok
16:59:12.0421 2080	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
16:59:12.0421 2080	usbvideo - ok
16:59:12.0468 2080	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
16:59:12.0468 2080	VgaSave - ok
16:59:12.0484 2080	ViaIde - ok
16:59:12.0515 2080	VolSnap         (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
16:59:12.0515 2080	VolSnap - ok
16:59:12.0546 2080	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
16:59:12.0546 2080	Wanarp - ok
16:59:12.0625 2080	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
16:59:12.0640 2080	Wdf01000 - ok
16:59:12.0640 2080	WDICA - ok
16:59:12.0703 2080	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
16:59:12.0718 2080	wdmaud - ok
16:59:12.0828 2080	WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
16:59:12.0828 2080	WmiAcpi - ok
16:59:12.0843 2080	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
16:59:12.0843 2080	WSTCODEC - ok
16:59:12.0890 2080	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
16:59:12.0890 2080	WudfPf - ok
16:59:12.0921 2080	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
16:59:12.0921 2080	WudfRd - ok
16:59:12.0953 2080	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
16:59:13.0062 2080	\Device\Harddisk0\DR0 - ok
16:59:13.0062 2080	Boot (0x1200)   (7c8d0dcb31f179aff5003f6445918649) \Device\Harddisk0\DR0\Partition0
16:59:13.0062 2080	\Device\Harddisk0\DR0\Partition0 - ok
16:59:13.0062 2080	============================================================
16:59:13.0062 2080	Scan finished
16:59:13.0062 2080	============================================================
16:59:13.0078 2232	Detected object count: 1
16:59:13.0078 2232	Actual detected object count: 1
16:59:19.0546 2232	sptd ( LockedFile.Multi.Generic ) - skipped by user
16:59:19.0546 2232	sptd ( LockedFile.Multi.Generic ) - User select action: Skip

dubitoph · Answer

Désolé, je dois faire une petite pause de 20 minutes car je dois impérativement m'occuper de mes filles...

Je retravaille sur ce problème juste après...

juju666 · Answer

Non, le locked c'est le driver de Daemon Tool :)

En attente de combofix donc ;)

dubitoph · Answer

Me voilà de retour...

Voici donc le rapport de Combofix : 

ComboFix 11-09-27.01 - dmi 27/09/2011  17:39:36.1.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.1977.1391 [GMT 2:00]
Lancé depuis: c:\documents and settings\dmi\Bureau\dubitoph.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
[i] ADS - system32: deleted 40 bytes in 1 streams. [/i]
[i] ADS - WINDOWS: deleted 24 bytes in 1 streams. [/i]
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\chr\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\chr\Local Settings\Application Data\ApplicationHistory
gen.exe.2c05686e.ini
c:\documents and settings\dmi\foito.exe
c:\documents and settings\dmi\gob.exe
c:\documents and settings\dmi\iob.exe
c:\documents and settings\dmi\Mes documents\HiJackThis.exe
c:\documents and settings\dmi\sod64.exe
c:\program files\InstallPedia
c:\program files\InstallPedia\Ionic.Zip.Reduced.dll
c:\program files\InstallPedia\lnetworker.exe
c:\program files\InstallPedia\pref_updater.exe
c:\program files\InstallPedia\service.exe
c:\program files\InstallPedia\Utils.dll
c:\program files\Mozilla Firefox\extensions\searchsettings@spigot.com
c:\program files\Search Settings
c:\program files\Search Settings\FF\chrome.manifest
c:\program files\Search Settings\FF\chrome\content\plugin.js
c:\program files\Search Settings\FF\chrome\content\plugin.xul
c:\program files\Search Settings\FF\chrome\content\protection.js
c:\program files\Search Settings\FF\chrome\content\utils.js
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
c:\program files\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
c:\program files\Search Settings\FF\components\IFBHOSearch.xpt
c:\program files\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
c:\program files\Search Settings\FF\components\IFHelperPreferences.xpt
c:\program files\Search Settings\FF\install.rdf
c:\program files\Search Settings\SeARchsettings.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\$NtUninstallKB2533$
c:\windows\$NtUninstallKB2533$\2962961871
c:\windows\$NtUninstallKB2533$\4156359079\@
c:\windows\$NtUninstallKB2533$\4156359079\bckfg.tmp
c:\windows\$NtUninstallKB2533$\4156359079\cfg.ini
c:\windows\$NtUninstallKB2533$\4156359079\Desktop.ini
c:\windows\$NtUninstallKB2533$\4156359079\kwrd.dll
c:\windows\$NtUninstallKB2533$\4156359079\L\owrwkutu
c:\windows\$NtUninstallKB2533$\4156359079\U\00000001.@
c:\windows\$NtUninstallKB2533$\4156359079\U\00000002.@
c:\windows\$NtUninstallKB2533$\4156359079\U\80000000.@
c:\windows\$NtUninstallKB2533$\4156359079\U\80000032.@
c:\windows\2801909239
c:\windows\system32\instsrv.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NOTEPAD
-------\Legacy_I.P_services
-------\Legacy_I.P_services
-------\Service_I.P services
-------\Service_I.P services
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2011-08-27 au 2011-09-27  ))))))))))))))))))))))))))))))))))))
.
.
2011-09-27 13:32 . 2011-09-27 13:32	--------	d--h--w-	c:\windows\msdownld.tmp
2011-09-27 12:21 . 2011-09-27 12:21	--------	d-----w-	c:\documents and settings\dmi\Application Data\QuickScan
2011-09-27 11:54 . 2011-09-27 11:54	--------	d-----w-	c:\program files\Trend Micro
2011-09-27 10:21 . 2011-09-27 10:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\InternetFax
2011-09-27 10:21 . 2011-09-27 10:22	--------	d-----w-	c:\documents and settings\All Users\Application Data	pfmon
2011-09-27 10:21 . 2011-09-27 10:21	--------	d-----w-	c:\program files\Alliance MCA
2011-09-17 12:42 . 2011-09-17 12:42	--------	d-----w-	C:\Poker
2011-09-16 21:44 . 2011-09-16 21:44	--------	d-----w-	c:\documents and settings\dmi\Application Data\BankPerfect
2011-09-16 17:26 . 2011-09-16 17:26	--------	d-----w-	c:\documents and settings\dmi\Application Data\AlauxSoft
2011-09-16 16:45 . 2011-09-16 16:54	--------	d-----w-	c:\program files\Microsoft Money 2005
2011-09-11 10:06 . 2011-09-11 10:06	--------	d-----w-	c:\program files\AnglaisFacile.com
2011-09-09 11:03 . 2011-09-09 11:09	--------	d-----w-	c:\program files\PDFCreator
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-27 14:39 . 2008-10-07 12:04	58752	----a-w-	c:\windows\system32\driversedbook.sys
2011-09-27 11:41 . 2011-05-15 11:40	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-18 17:19 . 2011-07-18 17:19	0	---ha-w-	c:\documents and settings\dmi\Local Settings\Application Data\BITA2.tmp
2011-06-29 16:51 . 2010-12-19 12:37	101720	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2011-09-09 11:02 . 2011-05-20 18:20	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-10-07 . 43D3342D9612FB5BE00807C32EEED77D . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[7] 2011-04-21 . B6E13F9C120C776A89D783E26D6C15C5 . 634648 . . [7.00.6000.17098] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2011-04-21 . 3E23DBEBE1020D52C63235E4189FAC03 . 634648 . . [7.00.6000.21300] . . c:\windows\$hf_mig$\KB2530548-IE7\SP3QFE\iexplore.exe
[7] 2011-02-14 . E4A798DFDE7FE6E79F23548F0EF0F844 . 634648 . . [7.00.6000.17096] . . c:\windows\ie7updates\KB2530548-IE7\iexplore.exe
[7] 2011-02-14 . E3CC8CCF21BFDC954255BB17083FB9F0 . 634648 . . [7.00.6000.21298] . . c:\windows\$hf_mig$\KB2497640-IE7\SP3QFE\iexplore.exe
[7] 2010-10-18 . 72D1F43C4146D312B0DB6AB98C21340E . 634648 . . [7.00.6000.17093] . . c:\windows\ie7updates\KB2497640-IE7\iexplore.exe
[7] 2010-10-18 . DA6E1F0F1932B62DD2F6ED05541C555C . 634648 . . [7.00.6000.21295] . . c:\windows\$hf_mig$\KB2416400-IE7\SP3QFE\iexplore.exe
[7] 2010-08-25 . E5412ED9E07C42C20C48D3FF71E6B1E8 . 634648 . . [7.00.6000.17091] . . c:\windows\ie7updates\KB2416400-IE7\iexplore.exe
[7] 2010-08-25 . F047BEB9771E45A05F425499A30F9BBA . 634648 . . [7.00.6000.21293] . . c:\windows\$hf_mig$\KB2360131-IE7\SP3QFE\iexplore.exe
[7] 2010-04-16 . C4BA5E36FB57F547117305BF1E0FE454 . 634656 . . [7.00.6000.17055] . . c:\windows\ie7updates\KB2360131-IE7\iexplore.exe
[7] 2010-04-16 . B24A4E23A2FEDB6976EB04D334AD82B2 . 634648 . . [7.00.6000.21256] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[7] 2009-12-18 . 53C291F3B01EECECBD7FD358EA3ACC94 . 634648 . . [7.00.6000.16981] . . c:\windows\ie7updates\KB982381-IE7\iexplore.exe
[7] 2009-12-18 . D19E56D5930C37CF211867DF450C372A . 634632 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\iexplore.exe
[7] 2009-10-28 . 80675329E0FD54F016C4F8A83C616349 . 634632 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[7] 2009-10-28 . 4F9B04D546C23A295F3F0AE015BE51DB . 634632 . . [7.00.6000.16945] . . c:\windows\ie7updates\KB978207-IE7\iexplore.exe
[7] 2009-08-27 . F232BA9F39BC0F722672C7E79E68EBEA . 634648 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976325-IE7\iexplore.exe
[7] 2009-08-27 . 332EC7562F3AA7364F2D4231C56DA986 . 634648 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe
[7] 2009-06-29 . 3CFC56F73D494FC1AA2B6E981DF15ACD . 634632 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\iexplore.exe
[7] 2009-06-29 . 02E2754D3E566C11A4934825920C47DD . 634632 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe
[7] 2009-04-25 . 092A7F2B49A19ECCE5369D3CB2276148 . 636088 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\iexplore.exe
[7] 2009-04-25 . C0503FD8D163652735C1EE900672A75C . 636088 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 . BCD8E48709BE4A79606F0B6E8E9A6162 . 636088 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 . A251068640DDB69FD7805B57D89D7FF7 . 636072 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\iexplore.exe
[7] 2008-12-19 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[7] 2008-12-19 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\iexplore.exe
[7] 2008-07-30 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe
[7] 2008-06-23 . 64E376A47763DAEABCDA14BD5B6EA286 . 625664 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB961260-IE7\iexplore.exe
[7] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.fr/fr.special-uninstallation-feedback-appf?lic=OQBBAFYARgBSAEUARQAtAFYAQQBFAEEAWQAtAFQAMwBMAFUARQAtAE4ATAAzAEQAQQAtAEMAQgBVAEsASAAtAEoARgA3AE0AOQA&inst=NwA3AC0ANAA0ADcAMQAzADQAOAA5ADUALQBUADQALQBGAEwAKwA5AC0AWABPADMANgArADEALQBYAE8AOQArADEA&prod=90&ver=9.0.894" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
c:\documents and settings\utilisateur\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2010-12-08 12:11	87424	----a-w-	c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk
backup=c:\windows\pss\BTTray.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AccelerometerSysTrayApplet]
2008-04-11 12:16	77672	----a-w-	c:\windows\system32\accelerometerST.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59	937920	----a-r-	c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Readereader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-10-19 01:12	1983816	----a-w-	c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Express Welcome]
2005-06-09 03:30	20480	----a-w-	c:\program files\IBM\Client Access\cwbwlwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Help Update]
2005-06-09 03:30	24626	----a-w-	c:\program files\IBM\Client Access\cwbinhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access PC5250 Sound]
2005-06-09 03:30	40960	----a-w-	c:\program files\IBM\Client Access\Emulator\pcssnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Service]
2005-06-09 03:30	20530	----a-w-	c:\program files\IBM\Client Access\cwbsvstr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 17:34	15360	----a-w-	c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firefox]
2011-09-09 11:02	924632	----a-w-	c:\program files\Mozilla Firefox\firefox.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-06-05 08:09	170520	----a-w-	c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2008-04-18 11:53	178712	----a-w-	c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-06-05 08:09	150040	----a-w-	c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2010-01-27 10:22	63048	----a-w-	c:\program files\LogMeIn\x86\LogMeInSystray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2005-08-18 08:55	99328	----a-w-	c:\program files\OpenVPN\bin\openvpn-gui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-06-05 08:09	141848	----a-w-	c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-06-03 14:40	177456	----a-w-	c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2008-03-24 11:43	884736	----a-w-	c:\program files\Analog Devices\SoundMAX\SMax4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2008-04-04 13:09	1044480	----a-w-	c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44	248552	----a-w-	c:\program files\Fichiers communs\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-06-20 14:19	1310720	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2010-12-10 12:28	247144	----a-w-	c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\TeamViewer\Version5\TeamViewer.exe"=
"c:\Program Files\UltraVNC\winvnc.exe"=
"c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe"=
"c:\hb32.exe"=
"c:\WINDOWS\system32\mmc.exe"=
"c:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe"=
"c:\Program Files\AVG\AVG10\avgmfapx.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\AVG\AVG10\avgdiagex.exe"=
"c:\Program Files\AVG\AVG10\avgnsx.exe"=
"c:\Program Files\AVG\AVG10\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"5800:TCP"= 5800:TCP:vnc5800
"22:TCP"= 22:TCP:SSHD
"8000:UDP"= 8000:UDP:Express Talk RTP Incoming Audio (UDP)
"8001:UDP"= 8001:UDP:Express Talk RTP Incoming Audio (UDP)
"8002:UDP"= 8002:UDP:Express Talk RTP Incoming Audio (UDP)
"8003:UDP"= 8003:UDP:Express Talk RTP Incoming Audio (UDP)
"8004:UDP"= 8004:UDP:Express Talk RTP Incoming Audio (UDP)
"8005:UDP"= 8005:UDP:Express Talk RTP Incoming Audio (UDP)
"81:TCP"= 81:TCP:Axon Virtual PBX Web Server
"4100:UDP"= 4100:UDP:uPNP Router Control Port
"8006:UDP"= 8006:UDP:Express Talk RTP Incoming Audio (UDP)
"8007:UDP"= 8007:UDP:Express Talk RTP Incoming Audio (UDP)
"8008:UDP"= 8008:UDP:Express Talk RTP Incoming Audio (UDP)
"8009:UDP"= 8009:UDP:Express Talk RTP Incoming Audio (UDP)
"5060:UDP"= 5060:UDP:Express Talk Sip Incoming Calls (UDP)
"5985:TCP"= 5985:TCP:*:Disabled:Gestion à distance de Windows 
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [07/03/2010 19:08 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [07/03/2010 19:08 5248]
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [22/02/2011 08:13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [19/01/2011 04:32 32592]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/12/2010 14:37 64288]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28/03/2008 10:14 24064]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17/05/2009 18:52 721904]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/01/2011 06:41 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [10/02/2011 07:54 297168]
R2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [08/01/2010 00:51 380928]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [09/05/2008 16:09 1168632]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [08/02/2011 05:33 269520]
R2 backupSpeedCall;backupSpeedCall;c:\windows\system32\srvany.exe [28/01/2010 20:20 8192]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [01/10/2010 12:40 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86ainfo.sys [27/01/2010 12:22 12856]
R2 OCS INVENTORY;OCS INVENTORY SERVICE;c:\program files\OCS Inventory Agent\OcsService.exe [28/10/2009 00:37 69632]
R2 OpenSSHd;OpenSSH Server;c:\program files\OpenSSH\bin\cygrunsrv.exe [18/03/2008 12:28 68096]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [10/12/2010 14:29 92008]
R2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [07/10/2008 14:32 1590216]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [13/05/2008 08:30 475520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [30/03/2011 17:17 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [10/02/2011 07:53 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/02/2011 07:53 27216]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [04/04/2007 19:16 41216]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers	ap0801.sys [24/06/2004 03:54 23552]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [18/08/2011 01:33 7390560]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
S2 gupdate1cb0bdd975ae192;Service Google Update (gupdate1cb0bdd975ae192);c:\program files\Google\Update\GoogleUpdate.exe [14/06/2010 18:21 133104]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [07/10/2008 15:42 193840]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [14/06/2010 18:21 133104]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys --> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers
pf.sys [29/06/2007 02:01 42512]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [21/06/2007 04:40 56448]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers	eamviewervpn.sys [25/01/2008 11:12 25088]
S3 TrueSight;TrueSight;c:\documents and settings\dmi\Bureau\TrueSight.sys [27/09/2011 16:10 60800]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [13/04/2008 19:34 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM	REG_MULTI_SZ   	WINRM
.
Contenu du dossier 'Tâches planifiées'
.
2011-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-09-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-23 17:26]
.
2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-14 16:21]
.
2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-14 16:21]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.01net.com/
mStart Page = hxxp://www.foozir.com/
uInternet Connection Wizard,ShellNext = https://217.145.35.171/dana-na/auth/url_2/welcome.cgi
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Envoyer à Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: chrnamur.be\chrvpn
Trusted Zone: fgov.be\*.minfin
Trusted Zone: localhost
Trusted Zone: winamax.fr\www
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0C17677C-5955-430B-969C-DD06005077E0}: NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{20D93359-B78E-45FE-8D0D-7B2198E2F30B}: NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{B947F0E2-0709-49E4-BD00-1240DDE8A598}: NameServer = 216.146.35.35,216.146.36.36
FF - ProfilePath - c:\documents and settings\dmi\Application Data\Mozilla\Firefox\Profiles\agx015nf.default\
FF - prefs.js: browser.startup.homepage - hxxp://localhost/speedcall/interfaces/interface.php
.
- - - - ORPHELINS SUPPRIMES - - - -
.
URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
URLSearchHooks-{9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
SafeBoot-19690823.sys
SafeBoot-61297986.sys
MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe
MSConfigStartUp-IP Network - c:\program files\InstallPedia\lnetworker.exe
MSConfigStartUp-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-27 17:49
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(1436)
c:\windows\system32\LMIinit.dll
.
- - - - - - - > 'explorer.exe'(3544)
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\progra~1\AVG\AVG10\avgchsvx.exe
c:\progra~1\AVG\AVG10\avgrsx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\oracle\ora92\bin\omtsreco.exe
c:\program files\OpenSSH\usr\sbin\sshd.exe
c:\windows\system32\wscntfy.exe
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
.
**************************************************************************
.
Heure de fin: 2011-09-27  17:52:48 - La machine a redémarré
ComboFix-quarantined-files.txt  2011-09-27 15:52
.
Avant-CF: 120 411 574 272 octets libres
Après-CF: 120 935 960 576 octets libres
.
WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect
.
- - End Of File - - A3BEBBEF2075ECB13888C93CA213601E

