afmae2pq.sys = rootkit?

Question

Bonjour,

le logiciel AVG Antirootkits free a, 1 seconde après le début de l'analyse, détecté un fichier qu'il qualifiie de "Hidden driver file" (=fichier driver caché). ce fichier s'appelle afmae2pq.sys et se trouve dans le repertoire C:\Windows\System32\Drivers.

Vu le fait que ce fichier soit parmi les dossiers les plus importants pour le bon fonctionnement et la stabilité de mon ordi. et Windows, pourriez-vous me dire si ce n'est qu'un faux-positif ou bien un rootkit?




merci

verni29 · Answer

Bonjour, 

Les recherches sur google ne donnent aucune information sur ce fichier.
Ce n'est pas bon signe. C'est sans doute un rootkit.

1/ Commence par analyser le fichier sur le site VirusTotal.
https://www.virustotal.com/gui/
Copiez le chemin indiqué ci-dessous et le coller dans la zone à analyser.

C:\Windows\System32\Drivers\afmae2pq.sys 

Tu cliques ensuite sur envoyer le fichier.
Tu postes le rapport de l'analyse ( pour cela, tu sélectionnes la zone de résultat --> click droit --> copier )

2/ peux-tu éviter de le supprimer avec AVGAntirootkit ( si il le supprime )?
Il serait bon de faire remonter ce fichier vers des concepteurs d'outils de désinfection pour leur signaler ce fichier.

A+

silveren · Answer

Merci pour ta réponse.


"
1/ Commence par analyser le fichier sur le site VirusTotal.
https://www.virustotal.com/gui/
Copiez le chemin indiqué ci-dessous et le coller dans la zone à analyser.

C:\Windows\System32\Drivers\afmae2pq.sys "


J'ai essayé mais le problème, c'est qu'en ouvrant le dossier Drivers ce fichier n'y est pas, même en activant l'affichage les fichiers/dossiers cachés.

verni29 · Answer

On va rechercher plus d'infos sur la présence du fichier.

1/ Télécharge OAD et enregistre le sur ton bureau
 http://sosvirus.changelog.fr/OAD.exe

    * Double clique sur le OAD pour le lancer.
    * dans la fenêtre qui va s'ouvrir, tape le nom de fichier à rechercher, puis valide par Entrée

Nom du fichier : afmae2pq.sys 

    * Choisis  le type de recherche : sélectionne l'option 6 puis valide par Entrée.

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

Fais un copier / coller de ce rapport dans ton prochain post.

Note : Si tu ne le trouves pas, il se trouve en C:\resultat/txt.

2/ Télécharge gmer 
http://www2.gmer.net/gmer.zip

dézippe-le (click droit et extraire sur le bureau ) 

Ouvre le dossier crée et double-clique sur gmer.exe . 

Note  : Si ton antivirus réagit, ne t'inquiète et ignore l'alerte. 

Le scan va se lancer de lui-même.
vérifie que l’outil est sur l’onglet RootKit/Malware.

A la fin du scan, clique sur le bouton save pour enregistrer le rapport. 
Enregistre-le sur le bureau ( fichier .log )

Poste ce rapport dans ta prochaine réponse.

A+

silveren · Answer

Voici le rapport par oad.exe pour le fichier afmae2pq.exe: 



06/05/2009 ---- 20:19:51,68  

----------------------------------
§§§§§§ [afmae2pq.sys] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

silveren · Answer

Et voilà le rapport de Gmer:


MER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-05-06 20:28:55
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.15 ----

SSDT            sprf.sys                     ZwEnumerateKey [0xF738ECA2]
SSDT            sprf.sys                     ZwEnumerateValueKey [0xF738F030]

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs       859DA1F8

AttachedDevice  \FileSystem\Ntfs \Ntfs       aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device          \FileSystem\Fastfat \Fat     8501C408

AttachedDevice  \FileSystem\Fastfat \Fat     fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat     aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip     aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Udp    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp  aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

verni29 · Answer

1/ Tu peux vérifier avec AVG Antirootkit si il y a toujours la détection.

2/ Télécharge Random's System Information Tool (RSIT) de random/random et enregistre le sur ton Bureau. 
http://images.malwareremoval.com/random/RSIT.exe 

Double-clique sur " RSIT.exe " pour le lancer . 
dans la fenêtre qui va s’ouvrir choisis  1 month pour l'option "List files/folders created ..." , 
 cliques ensuite sur " Continue " pour lancer l'analyse ... 

Si la dernière version de HijackThis n'est pas trouvée sur ton PC, RSIT la téléchargera et te demandera d'accepter la licence. 

Attends jusqu’à la fin de l’analyse.
deux rapports vont être generés. 

Poste uniquement le contenu de " log.txt ", et garde " info.txt " ( dans la barre des tâches), pour analyse, si je te le demande.

Si tu ne les trouves pas, les rapports sont sauvegardés dans le dossier  C:\rsit.

A+

silveren · Answer

voici le rapport log:


Logfile of random's system information tool 1.06 (written by random/random)
Run by HP_Propriétaire at 2009-05-06 20:45:46
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 1 GB (1%) free of 185 GB
Total RAM: 958 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:03, on 06/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\HP_Propriétaire\Bureau\RSIT.exe
C:\Program Files	rend micro\HP_Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Tunebite_WebRipPlugin Class - {AA102584-3B97-47e7-B9BC-75D54C110A7D} - C:\Program Files\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

silveren · Answer

Au fait, AVG anti-rootkit detecte toujours afmae2pq.exe.

verni29 · Answer

Le fichier est bien absent mais ce sont des traces de détectées.
Tu as remarqué que les outils ne donnaient rien.
On nettoie cela.

