TDSS Trojan

Logfile of random's system information tool 1.06 (written by random/random)
Run by Fryct at 2009-07-16 14:42:05
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 2
System drive C: has 65 GB (23%) free of 286 GB
Total RAM: 3583 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42:08, on 16/07/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Fryct\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Fryct.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O13 - Gopher Prefix:
O15 - Trusted Zone: http://realm01.dogsoftheseas.com
O15 - Trusted Zone: http://www.dogsoftheseas.com
O15 - Trusted Zone: http://*.dogsoftheseas.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\Program Files\Stardock\Object Desktop\DeskScapes\deskscapes.dll
O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - C:\PROGRA~1\Stardock\OBJECT~2\DESKSC~1\DesktopControlPanel.dll
O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\Program Files\Stardock\Object Desktop\DeskScapes\DreamControl.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\NETGEAR\WN111v2\jswpsapi.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\System32\nvSCPAPISvr.exe

Voilà le rapport SysProt, qui semble intéressant, notamment la fin avec tous ces geye* ^^


SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

Process:
Name: [System Idle Process]
PID: 0
Hidden: No
Window Visible: No

Name: System
PID: 4
Hidden: No
Window Visible: No

Name: C:\Windows\System32\smss.exe
PID: 496
Hidden: No
Window Visible: No

Name: C:\Windows\System32\csrss.exe
PID: 572
Hidden: No
Window Visible: No

Name: C:\Windows\System32\wininit.exe
PID: 632
Hidden: No
Window Visible: No

Name: C:\Windows\System32\csrss.exe
PID: 644
Hidden: No
Window Visible: No

Name: C:\Windows\System32\services.exe
PID: 680
Hidden: No
Window Visible: No

Name: C:\Windows\System32\lsass.exe
PID: 692
Hidden: No
Window Visible: No

Name: C:\Windows\System32\lsm.exe
PID: 700
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 868
Hidden: No
Window Visible: No

Name: C:\Windows\System32\winlogon.exe
PID: 892
Hidden: No
Window Visible: No

Name: C:\Windows\System32\nvvsvc.exe
PID: 968
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1000
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1068
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1136
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1208
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1244
Hidden: No
Window Visible: No

Name: C:\Windows\System32\audiodg.exe
PID: 1300
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1356
Hidden: No
Window Visible: No

Name: C:\Windows\System32\SLsvc.exe
PID: 1420
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1476
Hidden: No
Window Visible: No

Name: C:\Windows\System32\nvvsvc.exe
PID: 1512
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1648
Hidden: No
Window Visible: No

Name: C:\Windows\System32\spoolsv.exe
PID: 1964
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 1988
Hidden: No
Window Visible: No

Name: C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PID: 1632
Hidden: No
Window Visible: No

Name: C:\Windows\System32\PnkBstrA.exe
PID: 2124
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 2196
Hidden: No
Window Visible: No

Name: C:\Windows\System32\nvSCPAPISvr.exe
PID: 2224
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 2276
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 2312
Hidden: No
Window Visible: No

Name: C:\Windows\System32\SearchIndexer.exe
PID: 2388
Hidden: No
Window Visible: No

Name: C:\Windows\System32\taskeng.exe
PID: 2712
Hidden: No
Window Visible: No

Name: C:\Windows\System32\dwm.exe
PID: 2728
Hidden: No
Window Visible: No

Name: C:\Windows\explorer.exe
PID: 2816
Hidden: No
Window Visible: No

Name: C:\Windows\System32\taskeng.exe
PID: 2888
Hidden: No
Window Visible: No

Name: C:\Windows\System32\WUDFHost.exe
PID: 3000
Hidden: No
Window Visible: No

Name: C:\Program Files\Windows Defender\MSASCui.exe
PID: 3116
Hidden: No
Window Visible: No

Name: C:\Windows\WindowsMobile\wmdc.exe
PID: 3132
Hidden: No
Window Visible: No

Name: C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PID: 3140
Hidden: No
Window Visible: No

Name: C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PID: 3200
Hidden: No
Window Visible: No

Name: C:\Program Files\Windows Media Player\wmpnscfg.exe
PID: 3304
Hidden: No
Window Visible: No

Name: C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
PID: 3320
Hidden: No
Window Visible: No

Name: C:\Windows\System32\svchost.exe
PID: 3440
Hidden: No
Window Visible: No

Name: C:\Windows\System32\mobsync.exe
PID: 3640
Hidden: No
Window Visible: No

Name: C:\Program Files\Windows Media Player\wmpnetwk.exe
PID: 3712
Hidden: No
Window Visible: No