juju666 · Answer

&#9654 &#9654 DÉSACTIVE TES PROTECTIONS DURANT LA PROCÉDURE

&#9654 &#9654 SCRIPT PERSONNALISE A CET ORDINATEUR, NE PAS REPRODUIRE : DANGEREUX !!!! 

&#9654 Créé un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes : 


KillAll::

Driver::
Application Updater
backupSpeedCall
Lavasoft Kernexplorer

Folder::
c:\program files\Application Updater
c:\program files\Lavasoft

File::
c:\windows\system32\srvany.exe 

DDS::
uInternet Connection Wizard,ShellNext = https://217.145.35.171/dana-na/auth/url_2/welcome.cgi      
uInternet Settings,ProxyOverride = <local>      


&#9654 Enregistre ce fichier sous le nom  CFScript 

&#9654 Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript-2.gif 

&#9654 Combofix se lance, laisse toi guider.. 

&#9654 Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal! 
Ne touche à rien tant que le scan n'est pas terminé. 
&#9654 Une fois le scan achevé, un rapport va s'afficher: poste son contenu, en précisant où en sont tes soucis 

&#9654 Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

dubitoph · Answer

Voici le nouveau rapport, ci-après, le nouveau rapport. Je vais maintenant regarder au j'en suis au niveau des soucis rencontrés.

ComboFix 11-09-27.01 - dmi 27/09/2011  18:21:49.2.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.3.1252.33.1036.18.1977.1227 [GMT 2:00]
Lancé depuis: c:\documents and settings\dmi\Bureau\dubitoph.exe
Commutateurs utilisés :: c:\documents and settings\dmi\Bureau\CFScript.txt
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\windows\system32\srvany.exe"
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Application Updater
c:\program files\Application Updater\ApplicationUpdater.exe
c:\program files\Application Updater\config.ini
c:\program files\Lavasoft
c:\windows\system32\srvany.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_APPLICATION_UPDATER
-------\Legacy_BACKUPSPEEDCALL
-------\Legacy_LAVASOFT_KERNEXPLORER
-------\Service_Application Updater
-------\Service_backupSpeedCall
-------\Service_Lavasoft Kernexplorer
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2011-08-27 au 2011-09-27  ))))))))))))))))))))))))))))))))))))
.
.
2011-09-27 13:32 . 2011-09-27 13:32	--------	d--h--w-	c:\windows\msdownld.tmp
2011-09-27 12:21 . 2011-09-27 12:21	--------	d-----w-	c:\documents and settings\dmi\Application Data\QuickScan
2011-09-27 11:54 . 2011-09-27 11:54	--------	d-----w-	c:\program files\Trend Micro
2011-09-27 10:21 . 2011-09-27 10:24	--------	d-----w-	c:\documents and settings\All Users\Application Data\InternetFax
2011-09-27 10:21 . 2011-09-27 10:22	--------	d-----w-	c:\documents and settings\All Users\Application Data	pfmon
2011-09-27 10:21 . 2011-09-27 10:21	--------	d-----w-	c:\program files\Alliance MCA
2011-09-17 12:42 . 2011-09-17 12:42	--------	d-----w-	C:\Poker
2011-09-16 21:44 . 2011-09-16 21:44	--------	d-----w-	c:\documents and settings\dmi\Application Data\BankPerfect
2011-09-16 17:26 . 2011-09-16 17:26	--------	d-----w-	c:\documents and settings\dmi\Application Data\AlauxSoft
2011-09-16 16:45 . 2011-09-16 16:54	--------	d-----w-	c:\program files\Microsoft Money 2005
2011-09-11 10:06 . 2011-09-11 10:06	--------	d-----w-	c:\program files\AnglaisFacile.com
2011-09-09 11:03 . 2011-09-09 11:09	--------	d-----w-	c:\program files\PDFCreator
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-27 14:39 . 2008-10-07 12:04	58752	----a-w-	c:\windows\system32\driversedbook.sys
2011-09-27 11:41 . 2011-05-15 11:40	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-18 17:19 . 2011-07-18 17:19	0	---ha-w-	c:\documents and settings\dmi\Local Settings\Application Data\BITA2.tmp
2011-06-29 16:51 . 2010-12-19 12:37	101720	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2011-09-09 11:02 . 2011-05-20 18:20	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-10-07 . 43D3342D9612FB5BE00807C32EEED77D . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[7] 2011-04-21 . B6E13F9C120C776A89D783E26D6C15C5 . 634648 . . [7.00.6000.17098] . . c:\windows\system32\dllcache\iexplore.exe
[7] 2011-04-21 . 3E23DBEBE1020D52C63235E4189FAC03 . 634648 . . [7.00.6000.21300] . . c:\windows\$hf_mig$\KB2530548-IE7\SP3QFE\iexplore.exe
[7] 2011-02-14 . E4A798DFDE7FE6E79F23548F0EF0F844 . 634648 . . [7.00.6000.17096] . . c:\windows\ie7updates\KB2530548-IE7\iexplore.exe
[7] 2011-02-14 . E3CC8CCF21BFDC954255BB17083FB9F0 . 634648 . . [7.00.6000.21298] . . c:\windows\$hf_mig$\KB2497640-IE7\SP3QFE\iexplore.exe
[7] 2010-10-18 . 72D1F43C4146D312B0DB6AB98C21340E . 634648 . . [7.00.6000.17093] . . c:\windows\ie7updates\KB2497640-IE7\iexplore.exe
[7] 2010-10-18 . DA6E1F0F1932B62DD2F6ED05541C555C . 634648 . . [7.00.6000.21295] . . c:\windows\$hf_mig$\KB2416400-IE7\SP3QFE\iexplore.exe
[7] 2010-08-25 . E5412ED9E07C42C20C48D3FF71E6B1E8 . 634648 . . [7.00.6000.17091] . . c:\windows\ie7updates\KB2416400-IE7\iexplore.exe
[7] 2010-08-25 . F047BEB9771E45A05F425499A30F9BBA . 634648 . . [7.00.6000.21293] . . c:\windows\$hf_mig$\KB2360131-IE7\SP3QFE\iexplore.exe
[7] 2010-04-16 . C4BA5E36FB57F547117305BF1E0FE454 . 634656 . . [7.00.6000.17055] . . c:\windows\ie7updates\KB2360131-IE7\iexplore.exe
[7] 2010-04-16 . B24A4E23A2FEDB6976EB04D334AD82B2 . 634648 . . [7.00.6000.21256] . . c:\windows\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[7] 2009-12-18 . 53C291F3B01EECECBD7FD358EA3ACC94 . 634648 . . [7.00.6000.16981] . . c:\windows\ie7updates\KB982381-IE7\iexplore.exe
[7] 2009-12-18 . D19E56D5930C37CF211867DF450C372A . 634632 . . [7.00.6000.21183] . . c:\windows\$hf_mig$\KB978207-IE7\SP3QFE\iexplore.exe
[7] 2009-10-28 . 80675329E0FD54F016C4F8A83C616349 . 634632 . . [7.00.6000.21148] . . c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[7] 2009-10-28 . 4F9B04D546C23A295F3F0AE015BE51DB . 634632 . . [7.00.6000.16945] . . c:\windows\ie7updates\KB978207-IE7\iexplore.exe
[7] 2009-08-27 . F232BA9F39BC0F722672C7E79E68EBEA . 634648 . . [7.00.6000.16915] . . c:\windows\ie7updates\KB976325-IE7\iexplore.exe
[7] 2009-08-27 . 332EC7562F3AA7364F2D4231C56DA986 . 634648 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe
[7] 2009-06-29 . 3CFC56F73D494FC1AA2B6E981DF15ACD . 634632 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\iexplore.exe
[7] 2009-06-29 . 02E2754D3E566C11A4934825920C47DD . 634632 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe
[7] 2009-04-25 . 092A7F2B49A19ECCE5369D3CB2276148 . 636088 . . [7.00.6000.16850] . . c:\windows\ie7updates\KB972260-IE7\iexplore.exe
[7] 2009-04-25 . C0503FD8D163652735C1EE900672A75C . 636088 . . [7.00.6000.21045] . . c:\windows\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 . BCD8E48709BE4A79606F0B6E8E9A6162 . 636088 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 . A251068640DDB69FD7805B57D89D7FF7 . 636072 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB969897-IE7\iexplore.exe
[7] 2008-12-19 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[7] 2008-12-19 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\iexplore.exe
[7] 2008-07-30 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe
[7] 2008-06-23 . 64E376A47763DAEABCDA14BD5B6EA286 . 625664 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB961260-IE7\iexplore.exe
[7] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
.
(((((((((((((((((((((((((((((   SnapShot@2011-09-27_15.49.13   )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-09-27 16:28 . 2011-09-27 16:28	16384              c:\windows	emp\Perflib_Perfdata_138.dat
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.fr/fr.special-uninstallation-feedback-appf?lic=OQBBAFYARgBSAEUARQAtAFYAQQBFAEEAWQAtAFQAMwBMAFUARQAtAE4ATAAzAEQAQQAtAEMAQgBVAEsASAAtAEoARgA3AE0AOQA&inst=NwA3AC0ANAA0ADcAMQAzADQAOAA5ADUALQBUADQALQBGAEwAKwA5AC0AWABPADMANgArADEALQBYAE8AOQArADEA&prod=90&ver=9.0.894" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
c:\documents and settings\utilisateur\Menu D'marrer\Programmes\D'marrage\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\LMIinit]
2010-12-08 12:11	87424	----a-w-	c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\BTTray.lnk
backup=c:\windows\pss\BTTray.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AccelerometerSysTrayApplet]
2008-04-11 12:16	77672	----a-w-	c:\windows\system32\accelerometerST.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59	937920	----a-r-	c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-07 22:58	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Readereader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2009-10-19 01:12	1983816	----a-w-	c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Express Welcome]
2005-06-09 03:30	20480	----a-w-	c:\program files\IBM\Client Access\cwbwlwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Help Update]
2005-06-09 03:30	24626	----a-w-	c:\program files\IBM\Client Access\cwbinhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access PC5250 Sound]
2005-06-09 03:30	40960	----a-w-	c:\program files\IBM\Client Access\Emulator\pcssnd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Service]
2005-06-09 03:30	20530	----a-w-	c:\program files\IBM\Client Access\cwbsvstr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-13 17:34	15360	----a-w-	c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firefox]
2011-09-09 11:02	924632	----a-w-	c:\program files\Mozilla Firefox\firefox.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-06-05 08:09	170520	----a-w-	c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2008-04-18 11:53	178712	----a-w-	c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-06-05 08:09	150040	----a-w-	c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2010-01-27 10:22	63048	----a-w-	c:\program files\LogMeIn\x86\LogMeInSystray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\openvpn-gui]
2005-08-18 08:55	99328	----a-w-	c:\program files\OpenVPN\bin\openvpn-gui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-06-05 08:09	141848	----a-w-	c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-06-03 14:40	177456	----a-w-	c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
2008-03-24 11:43	884736	----a-w-	c:\program files\Analog Devices\SoundMAX\SMax4.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2008-04-04 13:09	1044480	----a-w-	c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44	248552	----a-w-	c:\program files\Fichiers communs\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2008-06-20 14:19	1310720	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2010-12-10 12:28	247144	----a-w-	c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"c:\Program Files\eMule\emule.exe"=
"c:\Program Files\TeamViewer\Version5\TeamViewer.exe"=
"c:\Program Files\UltraVNC\winvnc.exe"=
"c:\wamp\bin\apache\Apache2.2.11\bin\httpd.exe"=
"c:\hb32.exe"=
"c:\WINDOWS\system32\mmc.exe"=
"c:\Program Files\Maïdo Production\IziSpot 4\IziSpot.exe"=
"c:\Program Files\AVG\AVG10\avgmfapx.exe"=
"c:\Program Files\Skype\Phone\Skype.exe"=
"c:\Program Files\AVG\AVG10\avgdiagex.exe"=
"c:\Program Files\AVG\AVG10\avgnsx.exe"=
"c:\Program Files\AVG\AVG10\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"5800:TCP"= 5800:TCP:vnc5800
"22:TCP"= 22:TCP:SSHD
"8000:UDP"= 8000:UDP:Express Talk RTP Incoming Audio (UDP)
"8001:UDP"= 8001:UDP:Express Talk RTP Incoming Audio (UDP)
"8002:UDP"= 8002:UDP:Express Talk RTP Incoming Audio (UDP)
"8003:UDP"= 8003:UDP:Express Talk RTP Incoming Audio (UDP)
"8004:UDP"= 8004:UDP:Express Talk RTP Incoming Audio (UDP)
"8005:UDP"= 8005:UDP:Express Talk RTP Incoming Audio (UDP)
"81:TCP"= 81:TCP:Axon Virtual PBX Web Server
"4100:UDP"= 4100:UDP:uPNP Router Control Port
"8006:UDP"= 8006:UDP:Express Talk RTP Incoming Audio (UDP)
"8007:UDP"= 8007:UDP:Express Talk RTP Incoming Audio (UDP)
"8008:UDP"= 8008:UDP:Express Talk RTP Incoming Audio (UDP)
"8009:UDP"= 8009:UDP:Express Talk RTP Incoming Audio (UDP)
"5060:UDP"= 5060:UDP:Express Talk Sip Incoming Calls (UDP)
"5985:TCP"= 5985:TCP:*:Disabled:Gestion à distance de Windows 
.
R0 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [07/03/2010 19:08 160640]
R0 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [07/03/2010 19:08 5248]
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [22/02/2011 08:13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [19/01/2011 04:32 32592]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [19/12/2010 14:37 64288]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [28/03/2008 10:14 24064]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [17/05/2009 18:52 721904]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/01/2011 06:41 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [10/02/2011 07:54 297168]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [09/05/2008 16:09 1168632]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [08/02/2011 05:33 269520]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [01/10/2010 12:40 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86ainfo.sys [27/01/2010 12:22 12856]
R2 OCS INVENTORY;OCS INVENTORY SERVICE;c:\program files\OCS Inventory Agent\OcsService.exe [28/10/2009 00:37 69632]
R2 OpenSSHd;OpenSSH Server;c:\program files\OpenSSH\bin\cygrunsrv.exe [18/03/2008 12:28 68096]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [10/12/2010 14:29 92008]
R2 uvnc_service;uvnc_service;c:\program files\UltraVNC\winvnc.exe [07/10/2008 14:32 1590216]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [13/05/2008 08:30 475520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [30/03/2011 17:17 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [10/02/2011 07:53 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10/02/2011 07:53 27216]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [04/04/2007 19:16 41216]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\drivers	ap0801.sys [24/06/2004 03:54 23552]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [18/08/2011 01:33 7390560]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
S2 gupdate1cb0bdd975ae192;Service Google Update (gupdate1cb0bdd975ae192);c:\program files\Google\Update\GoogleUpdate.exe [14/06/2010 18:21 133104]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [07/10/2008 15:42 193840]
S3 gupdatem;Service Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [14/06/2010 18:21 133104]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers
pf.sys [29/06/2007 02:01 42512]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\drivers\SCR3XX2K.sys [21/06/2007 04:40 56448]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers	eamviewervpn.sys [25/01/2008 11:12 25088]
S3 TrueSight;TrueSight;c:\documents and settings\dmi\Bureau\TrueSight.sys [27/09/2011 16:10 60800]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [13/04/2008 19:34 14336]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM	REG_MULTI_SZ   	WINRM
.
Contenu du dossier 'Tâches planifiées'
.
2011-07-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2011-09-27 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-23 17:26]
.
2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-14 16:21]
.
2011-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-14 16:21]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.01net.com/
mStart Page = hxxp://www.foozir.com/
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Envoyer à Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: chrnamur.be\chrvpn
Trusted Zone: fgov.be\*.minfin
Trusted Zone: localhost
Trusted Zone: winamax.fr\www
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0C17677C-5955-430B-969C-DD06005077E0}: NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{20D93359-B78E-45FE-8D0D-7B2198E2F30B}: NameServer = 216.146.35.35,216.146.36.36
TCP: Interfaces\{B947F0E2-0709-49E4-BD00-1240DDE8A598}: NameServer = 216.146.35.35,216.146.36.36
FF - ProfilePath - c:\documents and settings\dmi\Application Data\Mozilla\Firefox\Profiles\agx015nf.default\
FF - prefs.js: browser.startup.homepage - hxxp://localhost/speedcall/interfaces/interface.php
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-27 18:28
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(1436)
c:\windows\system32\LMIinit.dll
.
- - - - - - - > 'explorer.exe'(2768)
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\progra~1\AVG\AVG10\avgchsvx.exe
c:\progra~1\AVG\AVG10\avgrsx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\System32\SCardSvr.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\oracle\ora92\bin\omtsreco.exe
c:\program files\OpenSSH\usr\sbin\sshd.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Heure de fin: 2011-09-27  18:31:43 - La machine a redémarré
ComboFix-quarantined-files.txt  2011-09-27 16:31
ComboFix2.txt  2011-09-27 15:52
.
Avant-CF: 120 984 879 104 octets libres
Après-CF: 120 968 224 768 octets libres
.
- - End Of File - - FD82EF89916E9EF027BCA14C55A6855A