1/ Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau. 
http://oldtimer.geekstogo.com/OTMoveIt3.exe

* Double-clique sur OTMoveIt.exe pour le lancer. 
* Copie la liste qui se trouve en citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous  Paste Instructions for Items to be Moved. 

:Processes
explorer.exe

:Services
afmae2pq
kojabyap

:Commands
[emptytemp]
[start explorer]
[Reboot]

* clique sur MoveIt! pour lancer la suppression. 
    * Le PC va redémarrer pour supprimer les fichiers.
    * après le redémarrage, un rapport va s'ouvrir.
    * Copie/Colle le contenu du rapport dans ton prochain message.

Si tu ne trouves plus le rapport,c'est un fichier .log qui se trouve en C:\_OTMoveIt\MovedFiles.

2/ Relance AVG Antirootkit.

A+

silveren · Answer

premièrement, merci pour tes logiciels.


J'ai effectué le scan de OTMoveIt3 et voici le rapport:



========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver afmae2pq not found.
Service\Driver afmae2pq not found.
Service\Driver kojabyap not found.
Service\Driver kojabyap not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\etilqs_iHoYcnHXPU3BPk30oFaq scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\~DF3DA6.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_200.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_6b8.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Propriétaire\Local Settings\Application Data\Mozilla\Firefox\Profiles\6n9m01jd.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05062009_212114

Files moved on Reboot...
File C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\etilqs_iHoYcnHXPU3BPk30oFaq not found!
File move failed. C:\WINDOWS	emp\_avast4_\Webshlock.txt scheduled to be moved on reboot.
File C:\WINDOWS	emp\Perflib_Perfdata_200.dat not found!
File C:\WINDOWS	emp\Perflib_Perfdata_6b8.dat not found!

silveren · Answer

Après un nouveau scan de AVG antirootkit, celui-ci ne m'affiche plus le fameux afmae2pq.sys mais un autre apellé awg11t8a.sys qui est dans le meme repertoire.

silveren · Answer

au fait, awg11t8a.sys est aussi "invisible" dans son repretoire.




cordialement

verni29 · Answer

pour les logiciels, ne les utilise pas à la légère.
Il faut connaitre la syntaxe  et les risques pour certains peuvent être grand de les utiliser sans conseil. 

1/ Télécharger DirLook . Enregistrer ce fichier sur le Bureau.  :
http://jpshortstuff.247fixes.com/DirLook.exe 

# Faire un double clic sur DirLook.exe pour lancer l'exécution de l'outil. 
# Vérifier que les deux cases situées derrière "Show hidden files/folders:" et BBCode Output:" sont cochées. 

Sélectionner la ligne ci-dessous : 

C:\Windows\System32\Drivers\

# Dans la petite fenêtre de DirLook, faire un clic droit dans la zone blanche et choisir Coller. 

Note: les lignes sélectionnées précédemment doivent avoir été recopiées dans la zone blanche de DirLook. 

#Cliquer sur le bouton DirLook pour lancer la recherche. 

Lorsque l'outil a terminé cette recherche, il y a ouverture d'une fenêtre du Bloc-notes. 

# Enregistrer ce fichier affiché dans le Bloc-notes sous le nom DirLook1.txt 
# Fermer le Bloc-notes. Fermer DirLook en cliquant sur le bouton Exit. 

Envoyer en réponse.
Si le rapport est trop long, tu me le postes via le site https://www.cjoint.com/
Tu m'indiqueras le lien crée.

Note: ce rapport se trouve aussi à la racine du disque système (dl_log.txt)

2/ Poste moi dans un autre message un rapport RSIT. ( tu as l'icône sur ton bureau )
Il n'y aura qu'un seul rapport cette fois-ci.

A+

silveren · Answer

pour dirlook:

DirLook.exe v2.0 by jpshortstuff
Log created at 21:51 on 06/05/2009
==================================[b]
Contents of "C:\Windows\System32\Drivers\"
[/b]
No files/folders found.

==================================
[b][color=blue]=EOF=[/b][/color]



aisni que RSIT:


zz
Logfile of random's system information tool 1.06 (written by random/random)
Run by HP_Propriétaire at 2009-05-06 21:53:02
Microsoft Windows XP Édition familiale Service Pack 2
System drive C: has 4 GB (2%) free of 185 GB
Total RAM: 958 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:53:18, on 06/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS
otepad.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\HP_Propriétaire\Bureau\RSIT.exe
C:\Program Files	rend micro\HP_Propriétaire.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Tunebite_WebRipPlugin Class - {AA102584-3B97-47e7-B9BC-75D54C110A7D} - C:\Program Files\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

verni29 · Answer

Il y a bien le driver awg11t8a.sys qui est apparu dans le rapport RSIT.
Tout comme l'autre, le fichier est absent.

1/ Pour le rapport avec DirLook, c'est surprenant.
recommence la manip avec DirLook et cette fois-ci tape le dossier :

C:\Windows\system32\drivers

2/ recommence la manip avec OTMoveIT3

Sous Paste Instructions for Items to be Moved, copie/colle ceci.

:Processes
explorer.exe

:Services
awg11t8a

:Commands
[start explorer]

* clique sur MoveIt! pour lancer la suppression.
* Le résultat apparaitra dans le cadre "Results". 

Copie/colle le résultat dans ton prochain message.

Note : le rapport ( fichier .log ) est également situé dans C:\_OTMoveIt\MovedFiles.

A+

verni29 · Answer

Silveren, 

Tiens moi au courant de la suite.
Après OTMoveIT3, relance AVG AntiRootKit.