Name: C:\Windows\System32\alg.exe
PID: 3856
Hidden: No
Window Visible: No

Name: C:\Windows\System32\wbem\unsecapp.exe
PID: 3828
Hidden: No
Window Visible: No

Name: C:\Windows\System32\wbem\WmiPrvSE.exe
PID: 2652
Hidden: No
Window Visible: No

Name: C:\Windows\System32\dllhost.exe
PID: 2052
Hidden: No
Window Visible: No

Name: C:\Users\Fryct\Desktop\SysProt.exe
PID: 1664
Hidden: No
Window Visible: Yes

******************************************************************************************
******************************************************************************************
Kernel Modules:
Module Name: \systemroot\system32\drivers\geyekrnxsbucwe.sys
Service Name: geyekrvgmpndef
Module Base: ---
Module End: ---
Hidden: Yes

Module Name: \??\C:\Users\Fryct\Desktop\SysProtDrv.sys
Service Name: SysProtDrv.sys
Module Base: A316B000
Module End: A3176000
Hidden: No

Module Name: C:\Windows\system32\ntkrnlpa.exe
Service Name: ---
Module Base: 82400000
Module End: 827B9000
Hidden: No

Module Name: C:\Windows\system32\hal.dll
Service Name: ---
Module Base: 827B9000
Module End: 827EC000
Hidden: No

Module Name: C:\Windows\system32\kdcom.dll
Service Name: ---
Module Base: 80401000
Module End: 80408000
Hidden: No

Module Name: C:\Windows\system32\mcupdate_GenuineIntel.dll
Service Name: ---
Module Base: 80408000
Module End: 80478000
Hidden: No

Module Name: C:\Windows\system32\PSHED.dll
Service Name: ---
Module Base: 80478000
Module End: 80489000
Hidden: No

Module Name: C:\Windows\system32\BOOTVID.dll
Service Name: ---
Module Base: 80489000
Module End: 80491000
Hidden: No

Module Name: C:\Windows\system32\CLFS.SYS
Service Name: CLFS
Module Base: 80491000
Module End: 804D2000
Hidden: No

Module Name: C:\Windows\system32\CI.dll
Service Name: ---
Module Base: 804D2000
Module End: 805B2000
Hidden: No

Module Name: C:\Windows\system32\drivers\Wdf01000.sys
Service Name: Wdf01000
Module Base: 80608000
Module End: 80684000
Hidden: No

Module Name: C:\Windows\system32\drivers\WDFLDR.SYS
Service Name: ---
Module Base: 80684000
Module End: 80691000
Hidden: No

Module Name: C:\Windows\System32\Drivers\sptd.sys
Service Name: sptd
Module Base: 80691000
Module End: 8076B000
Hidden: No

Module Name: C:\Windows\System32\Drivers\WMILIB.SYS
Service Name: ---
Module Base: 8076B000
Module End: 80774000
Hidden: No

Module Name: C:\Windows\System32\Drivers\SCSIPORT.SYS
Service Name: ---
Module Base: 80774000
Module End: 8079A000
Hidden: No

Module Name: C:\Windows\system32\drivers\acpi.sys
Service Name: ACPI
Module Base: 8079A000
Module End: 807E0000
Hidden: No

Module Name: C:\Windows\system32\drivers\msisadrv.sys
Service Name: msisadrv
Module Base: 807E0000
Module End: 807E8000
Hidden: No

Module Name: C:\Windows\system32\drivers\pci.sys
Service Name: pci
Module Base: 805B2000
Module End: 805D9000
Hidden: No

Module Name: C:\Windows\System32\drivers\partmgr.sys
Service Name: partmgr
Module Base: 807E8000
Module End: 807F7000
Hidden: No

Module Name: C:\Windows\system32\drivers\volmgr.sys
Service Name: volmgr
Module Base: 805D9000
Module End: 805E8000
Hidden: No

Module Name: C:\Windows\System32\drivers\volmgrx.sys
Service Name: volmgrx
Module Base: 82A02000
Module End: 82A4C000
Hidden: No

Module Name: C:\Windows\system32\drivers\intelide.sys
Service Name: intelide
Module Base: 82A4C000
Module End: 82A53000
Hidden: No

Module Name: C:\Windows\system32\drivers\PCIIDEX.SYS
Service Name: ---
Module Base: 82A53000
Module End: 82A61000
Hidden: No

Module Name: C:\Windows\system32\drivers\pciide.sys
Service Name: pciide
Module Base: 82A61000
Module End: 82A68000
Hidden: No

