Trojan sous Vista !!! HELP !!!!

Question

Bonjour,
J'ai attrapé un Trojan qui se nomme : Trojan Dropper Agent!IK
Impossible de le supprimer avec A-squared, Avg, spywareterminator et bien d'autre

Est-ce que quelqu'un peu me guider et m'aider à supprimer cette grosse m---- de mon PC

Merci beaucoup....

V-X · Answer

Salut,

Télécharge OTViewIt (de OldTimer) sur ton Bureau.

/!\ Désactive ton Antivirus,antispyware,pare-feu /!\

Double clique sur le raccourci présent sur le Bureau)

]Coche la case "Scan All User"

Sous "File Age" en haut, clique sur le menu déroulant et sélectionne "90 days".

Clique sur "Run Scan"

/!\ Laisse Travailler l'outil /!\

2 rapports s'afficheront sur ton bureau OTViewIt ainsi que Extra.TxT.

Poste le rapport OTViewIt

Re@per · Answer

Ok je vais le faire... 
Merci pour la rapidité

Re@per · Answer

Voici le rapport OTViewIt comme tu me la demandé :

OTViewIt logfile created on: 13/05/2009 01:07:55 - Run 4
OTViewIt by OldTimer - Version 1.0.21.0     Folder = C:\Users\Reaper\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy
 
2,00 Gb Total Physical Memory | 1,72 Gb Available Physical Memory | 86,16% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 100,00% Paging File free
Paging file location(s): ?:\pagefile.sys;
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 84,74 Gb Total Space | 11,05 Gb Free Space | 13,04% Space Free | Partition Type: NTFS
Drive D: | 56,49 Gb Total Space | 37,63 Gb Free Space | 66,62% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: PC-DE-BENOIT
Current User Name: Reaper
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
File Age = 90 Days
 
[color=orange]========== Processes ==========[/color]
 
[2008/01/19 09:33:37 | 00,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wininit.exe
[2008/01/19 09:33:14 | 00,229,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\lsm.exe
[2009/01/30 09:12:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32
vvsvc.exe
[2008/01/19 09:33:22 | 02,623,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLsvc.exe
[2006/11/02 11:45:37 | 00,044,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32undll32.exe
[2008/01/19 09:33:40 | 00,142,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\WUDFHost.exe
[2008/01/19 09:33:08 | 00,081,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwm.exe
[2007/05/18 12:31:16 | 00,073,728 | ---- | M] () -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
[2007/02/06 04:13:14 | 00,094,208 | ---- | M] () -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe
[2008/01/19 09:33:39 | 00,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wlanext.exe
[2007/05/15 19:47:48 | 00,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe
[2008/01/19 09:33:32 | 00,169,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32	askeng.exe
[2008/01/19 09:33:32 | 00,169,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32	askeng.exe
[2007/02/09 20:38:36 | 00,049,520 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe
[2007/04/19 21:32:08 | 00,225,280 | ---- | M] (ATK0100) -- C:\Program Files\ATK Hotkey\Hcontrol.exe
[2007/01/18 05:26:36 | 07,708,672 | ---- | M] () -- C:\Program Files\ATKOSD2\ATKOSD2.exe
[2006/12/21 09:03:38 | 01,036,288 | ---- | M] () -- C:\Program Files\Wireless Console 2\wcourier.exe
[2007/06/07 21:44:56 | 00,176,128 | ---- | M] (ATK) -- C:\Program Files\P4G\BatteryLife.exe
[2007/01/18 06:41:34 | 00,843,776 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
[2005/07/07 01:43:42 | 00,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
[2009/03/06 01:04:30 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
[2008/03/13 17:49:56 | 00,472,320 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
[2006/12/19 03:26:26 | 02,420,736 | ---- | M] () -- C:\Program Files\ATK Hotkey\ATKOSD.exe
[2007/04/16 12:33:18 | 00,647,168 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
[2007/02/12 14:38:04 | 00,355,096 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
[2006/10/26 14:40:34 | 00,335,872 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
[2008/10/20 22:18:26 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe
[2007/04/17 23:39:42 | 00,077,824 | ---- | M] () -- C:\Program Files\ATK Hotkey\KBFiltr.exe
[2008/11/18 11:01:20 | 00,139,912 | ---- | M] (SPAMfighter) -- C:\Program Files\Fighters\configservice.exe
[2007/04/16 12:14:24 | 00,327,680 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
[2009/01/14 18:53:02 | 00,226,656 | ---- | M] (Microsoft Corp.) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
[2006/12/29 02:17:50 | 00,123,248 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
[2009/04/28 14:09:33 | 00,487,424 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
[2008/05/27 07:18:43 | 00,439,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SearchIndexer.exe
[2008/01/19 09:38:38 | 01,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
[2007/03/23 13:04:54 | 04,423,680 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
[2006/11/21 19:31:26 | 00,630,784 | ---- | M] (Motorola Inc.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
[2006/11/02 18:27:32 | 00,061,440 | ---- | M] (ASUSTeK Computer INC.) -- C:\Program Files\ASUS\ATK Media\DMedia.exe
[2006/09/12 03:22:14 | 00,155,648 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apoint.exe
[2007/02/12 14:37:58 | 00,174,872 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
[2008/03/13 17:48:30 | 01,443,072 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
[2008/01/19 09:33:32 | 00,169,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32	askeng.exe
[2007/02/01 20:58:52 | 00,987,648 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Program Files\ASUS\ASUS Direct Console\LCMP.exe
[2009/01/15 14:54:18 | 00,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe
[2005/11/25 11:53:40 | 00,155,648 | ---- | M] () -- C:\Program Files\Razer\Copperheadazerhid.exe
[2008/10/25 11:44:34 | 00,031,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[2008/11/06 13:41:14 | 00,358,920 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
[2008/11/18 11:01:26 | 00,283,272 | ---- | M] (SPAMfighter) -- C:\Program Files\Fighters\licenseservice.exe
[2009/04/02 16:11:02 | 00,342,312 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
[2008/11/18 11:01:30 | 00,307,848 | ---- | M] (SPAMfighter) -- C:\Program Files\Fighters\updateservice.exe
[2009/04/26 22:46:41 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
[2007/05/31 09:21:28 | 00,648,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdc.exe
[2008/11/18 11:01:58 | 00,180,872 | ---- | M] (SPAMfighter) -- C:\Program Files\Fighters\Spywarefighter\SpywarefighterUser.exe
[2008/11/18 11:01:28 | 00,311,944 | ---- | M] (SPAMfighter) -- C:\Program Files\Fighters\ScannerService.exe
[2007/09/02 14:58:52 | 00,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
[2009/01/17 12:36:59 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[2009/03/03 04:16:04 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\WmiPrvSE.exe
[2008/01/19 09:33:09 | 00,125,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehtray.exe
[2008/01/19 09:33:39 | 00,202,240 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnscfg.exe
[2007/04/23 05:00:00 | 00,692,224 | ---- | M] (Logitech Inc.) -- C:\Program Files\SetPoint\SetPoint.exe
[2008/01/19 09:33:33 | 00,039,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\servicing\TrustedInstaller.exe
[2009/03/03 04:16:04 | 00,247,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wbem\WmiPrvSE.exe
[2006/09/08 08:54:30 | 00,042,544 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApMsgFwd.exe
[2008/01/19 09:33:09 | 00,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehmsas.exe
[2006/11/02 14:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe
[2007/02/02 20:28:36 | 00,493,056 | ---- | M] (ASUSTeK COMPUTER INC.) -- C:\Program Files\ASUS\ASUS Direct Console\D3DCheck.exe
[2008/01/19 09:33:39 | 00,896,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\wmpnetwk.exe
[2005/11/25 11:54:32 | 00,147,456 | ---- | M] () -- C:\Program Files\Razer\Copperheadazertra.exe
[2007/01/09 10:48:58 | 00,147,456 | ---- | M] (Razer Inc.) -- C:\Program Files\Razer\Copperheadazerofa.exe
[2006/09/08 09:06:08 | 00,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apntex.exe
[2008/01/19 09:33:04 | 00,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
[2007/04/11 16:32:22 | 00,056,080 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
[2006/09/08 09:10:22 | 00,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\HidFind.exe
[2006/09/11 12:31:36 | 00,208,896 | ---- | M] (ALPS) -- C:\Program Files\Apoint2K\Apvfb.exe
[2009/03/06 02:06:00 | 12,707,696 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
[2008/01/19 09:33:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe
[2009/04/02 16:10:56 | 00,656,168 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
[2009/05/13 00:51:21 | 00,422,912 | ---- | M] (OldTimer Tools) -- C:\Users\Reaper\Downloads\OTViewIt.exe
 
[color=orange]========== (O23) Win32 Services ==========[/color]
 