A+

silveren · Answer

Bonjour verni29,  


desolé pour l'absence. Mais, merci pour l'interet que tu porte à ce topic.


donc voilà le rapport de dirlook comme tu me l'a demandé:


DirLook.exe v2.0 by jpshortstuff
Log created at 17:11 on 08/05/2009
==================================[b]
Contents of "C:\Windows\system32\drivers"
[/b]
[b][color=blue]---FOLDERS---[/b][/color]

[b]disdn[/b] (Created on 20/10/2005 at 19:08) d-----
[b]etc[/b] (Created on 26/10/2005 at 23:22) d-----
[b]UMDF[/b] (Created on 16/02/2009 at 21:08) d-----

[b][color=blue]---FILES---[/b][/color]

[b]103C_HP_CPC_ES081AA-ABF s7410.fr_YC_0Pavi_QCNH612_E62FRheBLA2_48_IOpal_SASUSTek Computer INC._V1.02_B3.03_T051202_WXH2_L40C_M959_J200_7AMD_8Turion 64 Technology MT-32_91.79_#060410_N10EC8139_Z_G10025954.MRK[/b] (1843 bytes - created on 14/04/2008 at 17:33, modified on 14/04/2008 at 17:33) -rahs-
[b]1394bus.sys[/b] (53248 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]aavmker4.sys[/b] (26944 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:05) --a---
[b]acpi.sys[/b] (188672 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]acpiec.sys[/b] (12032 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]aec.sys[/b] (142464 bytes - created on 28/02/2006 at 04:15, modified on 15/02/2006 at 00:22) --a---
[b]afd.sys[/b] (138368 bytes - created on 05/08/2004 at 11:00, modified on 14/08/2008 at 09:51) --a---
[b]ALCXWDM.SYS[/b] (3644928 bytes - created on 28/02/2006 at 04:15, modified on 29/08/2005 at 22:11) --a---
[b]amdk6.sys[/b] (41216 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]amdk7.sys[/b] (41600 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]AmdK8.sys[/b] (43008 bytes - created on 28/02/2006 at 04:16, modified on 09/03/2005 at 20:53) --a---
[b]arp1394.sys[/b] (60800 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]aswFsBlk.sys[/b] (20560 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:07) --a---
[b]aswmon.sys[/b] (93296 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:08) --a---
[b]aswmon2.sys[/b] (94032 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:08) --a---
[b]aswRdr.sys[/b] (23152 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:06) --a---
[b]aswSP.sys[/b] (114768 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:07) --a---
[b]aswTdi.sys[/b] (51376 bytes - created on 15/04/2008 at 08:23, modified on 05/02/2009 at 21:06) --a---
[b]asyncmac.sys[/b] (14336 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]atapi.sys[/b] (95360 bytes - created on 05/08/2004 at 11:00, modified on 04/08/2004 at 04:59) --a---
[b]ati2erec.dll[/b] (40960 bytes - created on 28/02/2006 at 04:14, modified on 14/08/2005 at 03:41) --a---
[b]ati2mtag.sys[/b] (1313792 bytes - created on 28/02/2006 at 04:14, modified on 14/08/2005 at 04:35) --a---
[b]ativcaxx.cpa[/b] (524850 bytes - created on 28/02/2006 at 04:14, modified on 14/07/2005 at 21:08) --a---
[b]ativcaxx.vp[/b] (929 bytes - created on 28/02/2006 at 04:14, modified on 14/07/2005 at 21:08) --a---
[b]ativckxx.vp[/b] (58560 bytes - created on 28/02/2006 at 04:14, modified on 08/06/2005 at 21:45) --a---
[b]ativvpxx.vp[/b] (22944 bytes - created on 28/02/2006 at 04:14, modified on 14/08/2005 at 07:15) --a---
[b]atmarpc.sys[/b] (59904 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]atmepvc.sys[/b] (31360 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]atmlane.sys[/b] (55936 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]atmuni.sys[/b] (352256 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]audstub.sys[/b] (3072 bytes - created on 17/08/2001 at 20:59, modified on 17/08/2001 at 20:59) --a---
[b]AvgArCln.sys[/b] (3968 bytes - created on 29/04/2009 at 19:04, modified on 18/01/2007 at 12:00) --a---
[b]avgarkt.sys[/b] (5632 bytes - created on 31/01/2007 at 13:33, modified on 31/01/2007 at 13:33) --a---
[b]Awrtpd.sys[/b] (12960 bytes - created on 29/04/2008 at 09:19, modified on 29/04/2008 at 09:19) --a---
[b]Awrtrd.sys[/b] (15648 bytes - created on 29/04/2008 at 09:19, modified on 29/04/2008 at 09:19) --a---
[b]beep.sys[/b] (4224 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]bridge.sys[/b] (71552 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]bthport.sys[/b] (272768 bytes - created on 11/06/2008 at 09:16, modified on 14/06/2008 at 17:59) ------
[b]cbidf2k.sys[/b] (13952 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]CCDECODE.sys[/b] (17024 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]cdaudio.sys[/b] (18688 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]cdfs.sys[/b] (63744 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]cdr4_xp.sys[/b] (9336 bytes - created on 17/09/2008 at 15:32, modified on 23/07/2008 at 16:50) ------
[b]cdralw2k.sys[/b] (9464 bytes - created on 17/09/2008 at 15:32, modified on 23/07/2008 at 16:50) ------
[b]cdrom.sys[/b] (49536 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]cinemst2.sys[/b] (262528 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]classpnp.sys[/b] (49664 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]cpqdap01.sys[/b] (11776 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]crusoe.sys[/b] (40704 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]disk.sys[/b] (36352 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]diskdump.sys[/b] (14208 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]dmboot.sys[/b] (800256 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]dmio.sys[/b] (154496 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]dmload.sys[/b] (5888 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]DMusic.sys[/b] (52864 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 05:07) --a---