Module Name: C:\Windows\System32\drivers\mountmgr.sys
Service Name: MountMgr
Module Base: 82A68000
Module End: 82A78000
Hidden: No

Module Name: C:\Windows\system32\drivers\atapi.sys
Service Name: atapi
Module Base: 82A78000
Module End: 82A80000
Hidden: No

Module Name: C:\Windows\system32\drivers\ataport.SYS
Service Name: ---
Module Base: 82A80000
Module End: 82A9E000
Hidden: No

Module Name: C:\Windows\system32\drivers\fltmgr.sys
Service Name: FltMgr
Module Base: 82A9E000
Module End: 82AD0000
Hidden: No

Module Name: C:\Windows\system32\drivers\fileinfo.sys
Service Name: FileInfo
Module Base: 82AD0000
Module End: 82AE0000
Hidden: No

Module Name: C:\Windows\System32\Drivers\ksecdd.sys
Service Name: KSecDD
Module Base: 82AE0000
Module End: 82B51000
Hidden: No

Module Name: C:\Windows\system32\drivers\ndis.sys
Service Name: NDIS
Module Base: 8BA01000
Module End: 8BB0C000
Hidden: No

Module Name: C:\Windows\system32\drivers\msrpc.sys
Service Name: MsRPC
Module Base: 8BB0C000
Module End: 8BB37000
Hidden: No

Module Name: C:\Windows\system32\drivers\NETIO.SYS
Service Name: ---
Module Base: 8BB37000
Module End: 8BB72000
Hidden: No

Module Name: C:\Windows\System32\drivers\tcpip.sys
Service Name: Tcpip
Module Base: 8BC0A000
Module End: 8BCF2000
Hidden: No

Module Name: C:\Windows\System32\drivers\fwpkclnt.sys
Service Name: ---
Module Base: 8BCF2000
Module End: 8BD0D000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Ntfs.sys
Service Name: Ntfs
Module Base: 8BE03000
Module End: 8BF13000
Hidden: No

Module Name: C:\Windows\system32\drivers\volsnap.sys
Service Name: volsnap
Module Base: 8BF13000
Module End: 8BF4C000
Hidden: No

Module Name: C:\Windows\System32\Drivers\spldr.sys
Service Name: spldr
Module Base: 8BF4C000
Module End: 8BF54000
Hidden: No

Module Name: C:\Windows\System32\Drivers\mup.sys
Service Name: Mup
Module Base: 8BF54000
Module End: 8BF63000
Hidden: No

Module Name: C:\Windows\System32\drivers\ecache.sys
Service Name: Ecache
Module Base: 8BF63000
Module End: 8BF8A000
Hidden: No

Module Name: C:\Windows\system32\drivers\disk.sys
Service Name: disk
Module Base: 8BF8A000
Module End: 8BF9B000
Hidden: No

Module Name: C:\Windows\system32\drivers\CLASSPNP.SYS
Service Name: ---
Module Base: 8BF9B000
Module End: 8BFBC000
Hidden: No

Module Name: C:\Windows\system32\drivers\crcdisk.sys
Service Name: crcdisk
Module Base: 8BFBC000
Module End: 8BFC5000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\tunnel.sys
Service Name: tunnel
Module Base: 8BFE5000
Module End: 8BFF0000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\tunmp.sys
Service Name: tunmp
Module Base: 8BFF0000
Module End: 8BFF9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\intelppm.sys
Service Name: intelppm
Module Base: 8BD0D000
Module End: 8BD1C000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Service Name: nvlddmkm
Module Base: 8F60D000
Module End: 8FF7E000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\nvBridge.kmd
Service Name: ---
Module Base: 8FF7E000
Module End: 8FF80000
Hidden: No

Module Name: C:\Windows\System32\drivers\dxgkrnl.sys
Service Name: DXGKrnl
Module Base: 8BD1C000
Module End: 8BDBB000
Hidden: No