File not found --  -- (ADSMService [Auto | Running])
File not found --  -- (Apple Mobile Device [Auto | Running])
File not found --  -- (ASLDRService [Auto | Running])
File not found --  -- (ATKGFNEXSrv [Auto | Running])
File not found --  -- (CertPropSvc [Unknown | Stopped])
[2008/07/27 20:03:13 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
File not found --  -- (DcomLaunch [Unknown | Running])
[2008/01/19 09:33:06 | 02,091,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dfsr.exe -- (DFSR [On_Demand | Stopped])
[2008/01/19 09:34:06 | 00,134,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dps.dll -- (DPS [Unknown | Running])
[2008/01/19 09:33:09 | 00,292,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehrecvr.exe -- (ehRecvr [On_Demand | Running])
[2006/11/02 14:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\ehome\ehsched.exe -- (ehSched [On_Demand | Running])
File not found --  -- (EhttpSrv [On_Demand | Stopped])
File not found --  -- (ekrn [Auto | Running])
File not found --  -- (EvtEng [Auto | Running])
[2008/06/20 03:14:44 | 00,046,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped])
File not found --  -- (gusvc [On_Demand | Stopped])
File not found --  -- (IAANTMON [Auto | Running])
File not found --  -- (IDriverT [On_Demand | Stopped])
File not found --  -- (iPod Service [On_Demand | Running])
File not found --  -- (MDM [Auto | Running])
File not found --  -- (Microsoft Office Groove Audit Service [On_Demand | Stopped])
[2006/11/02 15:04:14 | 00,000,000 | ---D | M] -- C:\Windows\System32\Msdtc -- (MSDTC [Unknown | Stopped])
[2008/06/20 03:14:31 | 00,132,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped])
File not found --  -- (NMSAccessU [Auto | Running])
[2006/11/02 11:45:35 | 00,009,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32egedt32.exe -- (NOD32FiXTemDono [Auto | Stopped])
[2009/01/30 09:12:00 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32
vvsvc.exe -- (nvsvc [Auto | Running])
File not found --  -- (odserv [On_Demand | Stopped])
File not found --  -- (ose [On_Demand | Stopped])
File not found --  -- (PTK License-FIGHTERS-297811811 [Auto | Running])
File not found --  -- (PTK Live Update-FIGHTERS-297811811 [Auto | Running])
File not found --  -- (PTK Scanner-FIGHTERS-297811811 [Auto | Running])
File not found --  -- (PTK SharedAccess-FIGHTERS-297811811 [Auto | Running])
File not found --  -- (RegSrvc [Auto | Running])
[2008/01/19 09:36:19 | 00,095,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SCardSvr.dll -- (SCardSvr [Unknown | Stopped])
File not found --  -- (Schedule [Unknown | Running])
File not found --  -- (SCPolicySvc [Unknown | Stopped])
File not found --  -- (SeaPort [Auto | Running])
File not found --  -- (ServiceLayer [On_Demand | Stopped])
[2008/01/19 09:33:22 | 02,623,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLsvc.exe -- (slsvc [Auto | Running])
[2006/11/02 11:45:46 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\snmptrap.exe -- (SNMPTRAP [On_Demand | Stopped])
File not found --  -- (spmgr [Auto | Running])
File not found --  -- (sp_rssrv [Auto | Running])
File not found --  -- (Steam Client Service [On_Demand | Stopped])
[2008/01/19 09:33:33 | 00,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\UI0Detect.exe -- (UI0Detect [On_Demand | Stopped])
[2008/01/19 09:33:33 | 00,382,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vds.exe -- (vds [On_Demand | Stopped])
File not found --  -- (WdiServiceHost [Unknown | Stopped])
File not found --  -- (WdiSystemHost [Unknown | Running])
[2008/05/27 07:18:43 | 00,439,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SearchIndexer.exe -- (WSearch [Auto | Running])
 
[color=orange]========== Driver Services ==========[/color]
 