juju666 · Answer

Ok.

Normalement l'infection est partie, cependant, il se peut que tu doives réinstaller les logiciels qui ne fonctionnent plus !

&#9654 Télécharge MBAM et installe le selon l'emplacement par défaut
https://www.malwarebytes.com/mwb-download/
&#9654 Effectue la mise à jour et lance Malwarebytes' Anti-Malware

&#9654 &#9654 Si tu n''arrive pas à le mettre à jour, télécharge ce fichier , ferme MBAM, et exécute le

&#9654 Clique dans l'onglet du haut "Recherche"
&#9654 Coche l'option "Exécuter un examen complet" puis sur le bouton "Rechercher"
&#9654 Choisis de scanner tous tes disques durs, puis clique sur 'Lancer l'examen"

A la fin de l'analyse, si MBAM n'a rien trouvé :

&#9654 Clique sur OK, le rapport s'ouvre spontanément

Si des menaces ont été détectées :

&#9654 Clique sur OK puis "Afficher les résultats"
&#9654 Choisis l'option "Supprimer la sélection"
&#9654 Si MBAM demande le redémarrage de Windows : Clique sur "Oui"
&#9654 Une fois le PC redémarré, le rapport se trouve dans l'onglet "Rapports/Logs"
&#9654 Sinon le rapport s'ouvre automatiquement après la suppression

Quelque soit le résultat, copie/colle le rapport dans le prochain message

dubitoph · Answer

Après pas mal de temps dû au scan, voici le rapport de MBAM :  

Malwarebytes' Anti-Malware 1.51.2.1300 
www.malwarebytes.org 

Version de la base de données: 7809 

Windows 5.1.2600 Service Pack 3 
Internet Explorer 7.0.5730.13 

27/09/2011 19:59:08 
mbam-log-2011-09-27 (19-58-54).txt 

Type d'examen: Examen complet (C:\|) 
Elément(s) analysé(s): 311337 
Temps écoulé: 1 heure(s), 13 minute(s), 1 seconde(s) 

Processus mémoire infecté(s): 0 
Module(s) mémoire infecté(s): 0 
Clé(s) du Registre infectée(s): 1 
Valeur(s) du Registre infectée(s): 0 
Elément(s) de données du Registre infecté(s): 0 
Dossier(s) infecté(s): 0 
Fichier(s) infecté(s): 16 

Processus mémoire infecté(s): 
(Aucun élément nuisible détecté) 

Module(s) mémoire infecté(s): 
(Aucun élément nuisible détecté) 

Clé(s) du Registre infectée(s): 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker (PUP.Casino) -> No action taken. 

Valeur(s) du Registre infectée(s): 
(Aucun élément nuisible détecté) 

Elément(s) de données du Registre infecté(s): 
(Aucun élément nuisible détecté) 

Dossier(s) infecté(s): 
(Aucun élément nuisible détecté) 

Fichier(s) infecté(s): 
c:\documents and settings\dmi\local settings\application data\assembly\dl3\KEM54HX4.TTQ\XZT13H87.R7G\368f3cec\00d34a37_f353cb01\Utils.DLL (Adware.InstallPedia) -> No action taken. 
c:\documents and settings\dmi\local settings\application data\assembly\dl3\KEM54HX4.TTQ\XZT13H87.R7G\e1d5f1b9\00a61936_f353cb01
etworker.exe (Adware.InstallPedia) -> No action taken. 
c:\Poker	itan poker\_titanpsetup_6995c0[1].exe (PUP.Casino) -> No action taken. 
c:\program files\Cain\Abel.exe (HackTool.Cain) -> No action taken. 
c:\program files\Cain\Cain.exe (PUP.Passwordtool.Cain) -> No action taken. 
c:\Qoobox\quarantine\C\documents and settings\dmi\gob.exe.vir (Backdoor.Bot) -> No action taken. 
c:\Qoobox\quarantine\C\program files\installpedia\lnetworker.exe.vir (Adware.InstallPedia) -> No action taken. 
c:\Qoobox\quarantine\C\program files\installpedia\service.exe.vir (Adware.InstallPedia) -> No action taken. 
c:\Qoobox\quarantine\C\program files\installpedia\utils.dll.vir (Adware.InstallPedia) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP427\A0101085.exe (Backdoor.Bot) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP427\A0102089.exe (Adware.InstallPedia) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104449.exe (Backdoor.Bot) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104453.exe (Adware.InstallPedia) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104455.exe (Adware.InstallPedia) -> No action taken. 
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104456.dll (Adware.InstallPedia) -> No action taken. 
c:\WINDOWS\system32\Utils.dll (Adware.InstallPedia) -> No action taken.

dubitoph · Answer

AVG, lui, pendant ce temps, m'a affiché deux menaces : 

"c:\Documents and Settings\dmi\Local Settings\Application Data\assembly\dl3\KEM54HX4.TTQ\XZT13H87.R7G\e1d5f1b9\00a61936_f353cb01
etworker.EXE";"Adware Generic4.BSEA";"Objet potentiellement dangereux"
"c:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP427\A0102089.exe";"Adware Generic4.BSEA";"Objet potentiellement dangereux"

juju666 · Answer

No action taken. 

As-tu bien Supprimé la sélection ? 
Si non, il faut recommencer le scan !

~~

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.
Lance le, clique sur [Suppression] puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

dubitoph · Answer

Raaaaa... J'ai la tête ailleurs... Je n'avais pas lu que tu désirais le rapport après suppression. Je vais donc supprimer puis t'envoyer le rapport.

dubitoph · Answer

Voici donc le rapport, avant redémarrage de la machine. Je vais la redémarré comme voulu par MBAM puis effectuerai la manoeuvre avec AdwCleaner.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 7809

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

27/09/2011 20:20:30
mbam-log-2011-09-27 (20-20-30).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 311337
Temps écoulé: 1 heure(s), 13 minute(s), 1 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 16

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker (PUP.Casino) -> Not selected for removal.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\documents and settings\dmi\local settings\application data\assembly\dl3\KEM54HX4.TTQ\XZT13H87.R7G\368f3cec\00d34a37_f353cb01\Utils.DLL (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\documents and settings\dmi\local settings\application data\assembly\dl3\KEM54HX4.TTQ\XZT13H87.R7G\e1d5f1b9\00a61936_f353cb01
etworker.exe (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\Poker	itan poker\_titanpsetup_6995c0[1].exe (PUP.Casino) -> Not selected for removal.
c:\program files\Cain\Abel.exe (HackTool.Cain) -> Quarantined and deleted successfully.
c:\program files\Cain\Cain.exe (PUP.Passwordtool.Cain) -> Not selected for removal.
c:\Qoobox\quarantine\C\documents and settings\dmi\gob.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\program files\installpedia\lnetworker.exe.vir (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\program files\installpedia\service.exe.vir (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\program files\installpedia\utils.dll.vir (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP427\A0101085.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP427\A0102089.exe (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104449.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104453.exe (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104455.exe (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104456.dll (Adware.InstallPedia) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\Utils.dll (Adware.InstallPedia) -> Quarantined and deleted successfully.

juju666 · Answer

Ah c'est tout de suite mieux :)

dubitoph · Answer

Voici donc le rapport de AdwCleaner : 

# AdwCleaner v1.308 - Rapport créé le 27/09/2011 à 20:30:27
# Mis à jour le 25/09/11 à 17h par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : dmi - CHR (Administrateur)
# Exécuté depuis : C:\Documents and Settings\dmi\Bureau\adwcleaner.exe
# Option [Suppression]


***** [KillNav] *****

Aucun navigateur n'était en cours d'exécution.

***** [Processus] *****


***** [Services] *****


***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\Documents and Settings\dmi\Application Data\Search Settings

***** [Registre] *****

Clé Supprimée : HKCU\Software\Search Settings
Clé Supprimée : HKLM\SOFTWARE\Application Updater
Clé Supprimée : HKLM\SOFTWARE\InstallPedia
Clé Supprimée : HKLM\SOFTWARE\Search Settings
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.DllInfo
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDF
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFEncryptor
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFLine
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFText
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.Tools

***** [Navigateurs] *****

-\ Internet Explorer v7.0.5730.13

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v6.0.2 (fr)

Profil : agx015nf.default
Fichier : C:\Documents and Settings\dmi\Application Data\Mozilla\Firefox\Profiles\agx015nf.default\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[S1].txt - [1534 octets] - [27/09/2011 20:30:27]

*************************

Dossier Temporaire : 1 dossier(s) et 2 fichier(s) supprimé(s)

########## EOF - C:\AdwCleaner[S1].txt - [1756 octets] ##########

juju666 · Answer

Bien :)

On enchaîne :

&#9654  Télécharge AD-Remover sur ton Bureau : (TeamXScript) 

http://www.teamxscript.org/adremoverTelechargement.html ( Lien officiel ) 
OU 
https://www.androidworld.fr/ ( Miroir ) 

/!\ Ferme toutes applications en cours /!\ 

&#9654 Double-clique sur l'icône Ad-remover située sur ton Bureau. 
&#9654 Sur la page, clique sur le bouton « Scanner » 
&#9654 Confirme le lancement du scan 
&#9654 Laisse travailler l'outil. 
&#9654 Quand il a fini, un rapport s'ouvrira : ferme le.

&#9830 Pour me transmettre le rapport

clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Ad-Report-SCAN[1].txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

dubitoph · Answer

Merci beaucoup pour on investissement. Voici le lien demandé : 

http://www.cijoint.fr/cjlink.php?file=cj201109/cijf0jgnCi.txt

juju666 · Answer

Tu as du te tromper entre AdwCleaner  (utilisé vers 20h30) et AD-Remover (dernière procédure demandée) :)

dubitoph · Answer

J'ai recommencé la procédure, et voici donc le fichier : http://www.cijoint.fr/cjlink.php?file=cj201109/cijclVbirl.txt

juju666 · Answer

Parfait :)

On va passer un scan généraliste, et moi, je vais me coucher ;)
Donc je te souhaite d'ores et déjà bonne nuit ;)

&#9654 Télécharge MBAM et installe le selon l'emplacement par défaut
https://www.malwarebytes.com/mwb-download/
&#9654 Effectue la mise à jour et lance Malwarebytes' Anti-Malware

&#9654 &#9654 Si tu n''arrive pas à le mettre à jour, télécharge ce fichier , ferme MBAM, et exécute le

&#9654 Clique dans l'onglet du haut "Recherche"
&#9654 Coche l'option "Exécuter un examen complet" puis sur le bouton "Rechercher"
&#9654 Choisis de scanner tous tes disques durs, puis clique sur 'Lancer l'examen"

A la fin de l'analyse, si MBAM n'a rien trouvé :

&#9654 Clique sur OK, le rapport s'ouvre spontanément

Si des menaces ont été détectées :

&#9654 Clique sur OK puis "Afficher les résultats"
&#9654 Choisis l'option "Supprimer la sélection"
&#9654 Si MBAM demande le redémarrage de Windows : Clique sur "Oui"
&#9654 Une fois le PC redémarré, le rapport se trouve dans l'onglet "Rapports/Logs"
&#9654 Sinon le rapport s'ouvre automatiquement après la suppression

Quelque soit le résultat, copie/colle le rapport dans le prochain message

dubitoph · Answer

Bonjour,

Du fait que je m'étais à nouveau planté dans la procédure, j'ai du la recommencer deux fois...