[b]drmk.sys[/b] (60288 bytes - created on 28/02/2006 at 04:15, modified on 03/08/2004 at 22:08) --a---
[b]drmkaud.sys[/b] (2944 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 05:07) --a---
[b]DVDAccss.sys[/b] (29156 bytes - created on 24/08/2008 at 11:16, modified on 21/11/2003 at 14:15) --a---
[b]dxapi.sys[/b] (10496 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]dxg.sys[/b] (71040 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]dxgthk.sys[/b] (3328 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]enum1394.sys[/b] (6400 bytes - created on 17/08/2001 at 20:46, modified on 17/08/2001 at 20:46) --a---
[b]fastfat.sys[/b] (143360 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]fdc.sys[/b] (27392 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]fips.sys[/b] (35072 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]flpydisk.sys[/b] (20480 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]fltmgr.sys[/b] (128896 bytes - created on 05/08/2004 at 11:00, modified on 21/08/2006 at 09:14) --a---
[b]fsvga.sys[/b] (12416 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]fs_rec.sys[/b] (7936 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]ftdisk.sys[/b] (126080 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]gm.dls[/b] (3440660 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]gmreadme.txt[/b] (646 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]Hdaudbus.sys[/b] (138752 bytes - created on 07/01/2005 at 23:07, modified on 07/01/2005 at 23:07) ------
[b]Hdaudio.sys[/b] (145920 bytes - created on 07/01/2005 at 23:07, modified on 07/01/2005 at 23:07) ------
[b]hidclass.sys[/b] (36224 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]hidparse.sys[/b] (24960 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]hidusb.sys[/b] (9600 bytes - created on 14/04/2008 at 17:26, modified on 17/08/2001 at 20:02) --a---
[b]HPZid412.sys[/b] (51120 bytes - created on 28/02/2006 at 11:52, modified on 08/03/2005 at 20:52) --a---
[b]HPZipr12.sys[/b] (16496 bytes - created on 28/02/2006 at 11:52, modified on 08/03/2005 at 20:52) --a---
[b]HPZius12.sys[/b] (21744 bytes - created on 28/02/2006 at 11:52, modified on 08/03/2005 at 20:52) --a---
[b]http.sys[/b] (262784 bytes - created on 05/08/2004 at 11:00, modified on 17/03/2006 at 00:33) --a---
[b]i8042prt.sys[/b] (54400 bytes - created on 05/08/2004 at 11:00, modified on 03/08/2004 at 22:41) --a---
[b]imapi.sys[/b] (41856 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]intelide.sys[/b] (5504 bytes - created on 03/08/2004 at 23:43, modified on 04/08/2004 at 06:43) --a---
[b]ip6fw.sys[/b] (29056 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]ipfltdrv.sys[/b] (32896 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]ipinip.sys[/b] (20992 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]ipnat.sys[/b] (134912 bytes - created on 05/08/2004 at 11:00, modified on 29/09/2004 at 22:28) --a---
[b]ipsec.sys[/b] (74752 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]irenum.sys[/b] (11264 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]isapnp.sys[/b] (36224 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]kbdclass.sys[/b] (25216 bytes - created on 05/08/2004 at 11:00, modified on 03/08/2004 at 22:45) --a---
[b]kbdhid.sys[/b] (14848 bytes - created on 10/12/2008 at 18:20, modified on 03/08/2004 at 23:45) --a---
[b]kmixer.sys[/b] (172416 bytes - created on 28/02/2006 at 04:15, modified on 14/06/2006 at 08:47) --a---
[b]ks.sys[/b] (140928 bytes - created on 05/08/2004 at 11:00, modified on 03/08/2004 at 22:15) --a---
[b]ksecdd.sys[/b] (92032 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]ltmdmnt.sys[/b] (607452 bytes - created on 03/08/2004 at 23:46, modified on 03/08/2004 at 23:46) --a---
[b]mcd.sys[/b] (7680 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]mf.sys[/b] (63744 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]mnmdd.sys[/b] (4224 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]modem.sys[/b] (30336 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]mouclass.sys[/b] (23680 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]mouhid.sys[/b] (12288 bytes - created on 14/04/2008 at 17:26, modified on 23/08/2001 at 15:04) --a---
[b]mountmgr.sys[/b] (42240 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]mrxdav.sys[/b] (179584 bytes - created on 05/08/2004 at 11:00, modified on 18/12/2007 at 09:51) --a---
[b]mrxsmb.sys[/b] (453632 bytes - created on 05/08/2004 at 11:00, modified on 24/10/2008 at 11:10) --a---
[b]msfs.sys[/b] (19072 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]msgpc.sys[/b] (35072 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]MSKSSRV.sys[/b] (7552 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 04:58) --a---
[b]MSPCLOCK.sys[/b] (5376 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 04:58) --a---
[b]MSPQM.sys[/b] (4992 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 04:58) --a---
[b]mssmbios.sys[/b] (15488 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]MSTEE.sys[/b] (5504 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 20:58) --a---
[b]mup.sys[/b] (107904 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]MWhid.sys[/b] (13332 bytes - created on 03/11/2004 at 11:20, modified on 03/11/2004 at 11:20) --a---