[2006/11/02 11:51:38 | 00,420,968 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\adp94xx.sys -- (adp94xx [Disabled | Stopped])
[2006/11/02 11:51:32 | 00,297,576 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\adpahci.sys -- (adpahci [Disabled | Stopped])
[2006/11/02 11:50:35 | 00,098,408 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\adpu160m.sys -- (adpu160m [Disabled | Stopped])
[2006/11/02 11:51:00 | 00,147,048 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\adpu320.sys -- (adpu320 [Disabled | Stopped])
[2006/11/02 11:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\djsvs.sys -- (aic78xx [Disabled | Stopped])
[2006/11/02 11:49:20 | 00,014,952 | ---- | M] (Acer Laboratories Inc.) -- C:\Windows\System32\drivers\aliide.sys -- (aliide [Disabled | Stopped])
[2006/11/02 11:49:59 | 00,054,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\AMDAGP.SYS -- (amdagp [On_Demand | Stopped])
[2006/11/02 11:49:26 | 00,015,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\amdide.sys -- (amdide [Disabled | Stopped])
[2006/11/02 10:30:18 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\amdk7.sys -- (AmdK7 [Disabled | Stopped])
[2006/11/02 10:30:18 | 00,040,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\amdk8.sys -- (AmdK8 [Disabled | Stopped])
[2006/08/30 03:35:58 | 00,140,800 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService [On_Demand | Running])
[2006/11/02 11:50:09 | 00,067,688 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\arc.sys -- (arc [Disabled | Stopped])
[2006/11/02 11:50:10 | 00,067,688 | ---- | M] (Adaptec, Inc.) -- C:\Windows\System32\drivers\arcsas.sys -- (arcsas [Disabled | Stopped])
[2007/04/25 03:28:14 | 00,027,504 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm [Boot | Running])
File not found --  -- (ASMMAP [Auto | Running])
[2007/03/15 08:41:16 | 00,048,128 | ---- | M] (Attansic Technology corporation.) -- C:\Windows\System32\drivers\atl01v32.sys -- (AtcL001 [On_Demand | Running])
[2008/01/19 07:28:26 | 00,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bowser.sys -- (bowser [On_Demand | Running])
[2006/11/02 10:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\System32\drivers\BrFiltLo.sys -- (BrFiltLo [On_Demand | Stopped])
[2006/11/02 10:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) -- C:\Windows\System32\drivers\BrFiltUp.sys -- (BrFiltUp [On_Demand | Stopped])
[2006/11/02 10:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\BrSerId.sys -- (Brserid [Disabled | Stopped])
[2006/11/02 10:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\BrSerWdm.sys -- (BrSerWdm [Disabled | Stopped])
[2006/11/02 10:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\BrUsbMdm.sys -- (BrUsbMdm [Disabled | Stopped])
[2006/11/02 10:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\BrUsbSer.sys -- (BrUsbSer [On_Demand | Stopped])
[2009/01/15 21:43:05 | 00,019,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bthenum.sys -- (BthEnum [On_Demand | Stopped])
[2008/01/19 07:53:38 | 00,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bthmodem.sys -- (BTHMODEM [On_Demand | Stopped])
[2008/01/19 07:53:44 | 00,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bthpan.sys -- (BthPan [On_Demand | Stopped])
[2009/01/15 21:43:05 | 00,220,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\bthport.sys -- (BTHPORT [On_Demand | Stopped])
[2009/01/15 21:43:05 | 00,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\BTHUSB.SYS -- (BTHUSB [On_Demand | Stopped])
[2008/01/19 07:53:24 | 00,035,328 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\circlass.sys -- (circlass [On_Demand | Running])
[2008/01/19 09:42:58 | 00,247,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\clfs.sys -- (CLFS [Unknown | Running])
[2006/11/02 11:49:28 | 00,016,488 | ---- | M] (CMD Technology, Inc.) -- C:\Windows\System32\drivers\cmdide.sys -- (cmdide [Disabled | Stopped])
[2006/11/02 11:49:43 | 00,022,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk [Boot | Running])
[2006/11/02 10:30:18 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\crusoe.sys -- (Crusoe [Disabled | Stopped])
[2008/01/19 07:28:20 | 00,075,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\dfsc.sys -- (DfsC [System | Running])
[2008/01/19 07:49:12 | 00,131,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\Dot4.sys -- (dot4 [On_Demand | Stopped])
[2008/01/19 07:49:09 | 00,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\Dot4Prt.sys -- (Dot4Print [On_Demand | Stopped])
[2008/01/19 07:49:10 | 00,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\Dot4usb.sys -- (dot4usb [On_Demand | Stopped])
[2008/08/02 03:01:23 | 00,625,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgkrnl.sys -- (DXGKrnl [On_Demand | Running])
[2006/11/02 09:30:54 | 00,117,760 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60 [On_Demand | Stopped])
[2008/03/13 17:43:42 | 00,040,456 | ---- | M] (ESET) -- C:\Windows\System32\drivers\eamon.sys -- (eamon [Auto | Running])
[2008/03/13 17:44:36 | 00,029,704 | ---- | M] (ESET) -- C:\Windows\System32\drivers\easdrv.sys -- (easdrv [System | Running])
[2008/01/19 09:42:11 | 00,143,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\ecache.sys -- (Ecache [Boot | Running])
[2007/02/16 02:57:04 | 00,034,760 | ---- | M] (SlySoft, Inc.) -- C:\Windows\System32\drivers\ElbyCDFL.sys -- (ElbyCDFL [On_Demand | Running])
[2009/02/17 19:11:30 | 00,024,232 | ---- | M] (Elaborate Bytes AG) -- C:\Windows\System32\drivers\ElbyCDIO.sys -- (ElbyCDIO [System | Running])
[2006/11/02 11:51:34 | 00,316,520 | ---- | M] (Emulex) -- C:\Windows\System32\drivers\elxstor.sys -- (elxstor [Disabled | Stopped])
[2008/03/13 17:52:12 | 00,071,176 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfw.sys -- (epfw [Auto | Running])
[2008/03/13 17:52:16 | 00,030,728 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfwndis.sys -- (Epfwndis [On_Demand | Running])
[2008/03/13 17:52:16 | 00,054,280 | ---- | M] (ESET) -- C:\Windows\System32\drivers\epfwtdi.sys -- (epfwtdi [System | Running])
[2008/01/19 07:28:01 | 00,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\exfat.sys -- (exfat [On_Demand | Stopped])
[2008/01/19 09:42:31 | 00,058,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\fileinfo.sys -- (FileInfo [Boot | Running])
[2008/01/19 07:30:23 | 00,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\filetrace.sys -- (Filetrace [On_Demand | Stopped])
[2006/11/02 11:50:04 | 00,058,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\GAGP30KX.SYS -- (gagp30kx [On_Demand | Stopped])
[2009/03/19 16:32:48 | 00,023,400 | ---- | M] (GEAR Software Inc.) -- C:\Windows\System32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running])
File not found --  -- (ghaio [Auto | Running])
[2006/11/02 09:36:49 | 00,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\HdAudio.sys -- (HdAudAddService [On_Demand | Stopped])
[2008/01/19 06:30:49 | 00,053,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\hdaudbus.sys -- (HDAudBus [On_Demand | Running])
[2006/11/02 10:55:22 | 00,029,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidbth.sys -- (HidBth [Disabled | Stopped])
[2008/01/19 07:53:18 | 00,021,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\hidir.sys -- (HidIr [On_Demand | Running])
[2006/11/02 11:50:10 | 00,037,480 | ---- | M] (Hewlett-Packard Company) -- C:\Windows\System32\drivers\HpCISSs.sys -- (HpCISSs [Disabled | Stopped])
[2007/02/12 08:36:54 | 00,277,784 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\iaStor.sys -- (iaStor [Boot | Running])
[2006/11/02 11:51:25 | 00,232,040 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\iaStorV.sys -- (iaStorV [Disabled | Stopped])
[2006/11/02 11:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) -- C:\Windows\System32\drivers\iirsp.sys -- (iirsp [Disabled | Stopped])
[2007/03/26 13:18:18 | 01,761,696 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService [On_Demand | Running])
[2006/11/02 10:42:03 | 00,065,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\IPMIDrv.sys -- (IPMIDRV [Disabled | Stopped])
[2008/01/19 09:42:35 | 00,181,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\msiscsi.sys -- (iScsiPrt [On_Demand | Running])
[2006/11/02 11:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\System32\drivers\iteatapi.sys -- (iteatapi [Disabled | Stopped])
[2007/04/20 17:14:32 | 00,047,616 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\System32\drivers\itecir.sys -- (itecir [On_Demand | Running])
[2006/11/02 11:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) -- C:\Windows\System32\drivers\iteraid.sys -- (iteraid [Disabled | Stopped])
[2006/02/07 13:52:58 | 00,006,912 | ---- | M] (JMicron ) -- C:\Windows\System32\drivers\JGOGO.sys -- (JGOGO [Boot | Running])
[2007/04/11 18:18:34 | 00,048,000 | ---- | M] (JMicron Technology Corp.) -- C:\Windows\System32\drivers\jraid.sys -- (JRAID [Boot | Running])
[2008/01/19 07:49:17 | 00,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\kbdhid.sys -- (kbdhid [System | Running])
[2007/01/24 12:08:40 | 00,005,632 | ---- | M] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr [On_Demand | Running])
[2008/01/19 07:55:03 | 00,047,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\lltdio.sys -- (lltdio [Auto | Running])
[2006/11/02 11:50:04 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\lsi_fc.sys -- (LSI_FC [Disabled | Stopped])
[2006/11/02 11:50:05 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\lsi_sas.sys -- (LSI_SAS [Disabled | Stopped])
[2006/11/02 11:50:10 | 00,065,640 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\lsi_scsi.sys -- (LSI_SCSI [Disabled | Stopped])
[2007/04/16 11:44:56 | 00,373,888 | ---- | M] (Liteon) -- C:\Windows\System32\drivers\Ltn_hyd7700pc.sys -- (Ltn_hyd7700pc [On_Demand | Running])
[2008/01/19 07:30:36 | 00,084,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\luafv.sys -- (luafv [Auto | Running])
[2006/11/02 11:49:53 | 00,028,776 | ---- | M] (LSI Logic Corporation) -- C:\Windows\System32\drivers\megasas.sys -- (megasas [Disabled | Stopped])
[2008/01/19 07:57:16 | 00,018,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\MODEMCSA.sys -- (MODEMCSA [On_Demand | Running])
[2008/01/19 07:52:19 | 00,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\monitor.sys -- (monitor [On_Demand | Running])
[2006/11/02 11:50:16 | 00,078,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mpio.sys -- (mpio [Disabled | Stopped])
[2008/01/19 07:54:46 | 00,064,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mpsdrv.sys -- (mpsdrv [On_Demand | Running])
[2006/11/02 11:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) -- C:\Windows\System32\drivers\Mraid35x.sys -- (Mraid35x [Disabled | Stopped])
[2009/01/15 21:58:22 | 00,212,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mrxsmb10.sys -- (mrxsmb10 [On_Demand | Running])
[2008/01/19 07:28:37 | 00,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\mrxsmb20.sys -- (mrxsmb20 [On_Demand | Running])
[2006/11/02 11:49:44 | 00,023,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\msahci.sys -- (msahci [Boot | Running])
[2006/11/02 11:50:17 | 00,080,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\msdsm.sys -- (msdsm [Disabled | Stopped])
[2008/01/19 09:41:14 | 00,016,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\msisadrv.sys -- (msisadrv [Boot | Running])
[2008/01/19 09:42:29 | 00,163,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\msrpc.sys -- (MsRPC [On_Demand | Stopped])
[2006/12/13 17:11:58 | 00,007,680 | ---- | M] (ATK0100) -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor [On_Demand | Running])
[2008/05/20 04:07:31 | 00,148,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers
wifi.sys -- (NativeWifiP [On_Demand | Running])
[2006/11/02 09:30:54 | 01,781,760 | ---- | M] (Intel® Corporation) -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32 [On_Demand | Stopped])
[2007/09/26 14:12:22 | 02,251,776 | ---- | M] (Intel Corporation) -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32 [On_Demand | Running])
[2006/11/02 11:50:19 | 00,045,160 | ---- | M] (IBM Corporation) -- C:\Windows\System32\drivers
frd960.sys -- (nfrd960 [Disabled | Stopped])
[2008/01/19 07:55:50 | 00,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers
siproxy.sys -- (nsiproxy [System | Running])
[2006/11/02 09:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) -- C:\Windows\System32\drivers
trigdigi.sys -- (ntrigdigi [Disabled | Stopped])
[2009/01/30 09:12:00 | 07,544,832 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers
vlddmkm.sys -- (nvlddmkm [On_Demand | Running])
[2006/11/02 11:50:24 | 00,088,680 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers
vraid.sys -- (nvraid [Disabled | Stopped])
[2006/11/02 11:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\drivers
vstor.sys -- (nvstor [Disabled | Stopped])
[2006/11/02 11:50:40 | 00,106,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\NV_AGP.SYS -- (nv_agp [On_Demand | Stopped])
[2007/09/17 16:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
[2006/11/02 11:04:35 | 00,878,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\PEAuth.sys -- (PEAUTH [Auto | Running])
[2008/04/05 03:21:42 | 00,072,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\pacer.sys -- (PSched [System | Running])
[2006/11/02 11:51:45 | 00,900,712 | ---- | M] (QLogic Corporation) -- C:\Windows\System32\drivers\ql2300.sys -- (ql2300 [Disabled | Stopped])
[2006/11/02 11:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) -- C:\Windows\System32\drivers\ql40xx.sys -- (ql40xx [Disabled | Stopped])
[2008/01/19 07:56:07 | 00,031,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\qwavedrv.sys -- (QWAVEdrv [On_Demand | Stopped])
[2008/01/19 07:56:43 | 00,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\driversassstp.sys -- (RasSstp [On_Demand | Running])
[2008/01/19 08:01:09 | 00,006,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\RDPENCDD.sys -- (RDPENCDD [System | Running])
[2008/01/19 07:53:39 | 00,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\driversfcomm.sys -- (RFCOMM [On_Demand | Stopped])
[2007/02/25 00:42:22 | 00,039,936 | ---- | M] (REDC) -- C:\Windows\System32\driversimmptsk.sys -- (rimmptsk [Auto | Running])
[2007/01/24 02:40:20 | 00,042,496 | ---- | M] (REDC) -- C:\Windows\System32\driversimsptsk.sys -- (rimsptsk [Auto | Running])
[2007/03/22 08:02:04 | 00,037,376 | ---- | M] (REDC) -- C:\Windows\System32\driversixdptsk.sys -- (rismxdp [Auto | Running])
[2008/01/19 07:55:03 | 00,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\driversspndr.sys -- (rspndr [Auto | Running])
[2006/11/02 09:30:56 | 00,044,544 | ---- | M] (Realtek Corporation) -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169 [On_Demand | Stopped])
[2007/05/01 15:33:34 | 00,132,232 | ---- | M] (Saitek) -- C:\Windows\System32\drivers\SaiH0461.sys -- (SaiH0461 [On_Demand | Stopped])
[2006/11/02 11:50:16 | 00,076,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sbp2port.sys -- (sbp2port [Disabled | Stopped])
[2008/01/19 07:32:56 | 00,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sdbus.sys -- (sdbus [On_Demand | Running])
[2006/11/02 08:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\Windows\System32\drivers\secdrv.sys -- (secdrv [Auto | Running])
[2008/01/19 07:49:16 | 00,019,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sermouse.sys -- (sermouse [Disabled | Stopped])
[2008/01/19 07:49:46 | 00,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sffdisk.sys -- (sffdisk [On_Demand | Stopped])
[2006/11/02 10:51:40 | 00,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sffp_mmc.sys -- (sffp_mmc [On_Demand | Stopped])
[2008/01/19 07:49:46 | 00,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\sffp_sd.sys -- (sffp_sd [On_Demand | Stopped])
[2006/11/02 11:49:51 | 00,053,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\SISAGP.SYS -- (sisagp [On_Demand | Stopped])
[2006/11/02 11:50:10 | 00,038,504 | ---- | M] (Silicon Integrated Systems Corp.) -- C:\Windows\System32\drivers\sisraid2.sys -- (SiSRaid2 [Disabled | Stopped])
[2006/11/02 11:50:16 | 00,071,784 | ---- | M] (Silicon Integrated Systems) -- C:\Windows\System32\drivers\sisraid4.sys -- (SiSRaid4 [Disabled | Stopped])
[2008/01/19 07:55:27 | 00,066,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\smb.sys -- (Smb [System | Running])
[2006/11/21 19:35:00 | 00,982,272 | ---- | M] (Motorola Inc.) -- C:\Windows\System32\drivers\smserial.sys -- (smserial [On_Demand | Running])
[2007/03/30 05:30:02 | 09,600,896 | ---- | M] () -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC [On_Demand | Running])
[2008/01/19 09:41:30 | 00,021,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\spldr.sys -- (spldr [Boot | Running])
[2009/04/21 18:13:24 | 00,717,296 | ---- | M] () -- C:\Windows\System32\drivers\sptd.sys -- (sptd [Boot | Running])
[2008/01/19 07:29:15 | 00,144,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv2.sys -- (srv2 [On_Demand | Running])
[2008/01/19 07:29:12 | 00,098,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\srvnet.sys -- (srvnet [On_Demand | Running])
[2006/11/02 09:30:52 | 00,041,728 | ---- | M] () -- C:\Windows\System32\drivers\stusb2ir.sys -- (stusb2ir [On_Demand | Stopped])
[2006/11/02 11:50:05 | 00,035,944 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\symc8xx.sys -- (Symc8xx [Disabled | Stopped])
[2006/11/02 11:49:56 | 00,031,848 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\sym_hi.sys -- (Sym_hi [Disabled | Stopped])
[2006/11/02 11:50:03 | 00,034,920 | ---- | M] (LSI Logic) -- C:\Windows\System32\drivers\sym_u3.sys -- (Sym_u3 [Disabled | Stopped])
[2008/01/19 07:56:07 | 00,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers	cpipreg.sys -- (tcpipreg [Auto | Running])
[2008/01/19 07:55:58 | 00,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers	dx.sys -- (tdx [System | Running])
[2006/11/02 11:50:17 | 00,041,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers	pm.sys -- (TPM [On_Demand | Stopped])
[2008/01/19 08:01:15 | 00,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers	ssecsrv.sys -- (tssecsrv [On_Demand | Stopped])
[2008/01/19 07:55:41 | 00,015,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\TUNMP.SYS -- (tunmp [On_Demand | Running])
[2008/01/19 07:55:50 | 00,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers	unnel.sys -- (tunnel [On_Demand | Running])
[2006/11/02 11:49:59 | 00,056,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\UAGP35.SYS -- (uagp35 [On_Demand | Stopped])
[2006/11/02 11:50:04 | 00,058,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\ULIAGPKX.SYS -- (uliagpkx [On_Demand | Stopped])
[2006/11/02 11:51:25 | 00,235,112 | ---- | M] (ULi Electronics Inc.) -- C:\Windows\System32\drivers\uliahci.sys -- (uliahci [Disabled | Stopped])
[2006/11/02 11:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\System32\drivers\ulsata.sys -- (UlSata [Disabled | Stopped])
[2006/11/02 11:50:45 | 00,115,816 | ---- | M] (Promise Technology, Inc.) -- C:\Windows\System32\drivers\ulsata2.sys -- (ulsata2 [Disabled | Stopped])
[2008/01/19 07:53:40 | 00,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\umbus.sys -- (umbus [On_Demand | Running])
[2009/03/06 00:59:00 | 00,036,864 | ---- | M] (Apple, Inc.) -- C:\Windows\System32\drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])
[2008/01/19 07:53:25 | 00,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbcir.sys -- (usbcir [On_Demand | Stopped])
[2005/11/02 11:54:44 | 00,011,596 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) -- C:\Windows\System32\drivers\copperhd.sys -- (UsbFltr [On_Demand | Running])
[2008/01/19 07:53:38 | 00,134,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbvideo.sys -- (usbvideo [On_Demand | Stopped])
[2008/01/19 07:56:08 | 00,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\usb8023x.sys -- (usb_rndisx [On_Demand | Stopped])
[2008/11/18 11:01:46 | 00,015,496 | ---- | M] () -- C:\Windows\System32\drivers\vffilter.sys -- (Vfscan [On_Demand | Running])
[2008/01/19 07:52:06 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\vgapnp.sys -- (vga [On_Demand | Stopped])
[2006/11/02 10:30:19 | 00,039,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\viac7.sys -- (ViaC7 [Disabled | Stopped])
[2006/11/02 11:49:30 | 00,017,512 | ---- | M] (VIA Technologies, Inc.) -- C:\Windows\System32\drivers\viaide.sys -- (viaide [Disabled | Stopped])
[2008/01/19 09:42:18 | 00,052,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\volmgr.sys -- (volmgr [Boot | Running])
[2008/01/19 09:43:03 | 00,294,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\volmgrx.sys -- (volmgrx [Boot | Running])
[2006/11/02 11:50:41 | 00,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) -- C:\Windows\System32\drivers\vsmraid.sys -- (vsmraid [Disabled | Stopped])
[2006/11/02 10:52:52 | 00,020,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\wacompen.sys -- (WacomPen [Disabled | Stopped])
[2006/11/02 11:49:38 | 00,019,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\wd.sys -- (Wd [Disabled | Stopped])
[2008/01/19 09:43:27 | 00,503,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\Wdf01000.sys -- (Wdf01000 [Boot | Running])
[2006/11/02 10:35:03 | 00,011,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\wmiacpi.sys -- (WmiAcpi [Disabled | Stopped])
[2008/01/19 07:56:49 | 00,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl [Disabled | Stopped])
[2008/01/19 07:49:39 | 00,521,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\xnacc.sys -- (xnacc [On_Demand | Stopped])
[2007/08/28 18:05:12 | 00,055,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\xusb21.sys -- (xusb21 [On_Demand | Stopped])
 