Voici donc le rapport demandé : 

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Version de la base de données: 7809

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

28/09/2011 12:06:27
mbam-log-2011-09-28 (12-06-27).txt

Type d'examen: Examen complet (C:\|)
Elément(s) analysé(s): 311570
Temps écoulé: 47 minute(s), 48 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104786.exe (PUP.Casino) -> Quarantined and deleted successfully.
c:\system volume information\_restore{71a8f647-2a41-41a1-8a12-1ed46db6d989}\RP430\A0104833.exe (PUP.Passwordtool.Cain) -> Quarantined and deleted successfully.

juju666 · Answer

Salut :)

Nous allons effectuer un diagnostic de ton PC: 
&#9654 Télécharge ZHPDiag 

&#9654 Laisse toi guider lors de l''installation,coche "Ajouter une icône sur le bureau" et  "Exécuter ZHPDiag" 

&#9654 Clique sur l''icône représentant une loupe (« Lancer le diagnostic ») 

&#9654 Une fois le scan aux 100%, ferme ZHPDiag. Héberge le rapport ZHPDiag.txt présent sur ton bureau :

Voici comment procéder

&#9654 Rends toi sur pjjoint.malekal.com 
&#9654 Clique sur le bouton Parcourir 
&#9654 Sélectionne le fichier que tu veux heberger et clique sur Ouvrir 
&#9654 Clique sur le bouton Envoyer 
&#9654 Un message de confirmation s''affiche (L''upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015 Copie le lien dans ta prochaine réponse. 

A bientôt.

dubitoph · Answer

Re-bonjour,

Voici le lien obtenu suite à la procédure demandée : 

https://pjjoint.malekal.com/files.php?id=ZHPDiag_d7f14f5h5i15s12b8v14e7y14h12l7s11i10b5d15j14m11j14v14

juju666 · Answer

Il y a présence d'un rootkit TDSS !

&#9654 Télécharge Reload_TDSSKiller  

&#9654 Lance le   

choisis : lancer le nettoyage  

l'outil va automatiquement télécharger la derniere version puis   

TDSSKiller va s'ouvrir , clique sur "Start Scan"  Clique ici pour l'aide en image  

Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut.   
Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée.   
Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée.   
Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas  
Si Suspicious file est indiqué, laisse l''option cochée sur Skip    
une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer  

sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau  

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

dubitoph · Answer

Salut,

Apparemment, pas de Rootkit détecté par ce logiciel. Voici le rapport : 

15:29:32.0890 3384	TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
15:29:33.0062 3384	============================================================
15:29:33.0062 3384	Current date / time: 2011/09/28 15:29:33.0062
15:29:33.0062 3384	SystemInfo:
15:29:33.0062 3384	
15:29:33.0062 3384	OS Version: 5.1.2600 ServicePack: 3.0
15:29:33.0062 3384	Product type: Workstation
15:29:33.0062 3384	ComputerName: CHR
15:29:33.0062 3384	UserName: dmi
15:29:33.0062 3384	Windows directory: C:\WINDOWS
15:29:33.0062 3384	System windows directory: C:\WINDOWS
15:29:33.0062 3384	Processor architecture: Intel x86
15:29:33.0062 3384	Number of processors: 2
15:29:33.0062 3384	Page size: 0x1000
15:29:33.0062 3384	Boot type: Normal boot
15:29:33.0062 3384	============================================================
15:29:33.0281 3384	Initialize success
15:29:50.0859 3944	============================================================
15:29:50.0859 3944	Scan started
15:29:50.0859 3944	Mode: Manual; 
15:29:50.0859 3944	============================================================
15:29:51.0250 3944	a347bus         (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
15:29:51.0250 3944	a347bus - ok
15:29:51.0265 3944	a347scsi        (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
15:29:51.0265 3944	a347scsi - ok
15:29:51.0296 3944	Abiosdsk - ok
15:29:51.0312 3944	abp480n5 - ok
15:29:51.0375 3944	Accelerometer   (6c2e405d98e6342a9d66a2493e7ab15e) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
15:29:51.0375 3944	Accelerometer - ok
15:29:51.0453 3944	ACPI            (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
15:29:51.0453 3944	ACPI - ok
15:29:51.0500 3944	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
15:29:51.0515 3944	ACPIEC - ok
15:29:51.0640 3944	ADIHdAudAddService (ff60db2aca88543c025eacba25cee5c1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
15:29:51.0656 3944	ADIHdAudAddService - ok
15:29:51.0718 3944	adpu160m - ok
15:29:51.0765 3944	AEAudio         (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
15:29:51.0765 3944	AEAudio - ok
15:29:51.0828 3944	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
15:29:51.0843 3944	aec - ok
15:29:51.0921 3944	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
15:29:51.0921 3944	AFD - ok
15:29:52.0062 3944	AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
15:29:52.0078 3944	AgereSoftModem - ok
15:29:52.0156 3944	Aha154x - ok
15:29:52.0187 3944	aic78u2 - ok
15:29:52.0250 3944	aic78xx - ok
15:29:52.0328 3944	AliIde - ok
15:29:52.0359 3944	amsint - ok
15:29:52.0437 3944	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
15:29:52.0437 3944	Arp1394 - ok
15:29:52.0468 3944	asc - ok
15:29:52.0484 3944	asc3350p - ok
15:29:52.0562 3944	asc3550 - ok
15:29:52.0640 3944	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
15:29:52.0640 3944	AsyncMac - ok
15:29:52.0687 3944	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
15:29:52.0687 3944	atapi - ok
15:29:52.0718 3944	Atdisk - ok
15:29:52.0781 3944	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
15:29:52.0781 3944	Atmarpc - ok
15:29:52.0875 3944	ATSwpWDF        (a9f9d1d24441889beb1aa2b917457e23) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
15:29:52.0890 3944	ATSwpWDF - ok
15:29:53.0000 3944	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
15:29:53.0000 3944	audstub - ok
15:29:53.0093 3944	AVGIDSDriver    (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
15:29:53.0093 3944	AVGIDSDriver - ok
15:29:53.0203 3944	AVGIDSEH        (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
15:29:53.0203 3944	AVGIDSEH - ok
15:29:53.0250 3944	AVGIDSFilter    (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
15:29:53.0250 3944	AVGIDSFilter - ok
15:29:53.0359 3944	AVGIDSShim      (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
15:29:53.0359 3944	AVGIDSShim - ok
15:29:53.0437 3944	Avgldx86        (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
15:29:53.0437 3944	Avgldx86 - ok
15:29:53.0500 3944	Avgmfx86        (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
15:29:53.0515 3944	Avgmfx86 - ok
15:29:53.0546 3944	Avgrkx86        (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
15:29:53.0546 3944	Avgrkx86 - ok
15:29:53.0593 3944	Avgtdix         (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
15:29:53.0593 3944	Avgtdix - ok
15:29:53.0656 3944	b57w2k          (ea377a8e8e1000877210259750cbbf5f) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
15:29:53.0656 3944	b57w2k - ok
15:29:53.0718 3944	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
15:29:53.0718 3944	Beep - ok
15:29:53.0812 3944	BTKRNL          (ef5e0de0a7ca2977a9255f36f4d915ab) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
15:29:53.0828 3944	BTKRNL - ok
15:29:53.0859 3944	BTWUSB          (053dc5be74621b63bb48c2b86bafc7b0) C:\WINDOWS\system32\Drivers\btwusb.sys
15:29:53.0859 3944	BTWUSB - ok
15:29:53.0859 3944	catchme - ok
15:29:53.0968 3944	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
15:29:53.0968 3944	cbidf2k - ok
15:29:54.0031 3944	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
15:29:54.0031 3944	CCDECODE - ok
15:29:54.0062 3944	cd20xrnt - ok
15:29:54.0140 3944	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
15:29:54.0140 3944	Cdaudio - ok
15:29:54.0234 3944	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
15:29:54.0234 3944	Cdfs - ok
15:29:54.0281 3944	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
15:29:54.0296 3944	Cdrom - ok
15:29:54.0343 3944	Changer - ok
15:29:54.0375 3944	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
15:29:54.0375 3944	CmBatt - ok
15:29:54.0390 3944	CmdIde - ok
15:29:54.0406 3944	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
15:29:54.0406 3944	Compbatt - ok
15:29:54.0437 3944	Cpqarray - ok
15:29:54.0546 3944	CrystalSysInfo  (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
15:29:54.0546 3944	CrystalSysInfo - ok
15:29:54.0593 3944	dac2w2k - ok
15:29:54.0609 3944	dac960nt - ok
15:29:54.0625 3944	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
15:29:54.0640 3944	Disk - ok
15:29:54.0703 3944	dmboot          (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
15:29:54.0703 3944	dmboot - ok
15:29:54.0718 3944	dmio            (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
15:29:54.0734 3944	dmio - ok
15:29:54.0750 3944	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
15:29:54.0750 3944	dmload - ok
15:29:54.0828 3944	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
15:29:54.0843 3944	DMusic - ok
15:29:54.0875 3944	dpti2o - ok
15:29:54.0906 3944	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
15:29:54.0906 3944	drmkaud - ok
15:29:55.0015 3944	dsNcAdpt        (b2c3f71b86e25c3df78339ddb40a7562) C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
15:29:55.0015 3944	dsNcAdpt - ok
15:29:55.0109 3944	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
15:29:55.0109 3944	Fastfat - ok
15:29:55.0171 3944	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
15:29:55.0171 3944	Fdc - ok
15:29:55.0250 3944	Fips            (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
15:29:55.0250 3944	Fips - ok
15:29:55.0296 3944	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
15:29:55.0296 3944	Flpydisk - ok
15:29:55.0406 3944	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
15:29:55.0406 3944	FltMgr - ok
15:29:55.0453 3944	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
15:29:55.0453 3944	Fs_Rec - ok
15:29:55.0500 3944	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
15:29:55.0500 3944	Ftdisk - ok
15:29:55.0578 3944	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
15:29:55.0578 3944	Gpc - ok
15:29:55.0687 3944	HBtnKey         (407e41ddb2bfece109132aec296e0d98) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
15:29:55.0687 3944	HBtnKey - ok
15:29:55.0781 3944	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
15:29:55.0781 3944	HDAudBus - ok
15:29:55.0828 3944	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
15:29:55.0828 3944	HidUsb - ok
15:29:55.0890 3944	hpdskflt        (e8a95df23097bca840814d42f2ee5164) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
15:29:55.0906 3944	hpdskflt - ok
15:29:55.0937 3944	hpn - ok
15:29:56.0031 3944	HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
15:29:56.0031 3944	HpqKbFiltr - ok
15:29:56.0171 3944	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
15:29:56.0171 3944	HTTP - ok
15:29:56.0203 3944	i2omgmt - ok
15:29:56.0218 3944	i2omp - ok
15:29:56.0265 3944	i8042prt        (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
15:29:56.0265 3944	i8042prt - ok
15:29:56.0578 3944	ialm            (f592a1b020723cfbd3d2722514066449) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
15:29:56.0656 3944	ialm - ok
15:29:56.0765 3944	iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\DRIVERS\iaStor.sys
15:29:56.0765 3944	iaStor - ok
15:29:56.0828 3944	IFXTPM          (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
15:29:56.0828 3944	IFXTPM - ok
15:29:56.0890 3944	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
15:29:56.0890 3944	Imapi - ok
15:29:56.0937 3944	ini910u - ok
15:29:56.0953 3944	IntelIde - ok
15:29:56.0984 3944	intelppm        (ad340800c35a42d4de1641a37feea34c) C:\WINDOWS\system32\DRIVERS\intelppm.sys
15:29:56.0984 3944	intelppm - ok
15:29:57.0015 3944	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
15:29:57.0015 3944	Ip6Fw - ok
15:29:57.0046 3944	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
15:29:57.0062 3944	IpFilterDriver - ok
15:29:57.0078 3944	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
15:29:57.0078 3944	IpInIp - ok
15:29:57.0109 3944	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
15:29:57.0109 3944	IpNat - ok
15:29:57.0140 3944	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
15:29:57.0140 3944	IPSec - ok
15:29:57.0203 3944	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
15:29:57.0203 3944	IRENUM - ok
15:29:57.0328 3944	isapnp          (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
15:29:57.0328 3944	isapnp - ok
15:29:57.0406 3944	Kbdclass        (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
15:29:57.0406 3944	Kbdclass - ok
15:29:57.0515 3944	kbdhid          (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
15:29:57.0531 3944	kbdhid - ok
15:29:57.0578 3944	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
15:29:57.0593 3944	kmixer - ok
15:29:57.0640 3944	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
15:29:57.0640 3944	KSecDD - ok
15:29:57.0750 3944	Lbd             (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys
15:29:57.0750 3944	Lbd - ok
15:29:57.0781 3944	lbrtfdc - ok
15:29:57.0921 3944	LMIInfo         (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
15:29:57.0921 3944	LMIInfo - ok
15:29:57.0984 3944	lmimirr         (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
15:29:57.0984 3944	lmimirr - ok
15:29:58.0015 3944	LMIRfsClientNP - ok
15:29:58.0031 3944	LMIRfsDriver    (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
15:29:58.0031 3944	LMIRfsDriver - ok
15:29:58.0187 3944	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
15:29:58.0187 3944	mnmdd - ok
15:29:58.0281 3944	Modem           (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
15:29:58.0281 3944	Modem - ok
15:29:58.0343 3944	Mouclass        (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
15:29:58.0359 3944	Mouclass - ok
15:29:58.0421 3944	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
15:29:58.0421 3944	mouhid - ok
15:29:58.0531 3944	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
15:29:58.0531 3944	MountMgr - ok
15:29:58.0562 3944	mraid35x - ok
15:29:58.0609 3944	MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
15:29:58.0609 3944	MRxDAV - ok
15:29:58.0703 3944	MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
15:29:58.0734 3944	MRxSmb - ok
15:29:58.0796 3944	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
15:29:58.0796 3944	Msfs - ok
15:29:58.0937 3944	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
15:29:58.0937 3944	MSKSSRV - ok
15:29:59.0000 3944	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
15:29:59.0000 3944	MSPCLOCK - ok
15:29:59.0078 3944	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
15:29:59.0078 3944	MSPQM - ok
15:29:59.0140 3944	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
15:29:59.0140 3944	mssmbios - ok
15:29:59.0187 3944	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
15:29:59.0187 3944	MSTEE - ok
15:29:59.0328 3944	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
15:29:59.0328 3944	Mup - ok
15:29:59.0390 3944	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
15:29:59.0390 3944	NABTSFEC - ok
15:29:59.0468 3944	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
15:29:59.0484 3944	NDIS - ok
15:29:59.0531 3944	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
15:29:59.0531 3944	NdisIP - ok
15:29:59.0609 3944	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys
15:29:59.0609 3944	NdisTapi - ok
15:29:59.0640 3944	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys
15:29:59.0640 3944	Ndisuio - ok
15:29:59.0765 3944	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys
15:29:59.0765 3944	NdisWan - ok
15:29:59.0828 3944	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
15:29:59.0843 3944	NDProxy - ok
15:29:59.0906 3944	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys
15:29:59.0906 3944	NetBIOS - ok
15:29:59.0968 3944	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys
15:29:59.0968 3944	NetBT - ok
15:30:00.0171 3944	NETw5x32        (05743fffc2bc88cc8e426321bc6a762e) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
15:30:00.0218 3944	NETw5x32 - ok
15:30:00.0312 3944	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS
ic1394.sys
15:30:00.0328 3944	NIC1394 - ok
15:30:00.0390 3944	nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
15:30:00.0390 3944	nm - ok
15:30:00.0468 3944	NPF             (243126da7ba441d7c7c3262dcf435a9c) C:\WINDOWS\system32\drivers
pf.sys
15:30:00.0468 3944	NPF - ok
15:30:00.0531 3944	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
15:30:00.0531 3944	Npfs - ok
15:30:00.0593 3944	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
15:30:00.0609 3944	Ntfs - ok
15:30:00.0671 3944	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
15:30:00.0671 3944	Null - ok
15:30:00.0765 3944	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
15:30:00.0765 3944	NwlnkFlt - ok
15:30:00.0843 3944	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
15:30:00.0843 3944	NwlnkFwd - ok
15:30:00.0906 3944	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
15:30:00.0906 3944	ohci1394 - ok
15:30:00.0984 3944	Parport         (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
15:30:00.0984 3944	Parport - ok
15:30:01.0000 3944	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
15:30:01.0000 3944	PartMgr - ok
15:30:01.0046 3944	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
15:30:01.0046 3944	ParVdm - ok
15:30:01.0125 3944	PCI             (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
15:30:01.0125 3944	PCI - ok
15:30:01.0171 3944	PCIDump - ok
15:30:01.0234 3944	PCIIde - ok
15:30:01.0296 3944	Pcmcia          (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
15:30:01.0312 3944	Pcmcia - ok
15:30:01.0343 3944	PDCOMP - ok
15:30:01.0375 3944	PDFRAME - ok
15:30:01.0390 3944	PDRELI - ok
15:30:01.0406 3944	PDRFRAME - ok
15:30:01.0453 3944	perc2 - ok
15:30:01.0515 3944	perc2hib - ok
15:30:01.0609 3944	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys
15:30:01.0625 3944	PptpMiniport - ok
15:30:01.0640 3944	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
15:30:01.0656 3944	PSched - ok
15:30:01.0703 3944	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
15:30:01.0703 3944	Ptilink - ok
15:30:01.0734 3944	ql1080 - ok
15:30:01.0765 3944	Ql10wnt - ok
15:30:01.0796 3944	ql12160 - ok
15:30:01.0828 3944	ql1240 - ok
15:30:01.0859 3944	ql1280 - ok
15:30:01.0937 3944	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
15:30:01.0937 3944	RasAcd - ok
15:30:02.0046 3944	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys
15:30:02.0046 3944	Rasl2tp - ok
15:30:02.0078 3944	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys
15:30:02.0078 3944	RasPppoe - ok
15:30:02.0156 3944	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
15:30:02.0156 3944	Raspti - ok
15:30:02.0187 3944	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys
15:30:02.0187 3944	Rdbss - ok
15:30:02.0250 3944	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
15:30:02.0250 3944	RDPCDD - ok
15:30:02.0343 3944	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys
15:30:02.0359 3944	rdpdr - ok
15:30:02.0437 3944	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
15:30:02.0453 3944	RDPWD - ok
15:30:02.0515 3944	redbook         (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERSedbook.sys
15:30:02.0515 3944	redbook - ok
15:30:02.0609 3944	SCR3XX2K        (fc87d5e0328afa97bf6d39df96d5d356) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys
15:30:02.0609 3944	SCR3XX2K - ok
15:30:02.0687 3944	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
15:30:02.0687 3944	Secdrv - ok
15:30:02.0781 3944	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
15:30:02.0781 3944	serenum - ok
15:30:02.0812 3944	Serial          (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
15:30:02.0812 3944	Serial - ok
15:30:02.0937 3944	SFAUDIO         (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
15:30:02.0937 3944	SFAUDIO - ok
15:30:02.0984 3944	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
15:30:03.0000 3944	Sfloppy - ok
15:30:03.0031 3944	Simbad - ok
15:30:03.0078 3944	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
15:30:03.0093 3944	SLIP - ok
15:30:03.0250 3944	SNP2UVC         (cf9cde12fbc19dba8de528b7511a2f4f) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
15:30:03.0281 3944	SNP2UVC - ok
15:30:03.0312 3944	Sparrow - ok
15:30:03.0375 3944	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
15:30:03.0375 3944	splitter - ok
15:30:03.0500 3944	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
15:30:03.0500 3944	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
15:30:03.0500 3944	sptd ( LockedFile.Multi.Generic ) - warning
15:30:03.0500 3944	sptd - detected LockedFile.Multi.Generic (1)
15:30:03.0531 3944	sr              (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
15:30:03.0531 3944	sr - ok
15:30:03.0593 3944	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
15:30:03.0656 3944	Srv - ok
15:30:03.0750 3944	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
15:30:03.0750 3944	streamip - ok
15:30:03.0828 3944	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
15:30:03.0828 3944	swenum - ok
15:30:03.0906 3944	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
15:30:03.0921 3944	swmidi - ok
15:30:03.0937 3944	symc810 - ok
15:30:03.0937 3944	symc8xx - ok
15:30:03.0953 3944	sym_hi - ok
15:30:03.0968 3944	sym_u3 - ok
15:30:04.0046 3944	SynTP           (f08667f79bbd339547f477c75c3ed0b9) C:\WINDOWS\system32\DRIVERS\SynTP.sys
15:30:04.0046 3944	SynTP - ok
15:30:04.0109 3944	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
15:30:04.0109 3944	sysaudio - ok
15:30:04.0218 3944	tap0801         (846b7c0e3f6370cdcce157a5b36e70cd) C:\WINDOWS\system32\DRIVERS	ap0801.sys
15:30:04.0218 3944	tap0801 - ok
15:30:04.0312 3944	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys
15:30:04.0328 3944	Tcpip - ok
15:30:04.0359 3944	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
15:30:04.0375 3944	TDPIPE - ok
15:30:04.0406 3944	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
15:30:04.0406 3944	TDTCP - ok
15:30:04.0453 3944	teamviewervpn   (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS	eamviewervpn.sys
15:30:04.0453 3944	teamviewervpn - ok
15:30:04.0500 3944	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS	ermdd.sys
15:30:04.0500 3944	TermDD - ok
15:30:04.0562 3944	tmcomm          (eb2283c0a4dfbd2e53d14f2c4d5a1e89) C:\WINDOWS\system32\drivers	mcomm.sys
15:30:04.0562 3944	tmcomm - ok
15:30:04.0625 3944	TosIde - ok
15:30:04.0796 3944	TrueSight       (ddbf8e194041469f26fc6cbc8264beb0) C:\Documents and Settings\dmi\Bureau\TrueSight.sys
15:30:04.0812 3944	TrueSight - ok
15:30:04.0890 3944	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
15:30:04.0906 3944	Udfs - ok
15:30:04.0906 3944	ultra - ok
15:30:04.0968 3944	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
15:30:05.0000 3944	Update - ok
15:30:05.0078 3944	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
15:30:05.0078 3944	usbccgp - ok
15:30:05.0125 3944	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
15:30:05.0125 3944	usbehci - ok
15:30:05.0140 3944	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
15:30:05.0140 3944	usbhub - ok
15:30:05.0187 3944	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
15:30:05.0187 3944	usbprint - ok
15:30:05.0265 3944	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
15:30:05.0281 3944	usbscan - ok
15:30:05.0296 3944	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
15:30:05.0296 3944	USBSTOR - ok
15:30:05.0312 3944	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
15:30:05.0312 3944	usbuhci - ok
15:30:05.0343 3944	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
15:30:05.0343 3944	usbvideo - ok
15:30:05.0437 3944	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
15:30:05.0453 3944	VgaSave - ok
15:30:05.0453 3944	ViaIde - ok
15:30:05.0484 3944	VolSnap         (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
15:30:05.0484 3944	VolSnap - ok
15:30:05.0531 3944	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
15:30:05.0531 3944	Wanarp - ok
15:30:05.0609 3944	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
15:30:05.0609 3944	Wdf01000 - ok
15:30:05.0671 3944	WDICA - ok
15:30:05.0718 3944	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
15:30:05.0718 3944	wdmaud - ok
15:30:05.0796 3944	WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
15:30:05.0812 3944	WmiAcpi - ok
15:30:05.0875 3944	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
15:30:05.0875 3944	WSTCODEC - ok
15:30:05.0984 3944	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
15:30:05.0984 3944	WudfPf - ok
15:30:06.0046 3944	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
15:30:06.0046 3944	WudfRd - ok
15:30:06.0093 3944	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
15:30:06.0281 3944	\Device\Harddisk0\DR0 - ok
15:30:06.0281 3944	Boot (0x1200)   (7c8d0dcb31f179aff5003f6445918649) \Device\Harddisk0\DR0\Partition0
15:30:06.0281 3944	\Device\Harddisk0\DR0\Partition0 - ok
15:30:06.0281 3944	============================================================
15:30:06.0281 3944	Scan finished
15:30:06.0281 3944	============================================================
15:30:06.0296 3236	Detected object count: 1
15:30:06.0296 3236	Actual detected object count: 1
15:30:46.0875 3236	sptd ( LockedFile.Multi.Generic ) - skipped by user
15:30:46.0875 3236	sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
15:31:01.0062 3524	Deinitialize success