[b]NABTSFEC.sys[/b] (85376 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]ndis.sys[/b] (182912 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]NdisIP.sys[/b] (10880 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]ndistapi.sys[/b] (9600 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]ndisuio.sys[/b] (14592 bytes - created on 05/08/2004 at 11:00, modified on 20/04/2005 at 06:54) --a---
[b]ndiswan.sys[/b] (91776 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]ndproxy.sys[/b] (38016 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]netbios.sys[/b] (34560 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]netbt.sys[/b] (162816 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]nic1394.sys[/b] (61824 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]nikedrv.sys[/b] (12032 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]nmnt.sys[/b] (40320 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]npfs.sys[/b] (30848 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]NSDriver.sys[/b] (15648 bytes - created on 29/04/2008 at 09:20, modified on 29/04/2008 at 09:20) --a---
[b]ntfs.sys[/b] (574464 bytes - created on 05/08/2004 at 11:00, modified on 09/02/2007 at 11:10) --a---
[b]null.sys[/b] (2944 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]nwlnkflt.sys[/b] (12416 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]nwlnkfwd.sys[/b] (32512 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]nwlnkipx.sys[/b] (88448 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]nwlnknb.sys[/b] (63232 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]nwlnkspx.sys[/b] (55936 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]ohci1394.sys[/b] (61056 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]oprghdlr.sys[/b] (3456 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]p3.sys[/b] (46720 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]parport.sys[/b] (80384 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]partmgr.sys[/b] (18688 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]parvdm.sys[/b] (6912 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]pcdrndisuio.sys[/b] (13440 bytes - created on 28/02/2006 at 04:44, modified on 19/11/2005 at 02:58) --a---
[b]pci.sys[/b] (68608 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]pciide.sys[/b] (3328 bytes - created on 05/08/2004 at 04:00, modified on 23/08/2001 at 23:15) --a---
[b]pciidex.sys[/b] (25088 bytes - created on 05/08/2004 at 11:00, modified on 04/08/2004 at 04:59) --a---
[b]pcmcia.sys[/b] (120320 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]pcouffin.sys[/b] (47360 bytes - created on 26/12/2008 at 14:12, modified on 28/12/2008 at 19:31) --a---
[b]PFC.SYS[/b] (14572 bytes - created on 24/08/2008 at 11:16, modified on 11/02/2002 at 12:15) --a---
[b]portcls.sys[/b] (136960 bytes - created on 16/03/2004 at 16:58, modified on 16/03/2004 at 16:58) --a---
[b]processr.sys[/b] (39552 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]PS2.sys[/b] (19072 bytes - created on 28/02/2006 at 04:29, modified on 12/12/2005 at 23:27) --a---
[b]psched.sys[/b] (69120 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]pssdk31.drv[/b] (30272 bytes - created on 29/11/2008 at 09:22, modified on 29/11/2008 at 09:22) --a---
[b]ptilink.sys[/b] (17792 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]pxhelp20.sys[/b] (43528 bytes - created on 25/04/2005 at 08:03, modified on 21/03/2008 at 20:30) ------
[b]rasacd.sys[/b] (8832 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]rasl2tp.sys[/b] (51328 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]raspppoe.sys[/b] (41472 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]raspptp.sys[/b] (48384 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]raspti.sys[/b] (16512 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]rawwan.sys[/b] (34432 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]rdbss.sys[/b] (174592 bytes - created on 05/08/2004 at 11:00, modified on 05/05/2006 at 09:47) --a---
[b]rdpcdd.sys[/b] (4224 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]rdpdr.sys[/b] (196864 bytes - created on 03/08/2004 at 21:01, modified on 03/08/2004 at 21:01) --a---
[b]rdpwd.sys[/b] (139528 bytes - created on 05/08/2004 at 11:00, modified on 10/06/2005 at 04:11) --a---
[b]redbook.sys[/b] (58496 bytes - created on 03/08/2004 at 23:39, modified on 03/08/2004 at 23:39) --a---
[b]rio8drv.sys[/b] (12032 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]riodrv.sys[/b] (12032 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]rmcast.sys[/b] (202752 bytes - created on 05/08/2004 at 04:00, modified on 08/05/2008 at 12:28) --a---
[b]rndismp.sys[/b] (30080 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]rootmdm.sys[/b] (5888 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]RTL8139.sys[/b] (20992 bytes - created on 03/08/2004 at 21:31, modified on 03/08/2004 at 21:31) --a---
[b]Rtnicxp.sys[/b] (78720 bytes - created on 28/02/2006 at 04:16, modified on 30/09/2005 at 18:11) --a---
[b]scsiport.sys[/b] (96256 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]sdbus.sys[/b] (67584 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]secdrv.sys[/b] (20480 bytes - created on 05/08/2004 at 04:00, modified on 13/11/2007 at 10:25) --a---