[color=orange]========== (R ) Internet Explorer ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
"Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Default_Secondary_Page_URL"=
"Extensions Off Page"=about:NoAdd-ons
"Local Page"=C:\windows\system32\blank.htm
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Security Risk Page"=about:SecurityRisk
"Start Page"=http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"CustomizeSearch"=https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
"Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"SearchAssistant"=https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Local Page"=C:\windows\system32\blank.htm
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page"=https://www.google.fr/?gws_rd=ssl
"StartPageCache"=
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL]
""=http://home.microsoft.com/access/autosearch.asp?p=%s
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0
 
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0
 
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
 
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0
 
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
 
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
 
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Local Page"=C:\windows\system32\blank.htm
"Search Page"=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page"=https://www.google.fr/?gws_rd=ssl
"StartPageCache"=
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Internet Explorer\SearchURL]
""=http://home.microsoft.com/access/autosearch.asp?p=%s
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" (HKLM) -- C:\Windows\System32\ieframe.dll (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0
 
[color=orange]========== (O1) Hosts File ==========[/color]
 
HOSTS File = (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1       localhost
::1             localhost
 
[color=orange]========== (O2) BHO's ==========[/color]
 
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (HKLM) -- C:\Programmes\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll File not found
{5C255C8A-E604-49b4-9D64-90988571CECB} (HKLM) -- Reg Error: Key does not exist or could not be opened. File not found
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} (HKLM) -- C:\Programmes\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll File not found
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} (HKLM) -- C:\Programmes\Microsoft Office\Office12\GrooveShellExtensions.dll File not found
{9030D464-4C02-4ABF-8ECC-5164760863C6} (HKLM) -- C:\Programmes\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll File not found
{AA58ED58-01DD-4d91-8333-CF10577473F7} (HKLM) -- C:\Programmes\Google\Google Toolbar\GoogleToolbar.dll File not found
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (HKLM) -- C:\Programmes\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll File not found
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} (HKLM) -- C:\Programmes\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll File not found
{DBC80044-A445-435b-BC74-9C25C1C588A9} (HKLM) -- C:\Programmes\Java\jre6\bin\jp2ssv.dll File not found
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} (HKLM) -- C:\Programmes\Windows Live\Toolbar\wltcore.dll File not found
 