juju666 · Answer

Étrange ....

Sur ton bureau il y a l'icône de MBRCheck, lance-le, et poste le rapport qui en résulte (il sera également sur ton bureau, au nom MRCheck_Version_Date_Heure.txt)

dubitoph · Answer

J'ai lancé MBRCheck, mais j'ai le message suivant qui s'affiche : 

Done!
Press ENTER to exit...

Et rien ne se passe.

Evidemment, si je presse ENTER, l'application se ferme.

dubitoph · Answer

Oui.

J'ai regarder sur le C:, et il ne s'y trouve pas.

J'ai fait un clic droit dessus et fait exécuter en tant que, et il plantait avec un message d'erreur.

J'ai fait un clic droit dessus et fait exécuter en tant que et ai décocher la case "Protéger mon ordinateur...", et là il me refait ce que je t'ai décrit avant.

juju666 · Answer

&#9654 &#9654 Désactive tes protections 
&#9654 Télécharge ici : MBR_Repair (par gen-hackman)
&#9654 Enregistre-le sur ton bureau , 
&#9654 Lance-le , choisis "Verify" 

MBR_Verify.txt se mettra sur ton bureau, poste ici son contenu

dubitoph · Answer

Désolé,

Malgré le message, MBRCheck avait déposé un ficher sur le bureau. Voici, ci-après, le dernier. Je posterai ensuite le rapport de MBRVerify.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows XP Professional
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x0000000c

Kernel Drivers (total 157):
  0x804D7000 \WINDOWS\system32
tkrnlpa.exe
  0x806E5000 \WINDOWS\system32\hal.dll
  0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
  0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
  0xBA0A8000 gfsb.sys
  0xB9EA6000 spzk.sys
  0xBA5AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
  0xB9E8E000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
  0xB9E66000 a347bus.sys
  0xB9E37000 ACPI.sys
  0xB9E26000 pci.sys
  0xBA0B8000 ohci1394.sys
  0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xBA0D8000 isapnp.sys
  0xBA4BC000 compbatt.sys
  0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xBA0E8000 MountMgr.sys
  0xB9E07000 ftdisk.sys
  0xBA5AC000 dmload.sys
  0xB9DE1000 dmio.sys
  0xBA328000 PartMgr.sys
  0xBA4C4000 ACPIEC.sys
  0xBA670000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xBA0F8000 VolSnap.sys
  0xB9D13000 iaStor.sys
  0xBA108000 disk.sys
  0xBA118000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB9CF3000 fltMgr.sys
  0xB9CE1000 sr.sys
  0xBA128000 Lbd.sys
  0xB9CCA000 KSecDD.sys
  0xB9C3D000 Ntfs.sys
  0xB9C10000 NDIS.sys
  0xBA138000 sfaudio.sys
  0xB9BF6000 Mup.sys
  0xBA330000 hpdskflt.sys
  0xBA338000 avgrkx86.sys
  0xBA4C8000 AVGIDSEH.Sys
  0xBA1F8000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB7B49000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
  0xB7B35000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xBA448000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0xB7B11000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA450000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xB7AE9000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xB7771000 \SystemRoot\system32\DRIVERS\NETw5x32.sys
  0xBA208000 \SystemRoot\system32\DRIVERS
ic1394.sys
  0xBA218000 \SystemRoot\system32\DRIVERS\IFXTPM.SYS
  0xB772E000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB9BC2000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xB771A000 \SystemRoot\system32\DRIVERS\parport.sys
  0xBA228000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA458000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
  0xB9317000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
  0xB769F000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
  0xBA460000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xB7667000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xBA5E4000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xBA468000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xB9307000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xB92F7000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xB92E7000 \SystemRoot\system32\DRIVERSedbook.sys
  0xB7644000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA470000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
  0xB9BAE000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xB9BAA000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
  0xB92D7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0xBA478000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xB9BA6000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0xB7573000 \SystemRoot\system32\DRIVERS\btkrnl.sys
  0xBA6AC000 \SystemRoot\system32\DRIVERS\lmimirr.sys
  0xB92C7000 \SystemRoot\system32\DRIVERS\dsNcAdpt.sys
  0xBA6AD000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xB92B7000 \SystemRoot\system32\DRIVERSasl2tp.sys
  0xB9BA2000 \SystemRoot\system32\DRIVERS
distapi.sys
  0xB755C000 \SystemRoot\system32\DRIVERS
diswan.sys
  0xB92A7000 \SystemRoot\system32\DRIVERSaspppoe.sys
  0xB9297000 \SystemRoot\system32\DRIVERSaspptp.sys
  0xBA480000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB754B000 \SystemRoot\system32\DRIVERS\psched.sys
  0xB8197000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA488000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA490000 \SystemRoot\system32\DRIVERSaspti.sys
  0xB8187000 \SystemRoot\system32\DRIVERS	ap0801.sys
  0xB751B000 \SystemRoot\system32\DRIVERSdpdr.sys
  0xB8177000 \SystemRoot\system32\DRIVERS	ermdd.sys
  0xBA5E6000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB7495000 \SystemRoot\system32\DRIVERS\update.sys
  0xB9B8A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB7507000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0xB68A9000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB6889000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xA240E000 \SystemRoot\system32\drivers\ADIHdAud.sys
  0xA23EA000 \SystemRoot\system32\drivers\portcls.sys
  0xB3F2C000 \SystemRoot\system32\drivers\drmk.sys
  0xA23D2000 \SystemRoot\system32\drivers\AEAudio.sys
  0xA22AC000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0xB67B2000 \SystemRoot\System32\Drivers\Modem.SYS
  0x9AC70000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
  0x9AC60000 \SystemRoot\System32\Drivers\btwusb.sys
  0xBA66E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x9AF96000 \SystemRoot\System32\Drivers\Null.SYS
  0x9C32A000 \SystemRoot\System32\Drivers\Beep.SYS
  0x9B294000 \SystemRoot\System32\drivers\vga.sys
  0x9C328000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0x9A4EB000 \SystemRoot\System32\Drivers\ATSwpWDF.sys
  0x9C320000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x9ABD3000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x9ABCB000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x9B035000 \SystemRoot\system32\DRIVERSasacd.sys
  0x9A4D8000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0x9A47F000 \SystemRoot\system32\DRIVERS	cpip.sys
  0x9A438000 \SystemRoot\system32\DRIVERS\avgtdix.sys
  0x9A412000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0x9A9D0000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x9A9C0000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0x9A3EA000 \SystemRoot\system32\DRIVERS
etbt.sys
  0x9A3C8000 \SystemRoot\System32\drivers\afd.sys
  0x9A9B0000 \SystemRoot\system32\DRIVERS
etbios.sys
  0x9A39D000 \SystemRoot\system32\DRIVERSdbss.sys
  0x9A32D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9A9A0000 \SystemRoot\System32\Drivers\Fips.SYS
  0x9A2F1000 \SystemRoot\system32\DRIVERS\avgldx86.sys
  0x9A138000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
  0x9A950000 \SystemRoot\system32\DRIVERS\STREAM.SYS
  0x9ABC3000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
  0x9AAD4000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x9AAD0000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xBA168000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0x9A06A000 \SystemRoot\System32\Drivers\dump_iaStor.sys
  0xBF800000 \SystemRoot\System32\win32k.sys
  0x9AAEC000 \SystemRoot\System32\drivers\Dxapi.sys
  0x9A69A000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xA145F000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF024000 \SystemRoot\System32\igxpgd32.dll
  0xBF012000 \SystemRoot\System32\igxprd32.dll
  0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
  0xBF25B000 \SystemRoot\System32\igxpdx32.DLL
  0xBF562000 \SystemRoot\System32\ATMFD.DLL
  0x9DCE3000 \SystemRoot\system32\DRIVERS
disuio.sys
  0x95AD6000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0x9B7EC000 \SystemRoot\System32\Drivers\ParVdm.SYS
  0xBA378000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
  0x956FA000 \SystemRoot\system32\DRIVERS\srv.sys
  0xA0DCA000 \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
  0xBA2F8000 \??\C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
  0xBA1C8000 \SystemRoot\system32\drivers\sysaudio.sys
  0x94729000 \??\C:\WINDOWS\system32\drivers	mcomm.sys
  0x945AA000 \SystemRoot\system32\drivers\wdmaud.sys
  0xBA3A0000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
  0x9425E000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
  0x93CE9000 \SystemRoot\System32\Drivers\HTTP.sys
  0x9A692000 \??\C:\DOCUME~1\dmi\LOCALS~1\Temp\mbr.sys
  0x8A055000 \SystemRoot\system32\drivers\kmixer.sys
  0x8AF3A000 \SystemRoot\system32\DRIVERS\b57xp32.sys
  0x7C910000 \WINDOWS\system32
tdll.dll