Module Name: C:\Windows\System32\drivers\watchdog.sys
Service Name: ---
Module Base: 8FF80000
Module End: 8FF8C000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HECI.sys
Service Name: HECI
Module Base: 8FF8C000
Module End: 8FF97000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbuhci.sys
Service Name: usbuhci
Module Base: 8FF97000
Module End: 8FFA2000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBPORT.SYS
Service Name: ---
Module Base: 8FFA2000
Module End: 8FFE0000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbehci.sys
Service Name: usbehci
Module Base: 8FFE0000
Module End: 8FFEF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HDAudBus.sys
Service Name: HDAudBus
Module Base: 8BB72000
Module End: 8BBFF000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\cdrom.sys
Service Name: cdrom
Module Base: 8BDBB000
Module End: 8BDD3000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\yk60x86.sys
Service Name: yukonwlh
Module Base: 82B51000
Module End: 82B9D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\serial.sys
Service Name: Serial
Module Base: 8BDD3000
Module End: 8BDED000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\serenum.sys
Service Name: Serenum
Module Base: 8FFEF000
Module End: 8FFF9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\parport.sys
Service Name: Parport
Module Base: 82B9D000
Module End: 82BB5000
Hidden: No

Module Name: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Service Name: ---
Module Base: 82BB5000
Module End: 82BFF000
Hidden: Yes

Module Name: C:\Windows\system32\DRIVERS\msiscsi.sys
Service Name: iScsiPrt
Module Base: 90404000
Module End: 90433000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\storport.sys
Service Name: ---
Module Base: 90433000
Module End: 90474000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\TDI.SYS
Service Name: ---
Module Base: 90474000
Module End: 9047F000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\rasl2tp.sys
Service Name: Rasl2tp
Module Base: 9047F000
Module End: 90496000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ndistapi.sys
Service Name: NdisTapi
Module Base: 90496000
Module End: 904A1000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ndiswan.sys
Service Name: NdisWan
Module Base: 904A1000
Module End: 904C4000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\raspppoe.sys
Service Name: RasPppoe
Module Base: 904C4000
Module End: 904D3000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\raspptp.sys
Service Name: PptpMiniport
Module Base: 904D3000
Module End: 904E7000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\rassstp.sys
Service Name: RasSstp
Module Base: 904E7000
Module End: 904FC000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\termdd.sys
Service Name: TermDD
Module Base: 904FC000
Module End: 9050C000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\kbdclass.sys
Service Name: kbdclass
Module Base: 9050C000
Module End: 90517000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mouclass.sys
Service Name: mouclass
Module Base: 90517000
Module End: 90522000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\swenum.sys
Service Name: swenum
Module Base: 90522000
Module End: 90524000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ks.sys
Service Name: ---
Module Base: 90524000
Module End: 9054E000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mssmbios.sys
Service Name: mssmbios
Module Base: 9054E000
Module End: 90558000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\umbus.sys
Service Name: umbus
Module Base: 90558000
Module End: 90565000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbhub.sys
Service Name: usbhub
Module Base: 90565000
Module End: 9059A000
Hidden: No

Module Name: C:\Windows\System32\Drivers\NDProxy.SYS
Service Name: NDProxy
Module Base: 9059A000
Module End: 905AB000
Hidden: No

Module Name: C:\Windows\system32\drivers\RTKVHDA.sys
Service Name: IntcAzAudAddService
Module Base: 9080D000
Module End: 90A43000
Hidden: No

Module Name: C:\Windows\system32\drivers\portcls.sys
Service Name: ---
Module Base: 90A43000
Module End: 90A70000
Hidden: No

Module Name: C:\Windows\system32\drivers\drmk.sys
Service Name: ---
Module Base: 90A70000
Module End: 90A95000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Fs_Rec.SYS
Service Name: Fs_Rec
Module Base: 90A95000
Module End: 90A9E000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Null.SYS
Service Name: Null
Module Base: 90A9E000
Module End: 90AA5000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Beep.SYS
Service Name: Beep
Module Base: 90AA5000
Module End: 90AAC000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ehdrv.sys
Service Name: ehdrv
Module Base: 90AAC000
Module End: 90AC9000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Service Name: ---
Module Base: 90AE5000
Module End: 90AEC000
Hidden: No

Module Name: C:\Windows\System32\drivers\vga.sys
Service Name: vga
Module Base: 90AEC000
Module End: 90AF8000
Hidden: No

Module Name: C:\Windows\System32\drivers\VIDEOPRT.SYS
Service Name: ---
Module Base: 90AF8000
Module End: 90B19000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\RDPCDD.sys
Service Name: RDPCDD
Module Base: 90B19000
Module End: 90B21000
Hidden: No