[color=orange]========== (O3) Toolbars ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" (HKLM) -- C:\Programmes\Windows Live\Toolbar\wltcore.dll File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" (HKLM) -- C:\Programmes\Google\Google Toolbar\GoogleToolbar.dll File not found
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" (HKLM) -- C:\Programmes\Windows Live\Toolbar\wltcore.dll File not found
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" (HKLM) -- C:\Programmes\Google\Google Toolbar\GoogleToolbar.dll File not found
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{21FA44EF-376D-4D53-9B0F-8A89D3229068}" (HKLM) -- C:\Programmes\Windows Live\Toolbar\wltcore.dll File not found
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" (HKLM) -- C:\Programmes\Google\Google Toolbar\GoogleToolbar.dll File not found
 
[color=orange]========== (O4) Run Keys ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe File not found
"ASUS Screen Saver Protector"=C:\Windows\ASScrPro.exe ()
"ATKMEDIA"=C:\Program Files\ASUS\ATK Media\DMEDIA.EXE File not found
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s File not found
"Copperhead"=C:\Program Files\Razer\Copperheadazerhid.exe File not found
"DirectMessenger"="C:\Program Files\ASUS\ASUS Direct Console\LCMP.EXE" File not found
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice File not found
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" File not found
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" File not found
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" File not found
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe ()
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" File not found
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE File not found
"Launch LgDevAgt"="C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe" File not found
"NvCplDaemon"=RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime File not found
"RtHDVCpl"=RtHDVCpl.exe (Realtek Semiconductor)
"SMSERIAL"=C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe File not found
"spywarefighterguard"=C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe File not found
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" File not found
"Windows Defender"=%ProgramFiles%\Windows Defender\MSASCui.exe -hide File not found
"Windows Mobile Device Center"=%windir%\WindowsMobile\wmdc.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" /AUTO File not found
"ehTray.exe"=C:\Windows\ehome\ehTray.exe (Microsoft Corporation)
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" File not found
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe File not found
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe File not found
 
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem File not found
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=%ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem File not found
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" /AUTO File not found
"ehTray.exe"=C:\Windows\ehome\ehTray.exe (Microsoft Corporation)
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" File not found
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe File not found
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe File not found
 
[color=orange]========== (O6 & O7) Current Version Policies ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"ConsentPromptBehaviorAdmin"=2
"ConsentPromptBehaviorUser"=1
"EnableInstallerDetection"=1
"EnableLUA"=0
"EnableSecureUIAPaths"=1
"EnableVirtualization"=1
"PromptOnSecureDesktop"=1
"ValidateAdminCodeSignatures"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"scforceoption"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=0
"EnableUIADesktopToggle"=0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT"=1
"CF_BITMAP"=2
"CF_OEMTEXT"=7
"CF_DIB"=8
"CF_PALETTE"=9
"CF_UNICODETEXT"=13
"CF_DIBV5"=17
 
[color=orange]========== (O8) IE Context Menu Extensions ==========[/color]
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\]
E&xporter vers Microsoft Excel: C:\Programmes\Microsoft Office\Office12\EXCEL.EXE File not found
 
[HKEY_USERS\S-1-5-21-38078288-2320790660-2547689225-1000\Software\Microsoft\Internet Explorer\MenuExt\]
E&xporter vers Microsoft Excel: C:\Programmes\Microsoft Office\Office12\EXCEL.EXE File not found
 
[color=orange]========== (O9) IE Extensions ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\]
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}: Button: Ajout Direct -- %SystemDrive%\Programmes\Windows Live\Writer\WriterBrowserExtension.dll File not found
{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}: Menu: &Ajout Direct dans Windows Live Writer -- %SystemDrive%\Programmes\Windows Live\Writer\WriterBrowserExtension.dll File not found
{2670000A-7350-4f3c-8081-5663EE0C6C49}: Button: Send to OneNote -- %SystemDrive%\Programmes\Microsoft Office\Office12\ONBttnIE.dll File not found
{2670000A-7350-4f3c-8081-5663EE0C6C49}: Menu: S&end to OneNote -- %SystemDrive%\Programmes\Microsoft Office\Office12\ONBttnIE.dll File not found
{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}: Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 -- %SystemRoot%\WindowsMobile\INetRepl.dll [2007/05/31 09:21:16 | 00,176,520 | ---- | M] (Microsoft Corporation)
{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}: Menu: @C:\Windows\WindowsMobile\INetRepl.dll,-223 -- %SystemRoot%\WindowsMobile\INetRepl.dll [2007/05/31 09:21:16 | 00,176,520 | ---- | M] (Microsoft Corporation)
{92780B25-18CC-41C8-B9BE-3C9C571A8263}: Button: Research -- %SystemDrive%\Programmes\Microsoft Office\Office12\REFIEBAR.DLL File not found
 
[color=orange]========== (O13) Default Prefixes ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://
 
[color=orange]========== (O16) DPF ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\]
{8AD9C840-044E-11D1-B3E9-00805F499D93}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab -- Java Plug-in 1.6.0_13
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab -- Java Plug-in 1.6.0_13
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}: http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab -- Java Plug-in 1.6.0_13
 
[color=orange]========== (O17) DNS Name Servers ==========[/color]
 
{44848EF5-4E3F-420C-8310-61B4ADCBD5C3} (Servers:  | Description: )
{95CBBB04-9A19-4353-BA7A-B354D478BCC9} (Servers:  | Description: Intel(R) Wireless WiFi Link 4965AGN)
{E2D20EA9-94DC-40B5-B276-0D28706E669B} (Servers:  | Description: Microsoft Windows Mobile Remote Adapter)
{EE2B5A35-AAA3-47A7-8BDB-B2D2B82F9B63} (Servers:  | Description: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Controller)
 
[color=orange]========== Shell Execute Hooks ==========[/color]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" (HKLM) -- C:\Programmes\Microsoft Office\Office12\GrooveShellExtensions.dll File not found
 
[color=orange]========== HKLM *SecurityProviders* ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"=credssp.dll
>[2008/01/19 09:33:59 | 00,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\credssp.dll
 
[color=orange]========== LSA *Security Packages* ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Security Packages"=kerberos,msv1_0,schannel,wdigest,tspkg,
>[2008/01/19 09:36:42 | 00,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\TSpkg.dll
 
[color=orange]========== Safeboot Options ==========[/color]
 
"AlternateShell"=cmd.exe
 
[color=orange]========== CDRom AutoRun Settings ==========[/color]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1
 
[color=orange]========== Autorun Files on Drives ==========[/color]
 
autoexec.bat [REM Dummy file for NTVDM | ]
[2006/09/18 23:43:36 | 00,000,024 | ---- | M] () -- C:\autoexec.bat -- [ NTFS ]
 
autorun.inf [[autorun] | ;ilakbswbqptzwwnvyihnkokvecwmdbndqsyqqidnmcjhjfgogj | shellexecute="RECYCLER\S-0-4-99-100002083-100002953-100032402-8052.com d:\" | ;ediuwopqcwvredfkqigoqfihlholnmxvumkjvfqgxmnyecilhtopygkskdsugsmbckdcciev | shell\Open\command="RECYCLER\S-0-4-99-100002083-100002953-100032402-8052.com d:\" | ;yajhlrsmubpadewktvtnjlhctulwktdmfckadazrwgoajefnfearahsamrgtasylkstvgiwwyguapaheidptwkoaodpcmqqwopicfrripo | shell=Open | ]
[2009/04/26 15:31:23 | 00,000,420 | RHS- | M] () -- D:\autorun.inf -- [ NTFS ]
 
[color=orange]========== Files/Folders - Created Within 90 Days ==========[/color]
 
[2009/05/13 00:52:48 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2009/05/13 00:52:48 | 00,000,825 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/13 00:52:46 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/05/13 00:52:44 | 00,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2009/05/13 00:52:44 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/05/13 00:38:29 | 00,001,405 | ---- | C] () -- C:\Users\Reaper\Desktop\GenProc - Raccourci.lnk
[2009/05/13 00:38:27 | 00,000,000 | ---D | C] -- C:\GenProc
[2009/05/13 00:31:27 | 00,001,990 | ---- | C] () -- C:\Users\Public\Desktop\SPYWAREfighter.lnk
[2009/05/13 00:23:58 | 00,000,000 | ---D | C] -- C:\ProgramData\Fighters
[2009/05/13 00:23:58 | 00,000,000 | ---D | C] -- C:\Program Files\Fighters
[2009/05/12 16:08:24 | 00,000,008 | ---- | C] () -- C:\Windows\System32\PROTOCOL.INI
[2009/05/12 16:07:57 | 00,000,000 | ---D | C] -- C:\Users\Reaper\Documents\PocketFMS
[2009/05/11 15:49:39 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2009/05/11 15:49:39 | 00,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2009/05/11 15:49:39 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2009/05/11 15:49:39 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\icardie.dll
[2009/05/11 15:49:39 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2009/05/11 15:49:39 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2009/05/11 15:49:38 | 01,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2009/05/11 15:49:38 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2009/05/11 15:49:38 | 00,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2009/05/11 15:49:38 | 00,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2009/05/11 15:49:38 | 00,183,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2009/05/11 15:49:38 | 00,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2009/05/11 15:49:38 | 00,125,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2009/05/11 15:49:38 | 00,109,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll
[2009/05/11 15:49:38 | 00,094,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2009/05/11 15:49:38 | 00,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32	dc.ocx
[2009/05/11 15:49:38 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2009/05/11 15:49:38 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2009/05/11 15:49:38 | 00,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2009/05/11 15:49:38 | 00,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2009/05/11 15:49:38 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\corpol.dll
[2009/05/11 15:49:37 | 00,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2009/05/11 15:49:37 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2009/05/11 15:49:37 | 00,236,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webcheck.dll
[2009/05/11 15:49:37 | 00,208,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WinFXDocObj.exe
[2009/05/11 15:49:37 | 00,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2009/05/11 15:49:37 | 00,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2009/05/11 15:49:37 | 00,128,512 | ---

V-X · Answer

Re,

Télécharge ComboFix (de sUBs) sur ton Bureau. 