Processes (total 42):
       0 System Idle Process
       4 System
    1184 C:\WINDOWS\system32\smss.exe
    1248 C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
    1292 C:\PROGRA~1\AVG\AVG10\avgrsx.exe
    1404 csrss.exe
    1440 C:\WINDOWS\system32\winlogon.exe
    1488 C:\WINDOWS\system32\services.exe
    1500 C:\WINDOWS\system32\lsass.exe
    1664 C:\Program Files\Fingerprint Sensor\AtService.exe
    1676 C:\WINDOWS\system32\svchost.exe
    1752 svchost.exe
    1792 C:\WINDOWS\system32\svchost.exe
    1816 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    1968 svchost.exe
    2012 svchost.exe
     556 C:\WINDOWS\system32\spoolsv.exe
     632 scardsvr.exe
    1088 svchost.exe
    1124 C:\WINDOWS\system32\agrsmsvc.exe
    1132 C:\Program Files\AVG\AVG10\avgwdsvc.exe
    1396 C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
    1884 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    1936 C:\Program Files\Java\jre6\bin\jqs.exe
    1988 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
     344 C:\Program Files\LogMeIn\x86amaint.exe
     816 C:\Program Files\LogMeIn\x86\LogMeIn.exe
     920 C:\Program Files\AVG\AVG10\avgnsx.exe
    1172 C:\Program Files\OCS Inventory Agent\OcsService.exe
    1196 C:\Program Files\OpenSSH\bin\cygrunsrv.exe
    2088 C:\oracle\ora92\bin\omtsreco.exe
    2116 C:\Program Files\OpenSSH\usr\sbin\sshd.exe
    2512 C:\WINDOWS\system32\svchost.exe
    2720 C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    2752 C:\Program Files\UltraVNC\winvnc.exe
    3604 alg.exe
    2180 C:\Program Files\UltraVNC\winvnc.exe
    1932 C:\WINDOWS\system32\wscntfy.exe
    3496 C:\WINDOWS\explorer.exe
     340 C:\Program Files\AVG\AVG10\avgtray.exe
     788 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
    2976 C:\Program Files\ZHPDiag\mbrcheck.exe

\.\C: --> \.\PhysicalDrive0 at offset 0x00000000'00007e00  (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHZ2160BHG2, Rev: 8909    

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \.\PhysicalDrive0   Windows XP MBR code detected
            SHA1: 8637A6CD1F8DC55758E12C0B860CDE1133CA5719


Done!

dubitoph · Answer

Voici celui de MBRVerify :

¤¤¤¤¤¤¤¤¤ MBR_Repair | Verify | 1.0.0.5 ¤¤¤¤¤¤¤¤¤¤

Mis à jour le 04/05/2011 | 15.00 par g3n-h@ckm@n

Utilisateur : dmi (Administrateurs)
Ordinateur : CHR

Système d'exploitation : Microsoft Windows XP (32 bits)

Scan : 16:30:09 | 28/09/2011

Windows Version:		Windows XP Professional
Windows Information:		Service Pack 3 (build 2600)
Logical Drives Mask:		0x0000000c

Analysis of file "MBR.bin":
Windows XP MBR code detected


Done!

juju666 · Answer

tout va bien apparemment !

&#9654 Copie tout le texte présent dans la balise code ci-dessous ( tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )    


O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe    => Infection Rootkit (Rootkit.TDSS)
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe    => Infection Rootkit (Rootkit.TDSS)
[HKLM\Software\Classes\AppID\{937936af-28ca-4973-b8ae-f250406149a2}]    => Infection BT (Adware.BHO)
[HKLM\Software\Classes\TypeLib\{937936af-28ca-4973-b8ae-f250406149a2}]    => Infection BT (Adware.BHO)
[HKLM\Software\Classes	oolband.easyhidebtn]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.easyhidebtn.1]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.localizer]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.localizer.1]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.namehighlighter]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.namehighlighter.1]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.namehighlighterstatistics]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.namehighlighterstatistics.1]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.skypeiehelper]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.skypeiehelper.1]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.snameproxy]    => Toolbar.Agent
[HKLM\Software\Classes	oolband.snameproxy.1]    => Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{fe063db1-4ec0-403e-8dd8-394c54984b2c}]    => Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{fe063dbb-4ec0-403e-8dd8-394c54984b2c}]    => Toolbar.Ask
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{32099aac-c132-4136-9e9a-4e364a424e17}    => Toolbar.DaemonTools
EMPTYTEMP
EMPTYFLASH


&#9654 Puis Lance ZHPFix depuis le raccourci du bureau .   

&#9654 Une fois l'outil ZHPFix ouvert , clique sur le bouton [ H ] ( "coller les lignes Helper" ).   

&#9654 Dans l'encadré principal tu verras donc les lignes que tu as copié précédemment apparaitre.   

&#9654 Vérifie que toutes les lignes que je t''ai demandé de copier (et seulement elles) sont dans la fenêtre.   

&#9654 Clique sur le bouton « GO » pour lancer le nettoyage 

&#9654 Copie/Colle le rapport à l''écran dans ton prochain message   

Note : le rapport se trouve aussi dans C:\ZHP sous le nom de ZHPFix[Rx].txt (où X correspond au numéro du lancement de ZHPFix)

dubitoph · Answer

Voici donc : 

Rapport de ZHPFix 1.12.3362 par Nicolas Coolman, Update du 23/09/2011
Fichier d'export Registre : 
Run by dmi at 28/09/2011 17:16:17
Windows XP Professional Service Pack 3 (Build 2600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

========== Clé(s) du Registre ==========
SUPPRIME Key: HKLM\Software\Classes\AppID\{937936af-28ca-4973-b8ae-f250406149a2}
SUPPRIME Key: HKLM\Software\Classes\TypeLib\{937936af-28ca-4973-b8ae-f250406149a2}
SUPPRIME Key: HKLM\Software\Classes	oolband.easyhidebtn
SUPPRIME Key: HKLM\Software\Classes	oolband.easyhidebtn.1
SUPPRIME Key: HKLM\Software\Classes	oolband.localizer
SUPPRIME Key: HKLM\Software\Classes	oolband.localizer.1
SUPPRIME Key: HKLM\Software\Classes	oolband.namehighlighter
SUPPRIME Key: HKLM\Software\Classes	oolband.namehighlighter.1
SUPPRIME Key: HKLM\Software\Classes	oolband.namehighlighterstatistics
SUPPRIME Key: HKLM\Software\Classes	oolband.namehighlighterstatistics.1
SUPPRIME Key: HKLM\Software\Classes	oolband.skypeiehelper
SUPPRIME Key: HKLM\Software\Classes	oolband.skypeiehelper.1
SUPPRIME Key: HKLM\Software\Classes	oolband.snameproxy
SUPPRIME Key: HKLM\Software\Classes	oolband.snameproxy.1
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{fe063db1-4ec0-403e-8dd8-394c54984b2c}
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{fe063dbb-4ec0-403e-8dd8-394c54984b2c}

========== Valeur(s) du Registre ==========
SUPPRIME IFC: [FEATURE_BROWSER_EMULATION] svchost.exe
ABSENT IFC: [FEATURE_BROWSER_EMULATION] svchost.exe
SUPPRIME [HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{32099aac-c132-4136-9e9a-4e364a424e17}

========== Dossier(s) ==========
SUPPRIME Temporaires Windows: : 69
SUPPRIME Flash Cookies: 2

========== Fichier(s) ==========
SUPPRIME Temporaires Windows: : 19
SUPPRIME Flash Cookies: 1


========== Récapitulatif ==========
16 : Clé(s) du Registre
3 : Valeur(s) du Registre
2 : Dossier(s)
2 : Fichier(s)


End of clean in 00mn 01s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 28/09/2011 17:16:17 [2110]

dubitoph · Answer

J'ai quelque chose de bizarre : depuis la dernière opération, je ne vois plus le contenu de mes mails se trouvant dans la boite de réception.

dubitoph · Answer

Apparemment, concernant mes mails, tout est rentré dans l'ordre...

juju666 · Answer

On finalise !

Procédure d'optimisation/d'entretien/de prévention   

&#9654 Télécharge ici : PureRa (par l''editeur de JavaRa) 

&#9654 Lance-le (clic droit "executer en tant qu''administrateur" pour Vista/7) 

=> Configuration en vidéo ( merci gen-hackman ) 

&#9654 clique sur "Clean" 

&#9654 L''outil va faire son scan puis son nettoyage 

&#9654 à la fin du rapport tu auras une ligne comme ca : 

Total space cleaned: 8140878 bytes 

&#9654 transmets juste cette ligne , le reste importe peu  

------ 

&#9654 télécharge et installe Ccleaner 

&#9654 double-clique sur le fichier pour lancer l''installation  

/!\Utilisateur de Vista et windows 7 : Clique droit sur le logo de Ccleaner, « exécuter en tant qu''administrateur »  

&#9654 &#9654 une fois ouvert tu cliques sur option et puis avancé  
&#9654 tu décoches "effacer uniquement les fichiers du dossier temp de windows plus vieux que 24 heures " 
&#9654 &#9654 cliques sur nettoyeur  
&#9654 cliques sur windows et dans la colonne avancé  
&#9654 coches la première case "vieilles données du perfetch"  
&#9654 cliques sur analyse une fois l''analyse terminé  
&#9654 cliques sur "lancer le nettoyage" et sur la demande de confirmation "OK" &#9654 &#9654 cliques maintenant sur registre et puis sur "rechercher les erreurs " 
&#9654 laisses tout cochées et cliques sur "réparer les erreurs sélectionnées"  
&#9654 il te demande de sauvegarder ==> OUI  
&#9654 tu lui donnes un nom pour pouvoir la retrouver et enregistre  
&#9654 cliques sur "corriger toutes les erreurs sélectionnées" et sur la demande de confirmation ==> OK  
&#9654 Vérifie qu''il ne reste plus rien en relançant "rechercher les erreurs"  
&#9654 tu retournes dans option et tu recoches la case "effacer uniquement les fichiers du dossier temp de windows plus vieux que 24 heures" et sur nettoyeur  windows, sous avancé, tu décoches la première case "vieilles données du perfetch"  
&#9654 tu peux fermer Ccleaner  

------  

Fais une recherche des erreurs de disque : 
ouvre Ordinateur/Poste de travail => clic droit sur C: => propriétés => outils => Vérification des erreurs cliquez sur vérifier maintenant. Ensuite cochez les deux cases puis cliquez sur démarrer. Répondez oui pour le message d''avertissement et redémarrez votre système. 

------ 

Défragmente tes disques dur : 
Télécharge Deffragler, et défragmente tes disques.  

------ 

&#9654 Désactivation, puis Réactivation de la restauration système après désinfection :  

Il est nécessaire de désactiver puis réactiver la restauration système pour la purger car les points de restauration peuvent être infectés :  

XP/Vista : http://www.forum-fec.net/t97-purger-la-restauration-du-systeme 
Seven: http://www.forum-fec.net/faq-tutoriel-astuces-f10/purger-la-restauration-du-systeme-sous-windows-7-t142.htm 

------  

&#9654 Maintiens tes logiciels à jour c'est important, utilise ce programme : https://www.commentcamarche.net/faq/13362-mettre-a-jour-son-pc-contre-les-failles-de-securite
Absolument à faire.

&#9654 idem pour les Mises à jour Windows :  

Il est très important de maintenir son OS à jour car ceci comble les failles de sécurité par lesquelles les malwares ("virus") s'introduisent ... 

&#9654 Windows Update XP (uniquement avec Internet Explorer): http://update.microsoft.com/windowsupdate/v6/ 


&#9654 Windows Update Vista/Seven : cliquer sur le logo windows, dans la rechercher taper "Windows Update", cliquer sur le résultat. 

----- 

&#9654 Mets à jour Java : https://www.java.com/fr/download/uninstalltool.jsp   

&#9654 Désinstaller les anciennes versions de Java :   

&#9654 Télécharge JavaRa.zip   

&#9654 Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)   

&#9654 Double-clique sur le répertoire JavaRa obtenu.   

&#9654 Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s''afficher)   

&#9654 Clique sur Remove Older Versions.   

&#9654 Clique sur Oui pour confirmer. L''outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.   

&#9654 Un rapport va s''ouvrir, copie-colle le dans ta prochaine réponse.   

&#9654 Note : le rapport se trouve aussi là : ( C:\JavaRa.log )   

&#9654 Tu peux fermer l''application    

&#9654 &#9654 Met à jour les logiciels Adobe :  

&#9654 Reader : https://get2.adobe.com/fr/reader/otherversions/ 

&#9654 Flash Player: https://get.adobe.com/flashplayer/?loc=fr 

----- 

Si tu utilise FireFox, vérifie que tes plug in sont à jour : https://support.mozilla.org/en-US/kb/npapi-plugins 

----- 

&#9654 &#9654 pour supprimer les outils de désinfection : 

&#9654 Télécharge et exécute Delfix sur ton bureau

&#9654 Clique sur le bouton « Suppression » et poste son rapport sur ton prochain message  
&#9654 &#9654 Pour le désinstaller, il suffit de le relancer et cliquer sur le bouton de désinstallation.  