[b]serenum.sys[/b] (15488 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]serial.sys[/b] (66560 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]sffdisk.sys[/b] (11136 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]sffp_sd.sys[/b] (10240 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]sfloppy.sys[/b] (11392 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]SLIP.sys[/b] (11136 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]smclib.sys[/b] (14592 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]sonydcam.sys[/b] (25472 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]splitter.sys[/b] (6400 bytes - created on 28/02/2006 at 04:15, modified on 14/06/2006 at 08:47) --a---
[b]sptd.sys[/b] (717296 bytes - created on 17/04/2008 at 07:44, modified on 17/04/2008 at 07:44) --a---
[b]sr.sys[/b] (73600 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]srv.sys[/b] (333184 bytes - created on 05/08/2004 at 11:00, modified on 11/12/2008 at 11:57) --a---
[b]stream.sys[/b] (48640 bytes - created on 05/08/2004 at 11:00, modified on 03/08/2004 at 22:08) --a---
[b]StreamIP.sys[/b] (15360 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]swenum.sys[/b] (4352 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]swmidi.sys[/b] (54272 bytes - created on 28/02/2006 at 04:15, modified on 18/08/2001 at 04:00) --a---
[b]Sxgbvswp.sys[/b] (1079168 bytes - created on 09/05/2008 at 14:34, modified on 25/06/2001 at 09:29) --a---
[b]sysaudio.sys[/b] (60800 bytes - created on 28/02/2006 at 04:15, modified on 04/08/2004 at 05:15) --a---
[b]tape.sys[/b] (14976 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]tbhsd.sys[/b] (37664 bytes - created on 23/01/2009 at 08:49, modified on 23/01/2009 at 08:49) --a---
[b]tcpip.sys[/b] (360320 bytes - created on 05/08/2004 at 11:00, modified on 20/06/2008 at 10:45) --a---
[b]tcpip6.sys[/b] (225920 bytes - created on 05/08/2004 at 11:00, modified on 20/06/2008 at 09:52) --a---
[b]tdi.sys[/b] (18560 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]tdpipe.sys[/b] (12040 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]tdtcp.sys[/b] (21896 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]termdd.sys[/b] (40840 bytes - created on 03/08/2004 at 22:55, modified on 03/08/2004 at 22:55) --a---
[b]tosdvd.sys[/b] (51712 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]tsbvcap.sys[/b] (21376 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]tunmp.sys[/b] (12416 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]udfs.sys[/b] (66176 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]update.sys[/b] (209408 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usb8023.sys[/b] (12672 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usbcamd.sys[/b] (23808 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usbcamd2.sys[/b] (23936 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usbccgp.sys[/b] (31616 bytes - created on 16/04/2008 at 13:30, modified on 03/08/2004 at 21:08) --a---
[b]usbd.sys[/b] (4736 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]usbehci.sys[/b] (27008 bytes - created on 05/08/2004 at 11:00, modified on 31/03/2005 at 08:13) --a---
[b]usbhub.sys[/b] (57600 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usbintel.sys[/b] (16000 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]USBkey.sys[/b] (28848 bytes - created on 28/02/2006 at 04:44, modified on 19/11/2005 at 02:51) --a---
[b]usbohci.sys[/b] (17024 bytes - created on 28/02/2006 at 03:58, modified on 04/08/2004 at 05:08) --a---
[b]usbport.sys[/b] (142976 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]usbprint.sys[/b] (25856 bytes - created on 16/04/2008 at 13:30, modified on 03/08/2004 at 21:01) --a---
[b]usbscan.sys[/b] (15104 bytes - created on 16/04/2008 at 13:30, modified on 03/08/2004 at 20:58) --a---
[b]USBSTOR.SYS[/b] (26496 bytes - created on 28/02/2006 at 03:59, modified on 04/08/2004 at 05:08) --a---
[b]usbuhci.sys[/b] (20480 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]V0260Cmd.sys[/b] (24829 bytes - created on 26/08/2008 at 20:06, modified on 22/03/2006 at 12:23) -ra---
[b]V0260Vid.sys[/b] (162176 bytes - created on 26/08/2008 at 20:06, modified on 01/04/2006 at 15:16) -ra---
[b]vdmindvd.sys[/b] (58112 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]vga.sys[/b] (20992 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]viaide.sys[/b] (5376 bytes - created on 28/02/2006 at 05:02, modified on 04/08/2004 at 04:59) --a---
[b]videoprt.sys[/b] (79744 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]volsnap.sys[/b] (53376 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]wanarp.sys[/b] (34560 bytes - created on 05/08/2004 at 11:00, modified on 05/08/2004 at 11:00) --a---
[b]wdmaud.sys[/b] (82944 bytes - created on 28/02/2006 at 04:15, modified on 14/06/2006 at 09:00) --a---
[b]wmilib.sys[/b] (4352 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]wn5301.sys[/b] (468768 bytes - created on 28/02/2006 at 04:16, modified on 05/10/2005 at 17:44) --a---
[b]wpdusb.sys[/b] (38528 bytes - created on 11/08/2004 at 04:05, modified on 18/10/2006 at 20:00) --a---
[b]ws2ifsl.sys[/b] (12032 bytes - created on 05/08/2004 at 04:00, modified on 05/08/2004 at 04:00) --a---
[b]WSTCODEC.SYS[/b] (19328 bytes - created on 26/08/2008 at 20:06, modified on 03/08/2004 at 21:10) --a---
[b]WudfPf.sys[/b] (77568 bytes - created on 28/09/2006 at 17:55, modified on 28/09/2006 at 17:55) ------
[b]WudfRd.sys[/b] (82944 bytes - created on 28/09/2006 at 18:00, modified on 28/09/2006 at 18:00) ------
[b]ymidusb.sys[/b] (18048 bytes - created on 26/02/2009 at 11:02, modified on 07/11/2007 at 02:25) -ra---