/!\Désactive temporairement toute protection résidente /!\ (Antivirus, antispywares..)
Double clique sur ComboFix.exe.
Accepte la licence en cliquant sur Oui.
Le programme va te demander si tu souhaites installer la Console de Récupération. C'est une précaution, au cas où l'ordinateur tomberait en panne. Je te conseille donc de l'installer, ça ne coûte rien, et ça pourrait potentiellement servir !
Lorsque l'opération sera terminée, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse. 


Le rapport se trouve ici : %SystemDrive%\ComboFix.txt (%systemdrive% étant la partition où est installée Windows; C:\ en général)

Aide :Comment utiliser ComboFix. 

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Re@per · Answer

Ok je fait ça !!!
Et tu arrive a voir le problème dans tout ce charabia ???

Re@per · Answer

J'ai un souci j'ai bien le logiciel comboFix mais il me dit que j'ai norton internet security qui est en fonctionnement alors que je n'ai jamais installé norton sur mon PC j'ai NOD32 (et j'ai bien pris soin de le désactiver)
?????
j'ai fouillé dans les programmes et j'ai rien trouvé, c'est bizarre quand meme...

V-X · Answer

Re,

Utilise sa et ensuite redémarre ton pc et relance combofix.

Désinstalle NORTON:

Comment le faire correctement

Re@per · Answer

Ok c'est parti...
Merci en tout cas !

Re@per · Answer

Et voilà désolé pour le retard ce fut long...
ComboFix 09-05-12.04 - Reaper 13/05/2009  2:41.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.3070.2222 [GMT 2:00]
Lancé depuis: c:\users\Reaper\Downloads\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: Pare-feu personnel d'ESET *enabled*
 * Un nouveau point de restauration a été créé
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\UNICCodec
c:\programdata\Microsoft\Windows\Start Menu\Programs\UNICCodec\Uninstall.lnk
c:\users\Reaper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UNICCodec
c:\windows\system32\404Fix.exe
c:\windows\system32\acovcnt.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\drivers\gxvxcbeqqfdnppvxwyaieobmrryiuqxxnecbi.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcfwtwbxtnejylfocpwixdputwrrhpwidl.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
D:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Pilotes/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS
-------\Service_GXVXCSERV.SYS


(((((((((((((((((((((((((((((   Fichiers créés du 2009-04-13 au 2009-05-13  ))))))))))))))))))))))))))))))))))))
.

2009-05-13 00:19 . 2009-05-13 00:19	--------	d-----w	c:\programdata\NortonInstaller
2009-05-13 00:19 . 2009-05-13 00:19	--------	d-----w	c:\users\All Users\NortonInstaller
2009-05-12 22:23 . 2009-05-12 22:23	--------	d-----w	c:\programdata\Fighters
2009-05-12 22:23 . 2009-05-12 22:23	--------	d-----w	c:\users\All Users\Fighters
2009-05-12 22:23 . 2009-05-12 23:42	--------	d-----w	c:\program files\Fighters
2009-05-11 11:45 . 2009-05-12 13:40	35	----a-w	c:\users\Reaper\AppData\Roaming\SetValue.bat
2009-05-11 11:45 . 2009-05-12 13:40	691	----a-w	c:\users\Reaper\AppData\Roaming\GetValue.vbs
2009-05-11 11:29 . 2009-05-11 11:29	--------	d-----w	c:\programdata\Grisoft
2009-05-11 11:29 . 2009-05-11 11:29	--------	d-----w	c:\users\All Users\Grisoft
2009-05-08 20:16 . 2009-05-08 20:16	--------	d-----w	c:\users\Reaper\AppData\Roaming\Canneverbe_Limited
2009-05-08 20:16 . 2009-05-08 20:16	--------	d-----w	c:\program files\CDBurnerXP
2009-05-07 00:41 . 2009-05-07 00:41	--------	d-----w	c:\users\Reaper\AppData\Roaming\Yahoo! Inc
2009-05-07 00:41 . 2009-05-07 00:41	--------	d-----w	c:\users\Reaper\AppData\Roaming\Yahoo!
2009-05-07 00:35 . 2009-05-07 00:35	--------	d-----w	c:\users\Reaper\AppData\Local\Zimbra
2009-05-05 19:21 . 2009-05-12 23:06	--------	d-----w	c:\program files\a-squared Free
2009-05-05 17:16 . 2009-05-06 15:15	--------	d-----w	c:\program files\a-squared Anti-Dialer
2009-05-04 09:48 . 2009-05-04 09:50	253952	------w	c:\windows\Setup1.exe
2009-05-04 09:48 . 2009-05-04 09:50	74752	----a-w	c:\windows\ST6UNST.EXE
2009-05-04 09:47 . 2009-05-04 09:47	--------	d-----w	C:\HOTZIC
2009-05-02 16:33 . 2009-05-02 16:33	--------	d-----w	c:\users\Reaper\{862b60ee-0d70-4109-8806-9b4a25bd852f}
2009-05-02 16:32 . 2009-05-02 16:32	--------	d-----w	c:\program files\Windows Mobile Device Handbook
2009-04-29 19:57 . 2009-04-29 19:57	--------	d-----w	C:\SPDISK
2009-04-28 12:09 . 2009-04-28 12:09	142592	----a-w	c:\windows\system32\drivers\sp_rsdrv2.sys
2009-04-28 12:09 . 2009-05-12 13:35	--------	d-----w	c:\users\Reaper\AppData\Roaming\Spyware Terminator
2009-04-28 12:09 . 2009-05-12 14:07	--------	d-----w	c:\programdata\Spyware Terminator
2009-04-28 12:09 . 2009-05-12 14:07	--------	d-----w	c:\users\All Users\Spyware Terminator
2009-04-28 12:09 . 2009-05-12 14:07	--------	d-----w	c:\program files\Spyware Terminator
2009-04-26 11:17 . 2009-05-12 23:45	--------	d-----w	c:\program files\PocketFMS
2009-04-26 11:16 . 2009-05-12 14:06	--------	d-----w	c:\windows\Downloaded Installations
2009-04-21 16:20 . 2009-04-21 16:20	--------	d-----w	c:\users\Reaper\AppData\Roaming\DAEMON Tools
2009-04-21 16:20 . 2009-04-21 16:20	--------	d-----w	c:\users\Reaper\AppData\Roaming\DAEMON Tools Pro
2009-04-21 16:19 . 2009-04-21 16:19	--------	d-----w	c:\programdata\DAEMON Tools Lite
2009-04-21 16:19 . 2009-04-21 16:19	--------	d-----w	c:\users\All Users\DAEMON Tools Lite
2009-04-21 16:19 . 2009-04-21 16:19	--------	d-----w	c:\program files\DAEMON Tools Lite
2009-04-21 16:13 . 2009-04-21 16:21	--------	d-----w	c:\users\Reaper\AppData\Roaming\DAEMON Tools Lite
2009-04-20 10:51 . 2009-05-13 00:40	31966	----a-w	c:\programdata\nvModes.dat
2009-04-20 10:51 . 2009-05-13 00:40	31966	----a-w	c:\users\All Users\nvModes.dat
2009-04-20 10:45 . 2009-04-20 10:45	--------	d-----w	c:\windows\system32\AGEIA
2009-04-20 10:45 . 2009-04-20 10:45	--------	d-----w	c:\program files\AGEIA Technologies
2009-04-20 10:45 . 2009-04-20 10:45	--------	d-----w	c:\program files\Common Files\Wise Installation Wizard
2009-04-20 10:45 . 2009-01-30 07:12	1108512	----a-w	c:\windows\system32\nvcpluir.dll
2009-04-20 10:45 . 2009-01-30 07:12	797216	----a-w	c:\windows\system32\nvcplui.exe
2009-04-20 10:43 . 2009-02-04 03:45	453152	----a-w	c:\windows\system32\NVUNINST.EXE