------  

Tu peux garder Malwarebytes pour un scan de temps à autres  

-----  

Les antivirus ne font pas tout en ce qui concerne la sécurité de ta machine (mettre à jour ses logiciels etc etc)
La meilleur protection reste de connaître les infections pour pouvoir les éviter et avoir de bonne habitude.
Donc faut se documenter. 

Tu peux lire ce sujet sur les logiciels recommandés, et les attitudes responsables sur le web  
Et celui ci, sur les logiciels gratuits à éviter  

Si tu utilises Avast! ou AVG - regle le pour détecter les LPIs - voir : https://www.malekal.com/adwares-pup-protection/

Un peu de lecture pour éviter les infections :
- connaitre et éviter les infections : https://www.malekal.com/fichiers/projetantimalwares/ProjetAntiMalware-courte.pdf
- sécuriser son PC : http://forum.malekal.com/comment-securiser-son-ordinateur.html
- lire : http://www.commentcamarche.net/faq/27128-malwares-quels-enjeux-version-synthese

Ce qu'il ne faut pas faire :
Je télécharge n'importe quoi - je m'infecte - evite les programmes par publicités ou sur les liens commerciaux des moteurs de recherche - ce sont des arnaques ::
Les PUPs/LPIs : https://www.malekal.com/adwares-pup-protection/
Exemple de ce qu'il ne faut pas faire :
https://forums.commentcamarche.net/forum/affich-19719198-onglets-pub-intempestifs#14
https://forums.commentcamarche.net/forum/affich-18347759-le-nouveau-avast-sonne-trop-souvent#9
Je télécharge depuis n'importe où - je m'infecte : https://forums.commentcamarche.net/forum/affich-19916973-clickpotato-vlc-virus#6
Recommandations sur la sécurité : https://forums.commentcamarche.net/forum/affich-18680013-windows-7-et-antispyware#1

Fonctionnement de quelques catégories de malwares :
https://forums.commentcamarche.net/forum/affich-17725521-virus-programme-troyen
https://forums.commentcamarche.net/forum/affich-17746390-concernant-la-propagation-des-virus 
------  

&#9654 &#9654 Pense à marquer le fil comme résolu   

------  

Si tu as d'autres questions,
Sur le fonctionnement des malwares
Ou comment tu t'es fait infecté
N'hésites pas.
On se quitte si le rapport DelFix est ok... 

@+

dubitoph · Answer

dubitoph - 29 sep 2011 à 12:48 
Bonjour, 

Du à plusieurs soucis, je ne réponds que maintenant. 

Après avoir recherché les erreurs et dégfragmenté, j'ai refais un scan et apparemment, j'ai un virus Z-Access. 

Bon, comme demandé, voici le rapport JavaRa.log : 

JavaRa 1.15 Removal Log. 

Report follows after line. 

------------------------------------ 

The JavaRa removal process was started on Thu Sep 29 12:40:37 2011 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2 

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA} 

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB} 

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

dubitoph · Answer

Apparemment, concernant Delfix, il y a un bug car il plante quand je clique sur "Suppression".

J'avais cependant déjà supprimé tous les softs que tu m'avais indiqué soit à ma la main, soit via CCleaner.

dubitoph · Answer

Bon, je viens de refaire un scan avec Malwarebytes' Anti-Malware. Il n'a détecté aucun nuisible. Je vais donc m'ocupé maintenant de vider le cache de la restauration Windows. 

Je te remercie infiniment de ton investissement dans la résolution de l'infection de mon pc. 

Je considère que le problème est maintenant résolu.

juju666 · Answer

Bonjour,

Après avoir recherché les erreurs et dégfragmenté, j'ai refais un scan et apparemment, j'ai un virus Z-Access. 

Qui t'as dit ça ???

dubitoph · Answer

Re,

J'avais lancé une analyse AVG qui m'avait indiqué cela. J'ai donc laissé AVG supprimer les fichiers infectés.

Je viens de refaire une analyse avec AVG et je n'ai plus aucune détection.

Bonne soirée et encore un grand merci pour ton aide si précieuse.

juju666 · Answer

Repasse TDSS Killer pour voir? 

&#9654 Télécharge Reload_TDSSKiller  

&#9654 Lance le   

choisis : lancer le nettoyage  

l'outil va automatiquement télécharger la derniere version puis   

TDSSKiller va s'ouvrir , clique sur "Start Scan"  Clique ici pour l'aide en image  

Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut.   
Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée.   
Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée.   
Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas  
Si Suspicious file est indiqué, laisse l''option cochée sur Skip    
une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer  

sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau  

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

~~

Peux-tu poster l'analyse d'AVG ?

dubitoph · Answer

Je constate avec plaisir que tu es un jusqu'au boutiste! ;)

Voici le rapport de TDSSKiller : 