==================================
[b][color=blue]=EOF=[/b][/color]







et celui de OTmove:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver awg11t8a not found.
Service\Driver awg11t8a not found.
========== COMMANDS ==========
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05082009_171424




Donc après celà, j'ai refait le scan avec AVG antirootkit:
celui-ci ne me signale plus awg11t8a.sys ni afmae2pq.sys MAIS encore un autre appelé ah4ko11n.sys, aussi "invisible" dans son repertoire.





cordialement

verni29 · Answer

OK,

1/ Ce problème peut venir d'un logiciel.
Alcohol soft ou Daemon Tools sont-ils installé  sur ton PC ?
Ils utilisent des drivers aux noms aléatoires.

2/ Dans le dossier C:\RSIT, tu trouveras un rapport info.txt.
Poste-le.

A+

Je suis absent ce soir. Demain oui, je serais plus présent.

silveren · Answer

"  1/ Ce problème peut venir d'un logiciel.
Alcohol soft ou Daemon Tools sont-ils installé sur ton PC ?
Ils utilisent des drivers aux noms aléatoires. "

J'ai effectivement Daemon Tools.




"2/ Dans le dossier C:\RSIT, tu trouveras un rapport info.txt.
Poste-le. "


Ok, le voilà:




info.txt logfile of random's system information tool 1.06 2009-05-06 20:46:05

======Uninstall list======

-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->c:\WINDOWS\system32\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x40c 
-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EAF97B2C-0B9B-403C-829C-EF8099237DA9}\setup.exe" -l0x40c 
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70000000000}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AmazingMIDI-->C:\PROGRA~1\AMAZIN~1\UNWISE.EXE C:\PROGRA~1\AMAZIN~1\INSTALL.LOG
Amélioration de nos services-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1036 
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Audacity 1.3.4 (Unicode)-->"C:\Program Files\Audacity 1.3 Beta (Unicode)\unins000.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AVG Anti-Rootkit Free-->C:\Program Files\GRISOFT\AVG Anti-Rootkit Free\Uninstall.exe
AviSplit Classic Version 1.43-->"C:\Program Files\bobyte\AviSplit classic\unins000.exe"
BB26008 Livrée en Voyage-->C:\Program Files\Microsoft Games\Train Simulator\TRAINS\TRAINSET\BB26000NL\Uninstal.exe
BestPractice (remove only)-->"C:\Program Files\BestPractice\uninstall.exe"
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Burn4Free CD and DVD-->"C:\Program Files\Burn4Free\uninstall.exe"
Connexion Facile à Internet-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1036 
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB893357)-->"C:\WINDOWS\$NtUninstallKB893357$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB906569)-->"C:\WINDOWS\$NtUninstallKB906569$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif Windows XP - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Correctif Windows XP - KB883667-->C:\WINDOWS\$NtUninstallKB883667$\spuninst\spuninst.exe
Correctif Windows XP - KB885250-->C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
Correctif Windows XP - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Correctif Windows XP - KB887742-->C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
Correctif Windows XP - KB888113-->C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
Correctif Windows XP - KB888239-->C:\WINDOWS\$NtUninstallKB888239$\spuninst\spuninst.exe
Correctif Windows XP - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890175-->C:\WINDOWS\$NtUninstallKB890175$\spuninst\spuninst.exe
Correctif Windows XP - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Correctif Windows XP - KB892050-->"C:\WINDOWS\$NtUninstallKB892050$\spuninst\spuninst.exe"
Correctif Windows XP - KB893066-->"C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe"
Creative Live! Cam Vista IM Driver (1.00.07.0401)-->C:\WINDOWS\CtDrvIns.exe -uninstall -script VF0260.uns -unsext NT -plugin V0260Pin.dll -pluginres CtCamPin.crl
Creative Live! Cam Vista IM-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E38CA14-8D20-45CF-8850-8F6213465D00}\SETUP.EXE" -l0x40c  /remove
Creative Software AutoUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{88B1984E-36F0-47B8-B8DC-728966807A9C}\SETUP.EXE" -l0x40c  /remove
Creative System Information-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x40c  /remove
Creative WebCam Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E5ABA5FD-EE3D-4F15-895D-B32321E6C96B}\setup.exe" -l0x40c  /remove
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"
DVD@ccess 2.0.3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2B34414C-14FB-11D6-A329-0050045C24B2}\Setup.exe" -l0x9 
DVDFab Platinum-->C:\Program Files\DVDFab 5\Uninstall.exe
eX-Sense PRO!-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\eX-Sense\ST6UNST.LOG"  
Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
FrostWire 4.17.0-->C:\Program Files\FrostWire\Uninstall.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_BDA1448D3D255554.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files	rend micro\HijackThis.exe" /uninstall
HomePlayer 1.5.6b-->C:\Program Files\HomePlayer\uninst.exe
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
HP Appareils photos Photosmart 5.0-->C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Boot Optimizer-->C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
HP Deskjet Printer Preload-->MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP Document Viewer 5.3-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 1.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe"  -uninstall
HP Imaging Device Functions 6.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Multimedia Keyboard Software-->C:\HP\KBD\Install.exe /remove
HP Photosmart 330,380,420,470,7800,8000,8200 Series-->C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart Premier Software 6.0-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update-->MsiExec.exe /X{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}
HP Solution Center & Imaging Support Tools 5.3-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
Installer Yahoo! Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EAF97B2C-0B9B-403C-829C-EF8099237DA9}\setup.exe" -l0x40c  /remove
J2SE Runtime Environment 5.0 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150050}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 1.64-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Manuel d'utilisation de Creative Live! Cam Vista IM (Français)-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Creative\Creative Live! Cam Vista IM\Manuel d'utilisation de Creative Live! Cam Vista IM\French\CTManual.isu"
MegaStore-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{78FAAF25-07DA-11D9-B095-009027EC0701} 
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Excel Viewer 2003-->MsiExec.exe /I{90840409-6000-11D3-8CFE-0150048383C9}
Microsoft Train Simulator-->"C:\Program Files\Microsoft Games\Train Simulator\UNINSTAL.EXE" /runtemp /addremove
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
MidiPlayer-->C:\WINDOWS\st6unst.exe -n "C:\Program Files\MidiPlayer\ST6UNST.LOG"  
Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896422)-->"C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896424)-->"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901190)-->"C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905915)-->"C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
MovieXone 4.0-->MsiExec.exe /X{86BC19C8-EC91-4260-9D32-F3A7ADC3C433}
Moyea FLV Downloader version 1.15.0.15-->"C:\Program Files\Moyea\FLV Downloader\unins000.exe"
Mozilla Firefox (3.0.8)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
muvee autoProducer 4.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E073D315-3C54-44BF-A1B2-B5583AEA618C}\setup.exe" -l0x40c 
Panneau de contrôle ATI-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" 
PC Inspector File Recovery-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}\Setup.exe" -l0x40c 
PC-Doctor 5 for Windows-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
PhotoFiltre-->"C:\Program Files\PhotoFiltre\Uninst.exe"
PianoFX STUDIO 4.0-->"C:\Program Files\PianoFX\unins000.exe"
PixiePack Codec Pack-->MsiExec.exe /I{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC}
PS2-->C:\WINDOWS\system32\ps2.exe uninstall
Python 2.2 pywin32 extensions (build 203)-->"C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3-->C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
RGSS de RMXP version 1.0.1-->"C:\Program Files\Bodom-Child - RaBBi\RGSS\unins000.exe"
RMXP version 1.01-->"C:\Program Files\Bodom-Child - RaBBi\RMXP\unins000.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Services Internet-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{5CFD7508-7774-48FE-8280-7A3C0AE71755} /l1036 
Shareaza 2.4.0.0-->"C:\Program Files\Shareaza\Uninstall\unins000.exe"
Sonic Express Labeler-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio-->MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy-->MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data-->MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager-->MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SUPER © Version 2009.bld.35 (Jan 5, 2009)-->C:\PROGRA~1\ERIGHT~1\SUPER\Setup.exe /remove /q0
Total Video Converter 3.10-->"C:\Program Files\Total Video Converter\unins000.exe"
Train Sim Interface Quick Fix-->C:\WINDOWS\iun507.exe C:\Program Files\Microsoft Games\Train Simulator\irunin.ini
TubeMaster-->"C:\Program Files\TubeMaster\uninstall.exe"
Unlocker 1.8.7-->C:\Program Files\Unlocker\uninst.exe
Update for Windows XP (KB953356)-->"C:\WINDOWS\$NtUninstallKB953356$\spuninst\spuninst.exe"
VideoLAN VLC media player 0.8.6f-->C:\Program Files\VideoLAN\VLC\uninstall.exe
VirtuallyJenna K17 570 MOD-->"C:\Documents and Settings\HP_Propriétaire\Thrixxx\VirtuallyJenna K17\Save\unins000.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Yahoo! Anti-Spy-->C:\PROGRA~1\Yahoo!\Common\unypsr.exe
YAMAHA Tyros3 Voice Editor-->C:\Program Files\InstallShield Installation Information\{9464C58E-67D4-4DD5-A424-D8B1F2BB71D5}\setup.exe -runfromtemp -l0x040c -removeonly
YAMAHA XG SoftSynthesizer S-YXG50 -->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B713000F-FBE3-11D3-9D91-0050DA5C3DCF}\Setup.exe" -l0x40c 
YouTUBE (TM) movie downloader-->MsiExec.exe /X{2F8BE445-D14C-40E2-AF62-E43539FD1500}