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 00:25 . 2009-01-15 12:21	101864	----a-w	c:\users\Reaper\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-13 00:21 . 2007-04-18 08:33	12	----a-w	c:\windows\bthservsdp.dat
2009-05-12 23:58 . 2009-01-15 20:34	--------	d-----w	c:\program files\Safari
2009-05-12 18:39 . 2007-04-18 09:09	672322	----a-w	c:\windows\system32\perfh00C.dat
2009-05-12 18:39 . 2007-04-18 09:09	124434	----a-w	c:\windows\system32\perfc00C.dat
2009-05-12 16:27 . 2009-04-30 13:06	0	----a-w	c:\users\Reaper\mp3buf.tmp
2009-05-11 17:46 . 2009-01-17 10:40	--------	d-----w	c:\program files\Steam
2009-05-11 14:38 . 2009-01-18 15:14	--------	d-----w	c:\program files\Microsoft Works
2009-05-11 09:27 . 2009-02-22 10:37	--------	d-----w	c:\program files\Nokia
2009-05-11 09:27 . 2006-11-02 10:25	86016	----a-w	c:\windows\inf\infstor.dat
2009-05-11 09:27 . 2006-11-02 10:25	51200	----a-w	c:\windows\inf\infpub.dat
2009-05-11 09:27 . 2006-11-02 10:25	143360	----a-w	c:\windows\inf\infstrng.dat
2009-05-09 15:38 . 2009-01-15 19:10	--------	d-----w	c:\program files\LimeWire
2009-05-08 20:07 . 2009-04-11 07:25	--------	d-----w	c:\program files\SlySoft
2009-05-05 11:09 . 2009-02-02 10:12	--------	d-----w	c:\program files\Common Files\Nero
2009-05-02 17:01 . 2009-05-02 17:01	0	---ha-w	c:\windows\system32\drivers\Msft_User_WpdRapi2_01_00_00.Wdf
2009-04-26 20:46 . 2009-01-15 19:22	410984	----a-w	c:\windows\system32\deploytk.dll
2009-04-26 11:22 . 2009-01-15 19:21	--------	d-----w	c:\program files\Java
2009-04-26 09:42 . 2009-01-17 10:40	--------	d-----w	c:\program files\Common Files\Steam
2009-04-21 16:13 . 2009-01-16 16:26	717296	----a-w	c:\windows\system32\drivers\sptd.sys
2009-04-20 10:39 . 2009-01-23 14:48	680	----a-w	c:\users\Reaper\AppData\Local\d3d9caps.dat
2009-04-17 20:00 . 2009-01-15 13:03	27430	----a-w	c:\users\Reaper\AppData\Roaming\nvModes.dat
2009-04-17 19:58 . 2006-11-02 11:18	--------	d-----w	c:\program files\Windows Mail
2009-04-14 22:38 . 2009-01-15 19:18	--------	d--h--w	c:\program files\InstallShield Installation Information
2009-04-12 13:08 . 2009-01-15 20:36	124912	---ha-w	c:\windows\system32\mlfcache.dat
2009-04-11 07:05 . 2009-04-11 07:05	--------	d-----w	c:\program files\iTunes
2009-04-11 07:05 . 2009-04-11 07:05	--------	d-----w	c:\program files\iPod
2009-04-11 07:05 . 2009-01-16 16:28	--------	d-----w	c:\program files\Common Files\Apple
2009-04-03 17:25 . 2009-04-03 17:25	--------	d-----w	c:\program files\Common Files\Microsoft Games
2009-04-03 16:55 . 2009-01-15 19:29	--------	d-----w	c:\program files\Common Files\InstallShield
2009-03-28 15:24 . 2009-03-28 15:24	--------	d-----w	c:\program files\Polar
2009-03-19 14:32 . 2009-04-11 07:05	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-17 03:38 . 2009-04-17 17:03	13824	----a-w	c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-17 17:03	24064	----a-w	c:\windows\system32\amxread.dll
2009-03-15 11:47 . 2009-03-15 11:46	--------	d-----w	c:\program files\QuickTime
2009-03-08 11:34 . 2009-05-11 13:49	914944	----a-w	c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-05-11 13:49	43008	----a-w	c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-05-11 13:49	18944	----a-w	c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-05-11 13:49	109056	----a-w	c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-05-11 13:49	109568	----a-w	c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-05-11 13:49	132608	----a-w	c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-05-11 13:49	107520	----a-w	c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-05-11 13:49	107008	----a-w	c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-05-11 13:49	103936	----a-w	c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-05-11 13:49	420352	----a-w	c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-05-11 13:49	72704	----a-w	c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-05-11 13:49	71680	----a-w	c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-05-11 13:49	66560	----a-w	c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-05-11 13:49	169472	----a-w	c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-05-11 13:49	34816	----a-w	c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-05-11 13:49	48128	----a-w	c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-05-11 13:49	45568	----a-w	c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-05-11 13:49	156160	----a-w	c:\windows\system32\msls31.dll
2009-03-05 22:59 . 2009-03-05 22:59	36864	----a-w	c:\windows\system32\drivers\usbaapl.sys
2009-03-05 22:59 . 2009-03-05 22:59	1900544	----a-w	c:\windows\system32\usbaaplrc.dll
2009-03-03 04:46 . 2009-04-17 17:03	3599328	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-17 17:03	3547632	----a-w	c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-17 17:03	183296	----a-w	c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-17 17:03	551424	----a-w	c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-17 17:03	26112	----a-w	c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-17 17:03	98304	----a-w	c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-17 17:03	54784	----a-w	c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-17 17:03	44032	----a-w	c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-17 17:03	666624	----a-w	c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-17 17:03	17408	----a-w	c:\windows\system32\iashost.exe
2009-02-17 17:11 . 2009-02-17 17:11	24232	----a-w	c:\windows\system32\drivers\ElbyCDIO.sys
2009-02-17 13:33 . 2009-02-17 13:33	89256	----a-w	c:\windows\system32\ElbyCDIO.dll
2009-02-13 08:49 . 2009-04-17 17:03	72704	----a-w	c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-17 17:03	1255936	----a-w	c:\windows\system32\lsasrv.dll
2009-01-16 18:23 . 2006-11-02 12:50	174	--sha-w	c:\program files\desktop.ini
1998-04-26 22:00 . 1998-04-26 22:00	570128	----a-w	c:\program files\Common Files\DAO350.dll
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 01:08	143360	----a-w	c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-17 39408]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-05-07 1561840]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-21 630784]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-09-12 155648]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-13 1443072]
"DirectMessenger"="c:\program files\ASUS\ASUS Direct Console\LCMP.EXE" [2007-02-01 987648]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-01-15 33136]
"Copperhead"="c:\program files\Razer\Copperhead\razerhid.exe" [2005-11-25 155648]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Launch LgDevAgt"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2008-11-06 358920]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2008-11-06 1548296]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2008-11-06 2816520]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13605408]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-26 148888]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2009-01-29 57344]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-03-23 4423680]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2009-1-15 692224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-38078288-2320790660-2547689225-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{DA30E99D-A739-4229-8693-F3CCB4015EDD}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{ABA1E44D-C947-4B1E-A122-EDC7E0384737}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{3E248C4E-9C9F-4C63-BCB2-8DF4BFE37042}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{5D65E5A1-8554-46F1-B181-BA4B48B0AADF}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{DD4FCC73-061E-4A9C-A9B1-983177F13194}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{4FFEA0E5-02B3-416A-A080-8A349222CF0B}"= UDP:c:\program files\Steam\steamapps\common\trackmania nations forever\TmForever.exe:TrackMania Nations Forever
"{8552FFDE-6830-47EC-A239-29816AD81909}"= TCP:c:\program files\Steam\steamapps\common\trackmania nations forever\TmForever.exe:TrackMania Nations Forever
"{156EF447-DDD8-481C-8352-8EF8E520881D}"= UDP:c:\program files\Steam\steamapps\common\trackmania nations forever\TmForeverLauncher.exe:TrackMania Nations Forever
"{27B213F3-D643-4B1E-AE42-1FC141D2D6A9}"= TCP:c:\program files\Steam\steamapps\common\trackmania nations forever\TmForeverLauncher.exe:TrackMania Nations Forever
"{A3F53BA5-0BF4-4B47-B45E-6CB2FB612B7D}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{1A4EB7FD-F1A7-43BE-8238-C91A66098DD6}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{F20E8C73-91E3-4A76-AE5F-62A0CFE4E453}"= UDP:c:\program files\Steam\steamapps\common\saints row 2\SR2_pc.exe:Saints Row 2
"{53CA6E57-F42A-4321-9C73-6857FA535ACC}"= TCP:c:\program files\Steam\steamapps\common\saints row 2\SR2_pc.exe:Saints Row 2
"{EF9D29CF-FA79-46FB-9C5C-810A883C3C2F}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{F170ED97-6C21-4B32-B7D0-0D55FB02E588}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9A360CF4-416F-42EF-9403-B120265FED30}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{1A22A672-EAC4-4245-B849-35C9A459708C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{997435F4-8EA6-41AF-918E-ABDD86296914}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{32A395D5-A524-4E32-A0EA-C418DD16F8DB}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0A50CAEA-18AA-4A15-8057-643939CA85D3}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [13/03/2008 17:49 472320]
R2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [14/01/2009 18:53 226656]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\System32\drivers\atl01v32.sys [15/01/2009 21:48 48128]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [15/01/2009 14:48 47616]
R3 Ltn_hyd7700pc;TV tuner device ;c:\windows\System32\drivers\Ltn_hyd7700pc.sys [15/01/2009 14:49 373888]
R3 UsbFltr;Razer Copperhead Driver;c:\windows\System32\drivers\copperhd.sys [16/01/2009 18:58 11596]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\System32\regedt32.exe [02/11/2006 10:32 9216]
S3 SaiH0461;SaiH0461;c:\windows\System32\drivers\SaiH0461.sys [01/05/2007 15:33 132232]
S3 stusb2ir;Pont USB 2.0 IrDA;c:\windows\System32\drivers\stusb2ir.sys [02/11/2006 12:25 41728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 02:59
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 