20:29:35.0937 6120	TDSS rootkit removing tool 2.6.2.0 Sep 26 2011 18:56:43
20:29:36.0046 6120	============================================================
20:29:36.0046 6120	Current date / time: 2011/09/29 20:29:36.0046
20:29:36.0046 6120	SystemInfo:
20:29:36.0046 6120	
20:29:36.0046 6120	OS Version: 5.1.2600 ServicePack: 3.0
20:29:36.0046 6120	Product type: Workstation
20:29:36.0046 6120	ComputerName: CHR
20:29:36.0046 6120	UserName: dmi
20:29:36.0046 6120	Windows directory: C:\WINDOWS
20:29:36.0046 6120	System windows directory: C:\WINDOWS
20:29:36.0046 6120	Processor architecture: Intel x86
20:29:36.0046 6120	Number of processors: 2
20:29:36.0046 6120	Page size: 0x1000
20:29:36.0046 6120	Boot type: Normal boot
20:29:36.0046 6120	============================================================
20:29:36.0328 6120	Initialize success
20:29:40.0046 5864	============================================================
20:29:40.0046 5864	Scan started
20:29:40.0046 5864	Mode: Manual; 
20:29:40.0046 5864	============================================================
20:29:40.0906 5864	a347bus         (1f61cacacb521215f39061789147968c) C:\WINDOWS\system32\DRIVERS\a347bus.sys
20:29:40.0906 5864	a347bus - ok
20:29:40.0906 5864	a347scsi        (113e4b318bbaa7483ca4e582a4d63f49) C:\WINDOWS\system32\Drivers\a347scsi.sys
20:29:40.0906 5864	a347scsi - ok
20:29:40.0921 5864	Abiosdsk - ok
20:29:40.0937 5864	abp480n5 - ok
20:29:40.0968 5864	Accelerometer   (6c2e405d98e6342a9d66a2493e7ab15e) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
20:29:40.0968 5864	Accelerometer - ok
20:29:41.0000 5864	ACPI            (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:29:41.0000 5864	ACPI - ok
20:29:41.0015 5864	ACPIEC          (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
20:29:41.0015 5864	ACPIEC - ok
20:29:41.0062 5864	ADIHdAudAddService (ff60db2aca88543c025eacba25cee5c1) C:\WINDOWS\system32\drivers\ADIHdAud.sys
20:29:41.0062 5864	ADIHdAudAddService - ok
20:29:41.0062 5864	adpu160m - ok
20:29:41.0078 5864	AEAudio         (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
20:29:41.0078 5864	AEAudio - ok
20:29:41.0125 5864	aec             (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:29:41.0125 5864	aec - ok
20:29:41.0250 5864	AFD             (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
20:29:41.0250 5864	AFD - ok
20:29:41.0343 5864	AgereSoftModem  (1cfeba39fc613e45b49d3eddfbcda289) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
20:29:41.0359 5864	AgereSoftModem - ok
20:29:41.0375 5864	Aha154x - ok
20:29:41.0390 5864	aic78u2 - ok
20:29:41.0406 5864	aic78xx - ok
20:29:41.0437 5864	AliIde - ok
20:29:41.0453 5864	amsint - ok
20:29:41.0484 5864	Arp1394         (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
20:29:41.0484 5864	Arp1394 - ok
20:29:41.0500 5864	asc - ok
20:29:41.0515 5864	asc3350p - ok
20:29:41.0531 5864	asc3550 - ok
20:29:41.0562 5864	AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:29:41.0562 5864	AsyncMac - ok
20:29:41.0593 5864	atapi           (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
20:29:41.0609 5864	atapi - ok
20:29:41.0656 5864	Atdisk - ok
20:29:41.0703 5864	Atmarpc         (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:29:41.0703 5864	Atmarpc - ok
20:29:41.0781 5864	ATSwpWDF        (a9f9d1d24441889beb1aa2b917457e23) C:\WINDOWS\system32\Drivers\ATSwpWDF.sys
20:29:41.0796 5864	ATSwpWDF - ok
20:29:41.0859 5864	audstub         (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:29:41.0859 5864	audstub - ok
20:29:41.0906 5864	AVGIDSDriver    (4fa401b33c1b50c816486f6951244a14) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
20:29:41.0921 5864	AVGIDSDriver - ok
20:29:41.0968 5864	AVGIDSEH        (69578bc9d43d614c6b3455db4af19762) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
20:29:41.0968 5864	AVGIDSEH - ok
20:29:42.0015 5864	AVGIDSFilter    (6df528406aa22201f392b9b19121cd6f) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
20:29:42.0015 5864	AVGIDSFilter - ok
20:29:42.0062 5864	AVGIDSShim      (07eba0c11fa1d73b82ecc3255ddfe34d) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
20:29:42.0062 5864	AVGIDSShim - ok
20:29:42.0125 5864	Avgldx86        (f4dbbc8d3c5338693da23c59a50f8abc) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
20:29:42.0125 5864	Avgldx86 - ok
20:29:42.0156 5864	Avgmfx86        (1c77ef67f196466adc9924cb288afe87) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
20:29:42.0156 5864	Avgmfx86 - ok
20:29:42.0187 5864	Avgrkx86        (4def59ff7d09b9ce59739102b49fd526) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
20:29:42.0187 5864	Avgrkx86 - ok
20:29:42.0265 5864	Avgtdix         (a6d562b612216d8d02a35ebeb92366bd) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
20:29:42.0281 5864	Avgtdix - ok
20:29:42.0375 5864	b57w2k          (ea377a8e8e1000877210259750cbbf5f) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
20:29:42.0390 5864	b57w2k - ok
20:29:42.0406 5864	Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:29:42.0406 5864	Beep - ok
20:29:42.0484 5864	BTKRNL          (ef5e0de0a7ca2977a9255f36f4d915ab) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
20:29:42.0500 5864	BTKRNL - ok
20:29:42.0515 5864	BTWUSB          (053dc5be74621b63bb48c2b86bafc7b0) C:\WINDOWS\system32\Drivers\btwusb.sys
20:29:42.0515 5864	BTWUSB - ok
20:29:42.0515 5864	catchme - ok
20:29:42.0562 5864	cbidf2k         (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:29:42.0578 5864	cbidf2k - ok
20:29:42.0625 5864	CCDECODE        (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
20:29:42.0625 5864	CCDECODE - ok
20:29:42.0703 5864	cd20xrnt - ok
20:29:42.0718 5864	Cdaudio         (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:29:42.0718 5864	Cdaudio - ok
20:29:42.0765 5864	Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:29:42.0765 5864	Cdfs - ok
20:29:42.0812 5864	Cdrom           (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:29:42.0812 5864	Cdrom - ok
20:29:42.0828 5864	Changer - ok
20:29:42.0859 5864	CmBatt          (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
20:29:42.0859 5864	CmBatt - ok
20:29:42.0875 5864	CmdIde - ok
20:29:42.0890 5864	Compbatt        (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
20:29:42.0890 5864	Compbatt - ok
20:29:42.0906 5864	Cpqarray - ok
20:29:42.0968 5864	CrystalSysInfo  (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys
20:29:42.0984 5864	CrystalSysInfo - ok
20:29:43.0000 5864	dac2w2k - ok
20:29:43.0000 5864	dac960nt - ok
20:29:43.0031 5864	Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:29:43.0031 5864	Disk - ok
20:29:43.0078 5864	dmboot          (f5deadd42335fb33edca74ecb2f36cba) C:\WINDOWS\system32\drivers\dmboot.sys
20:29:43.0093 5864	dmboot - ok
20:29:43.0109 5864	dmio            (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
20:29:43.0109 5864	dmio - ok
20:29:43.0140 5864	dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:29:43.0140 5864	dmload - ok
20:29:43.0234 5864	DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:29:43.0234 5864	DMusic - ok
20:29:43.0265 5864	dpti2o - ok
20:29:43.0265 5864	drmkaud         (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:29:43.0281 5864	drmkaud - ok
20:29:43.0328 5864	dsNcAdpt        (b2c3f71b86e25c3df78339ddb40a7562) C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
20:29:43.0328 5864	dsNcAdpt - ok
20:29:43.0375 5864	Fastfat         (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:29:43.0375 5864	Fastfat - ok
20:29:43.0406 5864	Fdc             (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:29:43.0406 5864	Fdc - ok
20:29:43.0421 5864	Fips            (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
20:29:43.0421 5864	Fips - ok
20:29:43.0437 5864	Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:29:43.0437 5864	Flpydisk - ok
20:29:43.0484 5864	FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
20:29:43.0484 5864	FltMgr - ok
20:29:43.0531 5864	Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:29:43.0531 5864	Fs_Rec - ok
20:29:43.0593 5864	Ftdisk          (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:29:43.0593 5864	Ftdisk - ok
20:29:43.0640 5864	Gpc             (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:29:43.0640 5864	Gpc - ok
20:29:43.0687 5864	HBtnKey         (407e41ddb2bfece109132aec296e0d98) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
20:29:43.0687 5864	HBtnKey - ok
20:29:43.0734 5864	HDAudBus        (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:29:43.0734 5864	HDAudBus - ok
20:29:43.0750 5864	HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:29:43.0750 5864	HidUsb - ok
20:29:43.0781 5864	hpdskflt        (e8a95df23097bca840814d42f2ee5164) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
20:29:43.0781 5864	hpdskflt - ok
20:29:43.0859 5864	hpn - ok
20:29:43.0890 5864	HpqKbFiltr      (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
20:29:43.0890 5864	HpqKbFiltr - ok
20:29:43.0953 5864	HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:29:43.0953 5864	HTTP - ok
20:29:43.0968 5864	i2omgmt - ok
20:29:43.0984 5864	i2omp - ok
20:29:44.0031 5864	i8042prt        (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:29:44.0031 5864	i8042prt - ok
20:29:44.0265 5864	ialm            (f592a1b020723cfbd3d2722514066449) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
20:29:44.0421 5864	ialm - ok
20:29:44.0484 5864	iaStor          (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\DRIVERS\iaStor.sys
20:29:44.0484 5864	iaStor - ok
20:29:44.0609 5864	IFXTPM          (667cfdb801df771f47b7c39373c2d850) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
20:29:44.0609 5864	IFXTPM - ok
20:29:44.0640 5864	Imapi           (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:29:44.0640 5864	Imapi - ok
20:29:44.0671 5864	ini910u - ok
20:29:44.0687 5864	IntelIde - ok
20:29:44.0703 5864	intelppm        (ad340800c35a42d4de1641a37feea34c) C:\WINDOWS\system32\DRIVERS\intelppm.sys
20:29:44.0703 5864	intelppm - ok
20:29:44.0718 5864	Ip6Fw           (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
20:29:44.0734 5864	Ip6Fw - ok
20:29:44.0765 5864	IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:29:44.0765 5864	IpFilterDriver - ok
20:29:44.0781 5864	IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:29:44.0781 5864	IpInIp - ok
20:29:44.0812 5864	IpNat           (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:29:44.0828 5864	IpNat - ok
20:29:44.0843 5864	IPSec           (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:29:44.0843 5864	IPSec - ok
20:29:44.0890 5864	IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:29:44.0890 5864	IRENUM - ok
20:29:44.0984 5864	isapnp          (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:29:44.0984 5864	isapnp - ok
20:29:45.0031 5864	Kbdclass        (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:29:45.0046 5864	Kbdclass - ok
20:29:45.0062 5864	kbdhid          (94c59cb884ba010c063687c3a50dce8e) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:29:45.0062 5864	kbdhid - ok
20:29:45.0109 5864	kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:29:45.0125 5864	kmixer - ok
20:29:45.0140 5864	KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:29:45.0156 5864	KSecDD - ok
20:29:45.0203 5864	Lbd             (b7c19ec8b0dd7efa58ad41ffeb8b8cda) C:\WINDOWS\system32\DRIVERS\Lbd.sys
20:29:45.0203 5864	Lbd - ok
20:29:45.0250 5864	lbrtfdc - ok
20:29:45.0328 5864	LMIInfo         (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\RaInfo.sys
20:29:45.0328 5864	LMIInfo - ok
20:29:45.0375 5864	lmimirr         (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
20:29:45.0375 5864	lmimirr - ok
20:29:45.0390 5864	LMIRfsClientNP - ok
20:29:45.0421 5864	LMIRfsDriver    (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
20:29:45.0437 5864	LMIRfsDriver - ok
20:29:45.0484 5864	mnmdd           (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:29:45.0484 5864	mnmdd - ok
20:29:45.0546 5864	Modem           (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
20:29:45.0546 5864	Modem - ok
20:29:45.0609 5864	Mouclass        (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:29:45.0609 5864	Mouclass - ok
20:29:45.0656 5864	mouhid          (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:29:45.0656 5864	mouhid - ok
20:29:45.0703 5864	MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:29:45.0703 5864	MountMgr - ok
20:29:45.0718 5864	mraid35x - ok
20:29:45.0750 5864	MRxDAV          (e3f17e1ea5256709d4e97ef0da04b3c9) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:29:45.0765 5864	MRxDAV - ok
20:29:45.0828 5864	MRxSmb          (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:29:45.0875 5864	MRxSmb - ok
20:29:46.0000 5864	Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:29:46.0000 5864	Msfs - ok
20:29:46.0187 5864	MSKSSRV         (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:29:46.0203 5864	MSKSSRV - ok
20:29:46.0296 5864	MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:29:46.0312 5864	MSPCLOCK - ok
20:29:46.0531 5864	MSPQM           (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:29:46.0531 5864	MSPQM - ok
20:29:46.0734 5864	mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:29:46.0750 5864	mssmbios - ok
20:29:46.0937 5864	MSTEE           (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
20:29:46.0937 5864	MSTEE - ok
20:29:47.0046 5864	Mup             (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:29:47.0062 5864	Mup - ok
20:29:47.0265 5864	NABTSFEC        (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
20:29:47.0296 5864	NABTSFEC - ok
20:29:47.0421 5864	NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:29:47.0437 5864	NDIS - ok
20:29:47.0515 5864	NdisIP          (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
20:29:47.0515 5864	NdisIP - ok
20:29:47.0562 5864	NdisTapi        (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS
distapi.sys
20:29:47.0562 5864	NdisTapi - ok
20:29:47.0578 5864	Ndisuio         (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS
disuio.sys
20:29:47.0578 5864	Ndisuio - ok
20:29:47.0593 5864	NdisWan         (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS
diswan.sys
20:29:47.0593 5864	NdisWan - ok
20:29:47.0640 5864	NDProxy         (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:29:47.0656 5864	NDProxy - ok
20:29:47.0718 5864	NetBIOS         (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS
etbios.sys
20:29:47.0734 5864	NetBIOS - ok
20:29:47.0765 5864	NetBT           (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS
etbt.sys
20:29:47.0781 5864	NetBT - ok
20:29:48.0015 5864	NETw5x32        (05743fffc2bc88cc8e426321bc6a762e) C:\WINDOWS\system32\DRIVERS\NETw5x32.sys
20:29:48.0125 5864	NETw5x32 - ok
20:29:48.0140 5864	NIC1394         (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS
ic1394.sys
20:29:48.0140 5864	NIC1394 - ok
20:29:48.0187 5864	nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
20:29:48.0187 5864	nm - ok
20:29:48.0234 5864	NPF             (243126da7ba441d7c7c3262dcf435a9c) C:\WINDOWS\system32\drivers
pf.sys
20:29:48.0250 5864	NPF - ok
20:29:48.0312 5864	Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:29:48.0312 5864	Npfs - ok
20:29:48.0359 5864	Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:29:48.0375 5864	Ntfs - ok
20:29:48.0468 5864	Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:29:48.0468 5864	Null - ok
20:29:48.0515 5864	NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS
wlnkflt.sys
20:29:48.0515 5864	NwlnkFlt - ok
20:29:48.0562 5864	NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS
wlnkfwd.sys
20:29:48.0562 5864	NwlnkFwd - ok
20:29:48.0609 5864	ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:29:48.0609 5864	ohci1394 - ok
20:29:48.0687 5864	Parport         (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\DRIVERS\parport.sys
20:29:48.0687 5864	Parport - ok
20:29:48.0750 5864	PartMgr         (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:29:48.0750 5864	PartMgr - ok
20:29:48.0796 5864	ParVdm          (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
20:29:48.0796 5864	ParVdm - ok
20:29:48.0859 5864	PCI             (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
20:29:48.0859 5864	PCI - ok
20:29:48.0906 5864	PCIDump - ok
20:29:48.0937 5864	PCIIde - ok
20:29:49.0000 5864	Pcmcia          (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:29:49.0015 5864	Pcmcia - ok
20:29:49.0046 5864	PDCOMP - ok
20:29:49.0062 5864	PDFRAME - ok
20:29:49.0109 5864	PDRELI - ok
20:29:49.0140 5864	PDRFRAME - ok
20:29:49.0187 5864	perc2 - ok
20:29:49.0218 5864	perc2hib - ok
20:29:49.0296 5864	PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERSaspptp.sys
20:29:49.0296 5864	PptpMiniport - ok
20:29:49.0375 5864	PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:29:49.0375 5864	PSched - ok
20:29:49.0437 5864	Ptilink         (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:29:49.0437 5864	Ptilink - ok
20:29:49.0500 5864	ql1080 - ok
20:29:49.0531 5864	Ql10wnt - ok
20:29:49.0562 5864	ql12160 - ok
20:29:49.0578 5864	ql1240 - ok
20:29:49.0593 5864	ql1280 - ok
20:29:49.0625 5864	RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERSasacd.sys
20:29:49.0625 5864	RasAcd - ok
20:29:49.0703 5864	Rasl2tp         (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERSasl2tp.sys
20:29:49.0703 5864	Rasl2tp - ok
20:29:49.0765 5864	RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERSaspppoe.sys
20:29:49.0765 5864	RasPppoe - ok
20:29:49.0828 5864	Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERSaspti.sys
20:29:49.0828 5864	Raspti - ok
20:29:49.0875 5864	Rdbss           (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERSdbss.sys
20:29:49.0875 5864	Rdbss - ok
20:29:49.0906 5864	RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:29:49.0921 5864	RDPCDD - ok
20:29:49.0968 5864	rdpdr           (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERSdpdr.sys
20:29:49.0968 5864	rdpdr - ok
20:29:50.0046 5864	RDPWD           (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
20:29:50.0046 5864	RDPWD - ok
20:29:50.0140 5864	redbook         (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERSedbook.sys
20:29:50.0140 5864	redbook - ok
20:29:50.0328 5864	SCR3XX2K        (fc87d5e0328afa97bf6d39df96d5d356) C:\WINDOWS\system32\DRIVERS\SCR3XX2K.sys
20:29:50.0328 5864	SCR3XX2K - ok
20:29:50.0406 5864	Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:29:50.0421 5864	Secdrv - ok
20:29:50.0484 5864	serenum         (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:29:50.0484 5864	serenum - ok
20:29:50.0546 5864	Serial          (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\DRIVERS\serial.sys
20:29:50.0546 5864	Serial - ok
20:29:50.0625 5864	SFAUDIO         (b6401608579b6431994425ba7653f774) C:\WINDOWS\system32\drivers\sfaudio.sys
20:29:50.0640 5864	SFAUDIO - ok
20:29:50.0671 5864	Sfloppy         (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys
20:29:50.0671 5864	Sfloppy - ok
20:29:50.0718 5864	Simbad - ok
20:29:50.0781 5864	SLIP            (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
20:29:50.0781 5864	SLIP - ok
20:29:50.0906 5864	SNP2UVC         (cf9cde12fbc19dba8de528b7511a2f4f) C:\WINDOWS\system32\DRIVERS\snp2uvc.sys
20:29:50.0968 5864	SNP2UVC - ok
20:29:51.0031 5864	Sparrow - ok
20:29:51.0093 5864	splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:29:51.0109 5864	splitter - ok
20:29:51.0203 5864	sptd            (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
20:29:51.0296 5864	Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
20:29:51.0296 5864	sptd ( LockedFile.Multi.Generic ) - warning
20:29:51.0296 5864	sptd - detected LockedFile.Multi.Generic (1)
20:29:51.0375 5864	sr              (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
20:29:51.0375 5864	sr - ok
20:29:51.0468 5864	Srv             (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:29:51.0500 5864	Srv - ok
20:29:51.0546 5864	streamip        (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
20:29:51.0546 5864	streamip - ok
20:29:51.0609 5864	swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:29:51.0609 5864	swenum - ok
20:29:51.0687 5864	swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:29:51.0703 5864	swmidi - ok
20:29:51.0734 5864	symc810 - ok
20:29:51.0750 5864	symc8xx - ok
20:29:51.0781 5864	sym_hi - ok
20:29:51.0796 5864	sym_u3 - ok
20:29:51.0875 5864	SynTP           (f08667f79bbd339547f477c75c3ed0b9) C:\WINDOWS\system32\DRIVERS\SynTP.sys
20:29:51.0875 5864	SynTP - ok
20:29:51.0968 5864	sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:29:51.0984 5864	sysaudio - ok
20:29:52.0078 5864	tap0801         (846b7c0e3f6370cdcce157a5b36e70cd) C:\WINDOWS\system32\DRIVERS	ap0801.sys
20:29:52.0093 5864	tap0801 - ok
20:29:52.0156 5864	Tcpip           (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS	cpip.sys
20:29:52.0187 5864	Tcpip - ok
20:29:52.0250 5864	TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:29:52.0250 5864	TDPIPE - ok
20:29:52.0296 5864	TDTCP           (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:29:52.0296 5864	TDTCP - ok
20:29:52.0359 5864	teamviewervpn   (9101fffcfccd1a30e870a5b8a9091b10) C:\WINDOWS\system32\DRIVERS	eamviewervpn.sys
20:29:52.0359 5864	teamviewervpn - ok
20:29:52.0437 5864	TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS	ermdd.sys
20:29:52.0437 5864	TermDD - ok
20:29:52.0500 5864	tmtdi           (ce4b8bf9fbad5957ffb3fca281759540) C:\WINDOWS\system32\DRIVERS	mtdi.sys
20:29:52.0500 5864	tmtdi - ok
20:29:52.0546 5864	TosIde - ok
20:29:52.0640 5864	TrueSight - ok
20:29:52.0750 5864	Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:29:52.0750 5864	Udfs - ok
20:29:52.0781 5864	ultra - ok
20:29:52.0843 5864	Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:29:52.0859 5864	Update - ok
20:29:52.0921 5864	usbccgp         (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:29:52.0921 5864	usbccgp - ok
20:29:53.0000 5864	usbehci         (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:29:53.0000 5864	usbehci - ok
20:29:53.0046 5864	usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:29:53.0046 5864	usbhub - ok
20:29:53.0093 5864	usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
20:29:53.0109 5864	usbprint - ok
20:29:53.0156 5864	usbscan         (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:29:53.0156 5864	usbscan - ok
20:29:53.0234 5864	USBSTOR         (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:29:53.0234 5864	USBSTOR - ok
20:29:53.0265 5864	usbuhci         (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
20:29:53.0265 5864	usbuhci - ok
20:29:53.0328 5864	usbvideo        (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
20:29:53.0343 5864	usbvideo - ok
20:29:53.0437 5864	VgaSave         (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:29:53.0437 5864	VgaSave - ok
20:29:53.0484 5864	ViaIde - ok
20:29:53.0531 5864	VolSnap         (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
20:29:53.0531 5864	VolSnap - ok
20:29:53.0593 5864	Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:29:53.0593 5864	Wanarp - ok
20:29:53.0671 5864	Wdf01000        (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:29:53.0703 5864	Wdf01000 - ok
20:29:53.0718 5864	WDICA - ok
20:29:53.0781 5864	wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:29:53.0781 5864	wdmaud - ok
20:29:53.0875 5864	WmiAcpi         (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
20:29:53.0875 5864	WmiAcpi - ok
20:29:53.0921 5864	WSTCODEC        (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
20:29:53.0921 5864	WSTCODEC - ok
20:29:54.0015 5864	WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:29:54.0015 5864	WudfPf - ok
20:29:54.0062 5864	WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:29:54.0062 5864	WudfRd - ok
20:29:54.0109 5864	MBR (0x1B8)     (c99c3199cfaa4cbdcd91493f6d113a50) \Device\Harddisk0\DR0
20:29:54.0328 5864	\Device\Harddisk0\DR0 - ok
20:29:54.0343 5864	Boot (0x1200)   (7c8d0dcb31f179aff5003f6445918649) \Device\Harddisk0\DR0\Partition0
20:29:54.0343 5864	\Device\Harddisk0\DR0\Partition0 - ok
20:29:54.0343 5864	============================================================
20:29:54.0343 5864	Scan finished
20:29:54.0343 5864	============================================================
20:29:54.0359 4412	Detected object count: 1
20:29:54.0359 4412	Actual detected object count: 1
20:30:11.0328 4412	sptd ( LockedFile.Multi.Generic ) - skipped by user
20:30:11.0328 4412	sptd ( LockedFile.Multi.Generic ) - User select action: Skip 
20:30:29.0828 1180	Deinitialize success

juju666 · Answer

Bah oui je vais pas te laisser repartir si tu es infecté :)

Tu as le rapport d'AVG stp ?

dubitoph · Answer

Concernant le rapport d'AVG, je ne retrouve pas celui avec les clés contenant des Z-Access. Par contre, j'ai retrouvé un rapport d'aujourd'hui à 08h04 : 

"";"C:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP430\A0104451.exe";"Cheval de Troie : SHeur4.DLF";"Déplacé en Quarantaine"
"";"C:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP430\A0104448.exe";"Virus identifié Worm/Generic2.AZXU";"Déplacé en Quarantaine"
"";"C:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP427\A0101146.exe";"Cheval de Troie : Dropper.Generic4.BCRI";"Déplacé en Quarantaine"
"";"C:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP427\A0101145.exe";"Cheval de Troie : Dropper.Generic4.BCRI";"Déplacé en Quarantaine"
"";"C:\System Volume Information\_restore{71A8F647-2A41-41A1-8A12-1ED46DB6D989}\RP427\A0101087.exe";"Virus identifié Worm/Generic2.AZXU";"Déplacé en Quarantaine"

juju666 · Answer

C'est dans la restauration système que tu aurais du purger :)

Windows ne parvient pas à accéder

51 réponses

Discussions similaires

Newsletters