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: avast! antivirus 4.8.1335 [VPS 090505-0]

======System event log======

Computer Name: NOM-EB85C523610
Event Code: 62486
Message: Invalid parameters

Record Number: 208550
Source Name: ati2mtag
Time Written: 20090503124255.000000+120
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 62486
Message: Invalid parameters

Record Number: 208549
Source Name: ati2mtag
Time Written: 20090503124255.000000+120
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 62486
Message: Invalid parameters

Record Number: 208548
Source Name: ati2mtag
Time Written: 20090503124255.000000+120
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 62486
Message: Invalid parameters

Record Number: 208547
Source Name: ati2mtag
Time Written: 20090503124255.000000+120
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 62486
Message: Invalid parameters

Record Number: 208546
Source Name: ati2mtag
Time Written: 20090503124255.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: NOM-EB85C523610
Event Code: 12001
Message: The Messenger Sharing USN Journal Reader service started successfully.

Record Number: 5
Source Name: usnjsvc
Time Written: 20090312085510.000000+060
Event Type: 
User: 

Computer Name: NOM-EB85C523610
Event Code: 0
Message: 
Record Number: 4
Source Name: .NET Runtime
Time Written: 20090312085439.000000+060
Event Type: erreur
User: 

Computer Name: NOM-EB85C523610
Event Code: 1800
Message: Le service Centre de sécurité Windows a démarré.

Record Number: 3
Source Name: SecurityCenter
Time Written: 20090312085333.000000+060
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 1
Message: 
Record Number: 2
Source Name: Bonjour Service
Time Written: 20090312085333.000000+060
Event Type: Informations
User: 

Computer Name: NOM-EB85C523610
Event Code: 4
Message: The LightScribe Service started successfully.

Record Number: 1
Source Name: LightScribeService
Time Written: 20090312085330.000000+060
Event Type: Informations
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\K-Lite Codec Pack\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 36 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2402
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=c:\Program Files\Fichiers communs\Sonic Shared\Sonic Central\
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

-----------------EOF-----------------





cordialement

verni29 · Answer

On va vérifier si le problème vient bien de ce logiciel.
Tu me dis que tu l'as sur ton PC mais je ne le remarque pas dans le rapport RSIT.

1/ Désinstalle Daemon Tools. 

2/ Tu relances OTMoveIT3 et colle ceci sous Paste instructions for Items to be Moved :

:Processes
explorer.exe

:Services
ah4ko11n

:Commands
[start explorer]

* clique sur MoveIt! pour lancer la suppression.
* Le résultat apparaitra dans le cadre "Results".

Copie/colle le résultat dans ton prochain message.

3/ Fais un nettoyage du disque dur avec un logiciel comme CCleaner :
http://www.commentcamarche.net/telecharger/telecharger 168 ccleaner
Tu nettoies le registre et les fichiers.

4/ Relance AVG Antirootkit.
On va voir si il détecte quelque chose.

A+

Afmae2pq.sys = rootkit?

20 réponses

Votre réponse

Discussions similaires

Newsletters