c:\users\Reaper\AppData\Local\Temp\gxvxc000 0 bytes

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gxvxcserv.sys]
"imagepath"="\systemroot\system32\drivers\gxvxcsfobckhqntpwebkenqropgrcinvglkxa.sys"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\[u]0/u001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\gxvxcserv.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\systemroot\system32\drivers\gxvxcsfobckhqntpwebkenqropgrcinvglkxa.sys"
.
Heure de fin: 2009-05-13  3:00
ComboFix-quarantined-files.txt  2009-05-13 01:00

Avant-CF: 12 371 533 824 octets libres
Après-CF: 12 361 490 432 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5,6,7
295	--- E O F ---	2009-05-11 16:38

V-X · Answer

Re,

&#x25B6 Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

&#x25B6 Mets le à jour

&#x25B6 Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.

&#x25B6 Sélectionne Exécuter un examen COMPLET si ce n'est pas déjà fait

&#x25B6 clique sur Rechercher

&#x25B6 Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

&#x25B6 Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

&#x25B6 Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

&#x25B6 Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

Re@per · Answer

Ok je l'ai téléchergé.... en tout cas merci et je te tient au courant après l'examen
Merci pour ton aide.

Re@per · Answer

ça y est c'est fini tu as besoin du rapport d'erreur ?

Merci pour ton aide V-X

V-X · Answer

Re,

Oui poste moi le rapport de malwarebyte.

Re@per · Answer

Voilà : 

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2121
Windows 6.0.6001 Service Pack 1

13/05/2009 13:18:14
mbam-log-2009-05-13 (13-18-14).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 220362
Temps écoulé: 2 hour(s), 15 minute(s), 5 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\Windows\System32\gxvxcfwtwbxtnejylfocpwixdputwrrhpwidl.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

Re@per · Answer

Juste une question de curiosité... A quoi cela va te servir ?

V-X · Answer

Re,

A savoir si bien la dernière version de malwarebyte et ce qu'il a découvert.

Télécharge OTCleanIt de OldTimer sur ton Bureau

Lance OTCleanIt avec un double-clic (sous Vista, lance-le en cliquant droit sur OTCleanIt.exe et en sélectionnant "exécuter en tant qu'administrateur")

Appuie sur le bouton "CleanUp!"

A la question "begin cleanup process?", réponds "YES"

A la fin de l'opération, si OTCleanIt demande de redémarrer ("Do you want to reboot now?"), ferme ce que tu es en train de faire (internet, documents divers...) et clique sur "YES":

Au redémarrage, OTCleanIt aura supprimé les outils de désinfection, et se sera même auto-détruit!
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> Fais un scan en ligne avec Kaspersky : Kaspersky

N.B. : Le scan ne marche que sous Internet Explorer.

- Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...). Allume les si necessaire.

- Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >.

- On va te demander de télécharger un contrôle active x, accepte .

- Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer.

- Poste le rapport qui sera généré stp. (clique sur <enregistrer le rapport> puis sauvegarde-le sur ton bureau en choisissant "fichier texte (*.txt)" pour l'extension).
S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : clic ici

Rappel : le scan est à faire sous Internet Explorer
Tuto ici si problème

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte toi sur le site de Kaspersky pour retenter le scan en ligne.
Pour le rapport Kaspersky il faut que tu choisisses "Afficher le rapport" puis que tu l'enregistres sur ton bureau sous forme de fichier texte (type de fichier "tous les fichiers").

Re@per · Answer

Et ça marchera avec vista ??? car ils disent que c'est en cours de développement pour vista ?
Je l'ai lancé on verra bien...

Re@per · Answer

Analyse a été effectué par le scan en ligne comme tu me l'a dit mais rien n'a été détecté !
y a rien sur le rapport donc voilà !

Merci pour ton aide je pense que l'on s'est débarrassé pour de bon de cette merde...

A plus passe une bonne soirée !

V-X · Answer

Re,

Des informations intéressantes pour toi et ton PC :

Conserve malwarebyte et CCLEANER et fait des scans réguliers avec malwarebyte en mode normal et en mode sans échec.

Nettoie ton PC avec CCLEANER toutes les semaines suit les information donner précèdement.

&#x25B6 Comportement à adopter avec son PC :ici
et pourquoi ( exemple ) :ici

&#x25B6 Surveillance :
Effectue des scan réguliers de surveillance (une fois tous les 15 jours, par exemple) avec ton antivirus puis avec ton anti-spyware (après les avoir mis à jour bien sur !) et supprime ce qu'ils peuvent trouver (où mets en quarantaine, en pensant à la vider ultérieurement).

&#x25B6 Pourquoi ? Pour éviter de se retrouver dans ce genre de situation ( peu commune mais ...) :
->ici

=============================================================

=> Il faut mettre a jour la console Java régulièrement aussi :

Pourquoi

Donc pour se faire, rends toi ici et télécharge la dernière version (si ta version actuelle n'est pas à jour) ou ici
Après avoir installé la dernière version, désinstalle les anciennes versions (de Java) afin d’éliminer les failles de sécurité présentes dans ces anciennes versions.
via Démarrer / Paramètres / Panneau de config / et dans Ajout/Suppression de programmes navigue jusqu'aux anciennes versions de la console Java qui s'y trouvent, puis clique sur « Supprimer », suis les invites de commandes dans la boite de dialogue qui va s'ouvrir afin d'amener la désinstallation à son terme.
Fais cela pour chacune d'elles, une à une, fais redémarrer ton PC quand cela te sera demandé .
Retourne ensuite chez Java ci-dessus et clique sur le bouton "Vérifier l'installation" pour t'assurer que tout est en ordre.

=============================================================

&#x25B6 Afin d’éviter les autres failles de sécurité des différents programmes présents sur ton PC :

Vérifie tes mises à jours des différents softs régulièrement ici et mets à jour ce qui ne l’est pas. ici
 Tutoriel
-Autre possibilité, t'abonner gratuitement a "la lettre hebdomadaire de secuser.com" ici a gauche en bas de page.

===========================================================

&#x25B6 teste l'efficacité de ton pare-feu ici ( à titre indicatif ):
ici

&#x25B6 tests firewall: ici

 &#x25B6 Un complément au pare-feu pour fermer les ports risqués (dangereux, s’ils restent ouverts) :

ZebProtect (application ne nécessitant pas d’installation à lancer et paramétrer une unique fois) ici

 Tutoriel

================================================================
 &#x25B6 Pour une meilleur sécurité lorsque tu surfes , je te conseille d'utiliser FireFox :
télécharge le ici -> firefox firefox

( Attention : toujours garder IE sur son PC ! Il est indispensable pour les mises à jour de ton système ainsi que pour pas mal de choses, comme les scan d'antivirus en ligne, ect... )

Tutorial pour sécuriser Firefox

=================================================================
 Rappel sur les principales causes d'infection :


&#x25B6 L'utilisation de cracks ou keygens est à proscrire, de même que le surf sur les sites de téléchargement de ceux-ci :

 Les dangers des cracks

&#x25B6 Le crack dans toute sa splendeur, journal d'une infection attendue :
ici

&#x25B6 Autres exemples en image , où comment s'infiltre une infection par un pseudo crack :
ici


&#x25B6 Le P2P ( l'utilisation de logiciels comme eMule, Sharazaa, LimeWire, Bit torrent):

Les conséquences du P2P

&#x25B6 Pourquoi éviter le P2P :
> ici
> et ici
> et la


&#x25B6 Faire attention avec les ActiveX :
ici
et comment :
là


&#x25B6 Prévention sur deux autres types d'infection d'actualité :

&#x25B6 MSN prévention :
ici
-> autre danger grandissant , le " phishing " (= hameçonnage ) :
ici


&#x25B6 Infection par supports amovibles (clefs usb, flash, DD externes ..) :
ici
ici

=================================================================
&#x25B6 Prévention & Sécurité sur internet

projet anti-malware

Re@per · Answer

Salut ,
maintenant j'ai un message d'erreur au démarrage qui dit :
"Cannot Create System Shell Notification Icon"

et je sait pas pourquoi....

Re@per · Answer

A oui pour info c'est "Asus direct console" la source du problème

Mais je clique sur l'exe. et il se lance pdt 1 sec après rien....

Trojan sous Vista !!! HELP !!!!

21 réponses

Votre réponse

Discussions similaires

Newsletters