Module Name: C:\Windows\system32\drivers\rdpencdd.sys
Service Name: RDPENCDD
Module Base: 90B21000
Module End: 90B29000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Service Name: USBSTOR
Module Base: 90B52000
Module End: 90B67000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\USBD.SYS
Service Name: ---
Module Base: 90B67000
Module End: 90B69000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\usbccgp.sys
Service Name: usbccgp
Module Base: 90B69000
Module End: 90B80000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Lycosa.sys
Service Name: LycoFltr
Module Base: 90B80000
Module End: 90B84000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\hidusb.sys
Service Name: HidUsb
Module Base: 90B84000
Module End: 90B8D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Service Name: ---
Module Base: 90B8D000
Module End: 90B9D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\kbdhid.sys
Service Name: kbdhid
Module Base: 90B9D000
Module End: 90BA6000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mouhid.sys
Service Name: mouhid
Module Base: 90BA6000
Module End: 90BAE000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Msfs.SYS
Service Name: Msfs
Module Base: 90BAE000
Module End: 90BB9000
Hidden: No

Module Name: C:\Windows\System32\Drivers\Npfs.SYS
Service Name: Npfs
Module Base: 90BB9000
Module End: 90BC7000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\rasacd.sys
Service Name: RasAcd
Module Base: 90BC7000
Module End: 90BD0000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\tdx.sys
Service Name: tdx
Module Base: 90BD0000
Module End: 90BE6000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\smb.sys
Service Name: Smb
Module Base: 90BE6000
Module End: 90BFA000
Hidden: No

Module Name: C:\Windows\system32\drivers\afd.sys
Service Name: AFD
Module Base: 905AB000
Module End: 905F3000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\netbt.sys
Service Name: netbt
Module Base: 91A0C000
Module End: 91A3E000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\pacer.sys
Service Name: PSched
Module Base: 91A3E000
Module End: 91A54000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\jswpslwf.sys
Service Name: jswpslwf
Module Base: 91A54000
Module End: 91A59000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\netbios.sys
Service Name: NetBIOS
Module Base: 91A59000
Module End: 91A67000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\wanarp.sys
Service Name: Wanarp
Module Base: 91A67000
Module End: 91A7A000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\rdbss.sys
Service Name: rdbss
Module Base: 91A7A000
Module End: 91AB6000
Hidden: No

Module Name: C:\Windows\system32\drivers\nsiproxy.sys
Service Name: nsiproxy
Module Base: 91AB6000
Module End: 91AC0000
Hidden: No

Module Name: C:\Windows\System32\Drivers\dfsc.sys
Service Name: DfsC
Module Base: 91AC0000
Module End: 91AD7000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\udfs.sys
Service Name: udfs
Module Base: 91AD7000
Module End: 91B12000
Hidden: No

Module Name: C:\Windows\System32\Drivers\crashdmp.sys
Service Name: ---
Module Base: 91B12000
Module End: 91B1F000
Hidden: No

Module Name: \SystemRoot\System32\Drivers\dump_dumpata.sys
Service Name: ---
Module Base: 91B1F000
Module End: 91B2A000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: 91B2A000
Module End: 91B32000
Hidden: Yes

Module Name: C:\Windows\System32\drivers\Dxapi.sys
Service Name: ---
Module Base: 91B32000
Module End: 91B3C000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\monitor.sys
Service Name: monitor
Module Base: 91B3C000
Module End: 91B4B000
Hidden: No

Module Name: \SystemRoot\system32\drivers\fbwndq.sys
Service Name: ---
Module Base: 91B4B000
Module End: 91B5A000
Hidden: Yes

Module Name: C:\Windows\system32\drivers\luafv.sys
Service Name: luafv
Module Base: 91B5A000
Module End: 91B75000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\eamon.sys
Service Name: eamon
Module Base: 9D00D000
Module End: 9D0C9000
Hidden: No

Module Name: C:\Windows\system32\drivers\spsys.sys
Service Name: ---
Module Base: 9D0D1000
Module End: 9D181000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\lltdio.sys
Service Name: lltdio
Module Base: 9D181000
Module End: 9D191000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\nwifi.sys
Service Name: NativeWifiP
Module Base: 9D191000
Module End: 9D1BB000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ndisuio.sys
Service Name: Ndisuio
Module Base: 9D1BB000
Module End: 9D1C5000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\rspndr.sys
Service Name: rspndr
Module Base: 9D1C5000
Module End: 9D1D8000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\asyncmac.sys
Service Name: AsyncMac
Module Base: 9D1D8000
Module End: 9D1E1000
Hidden: No

Module Name: C:\Windows\system32\drivers\HTTP.sys
Service Name: HTTP
Module Base: 91B75000
Module End: 91BE0000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srvnet.sys
Service Name: srvnet
Module Base: 9D1E1000
Module End: 9D1FE000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\bowser.sys
Service Name: bowser
Module Base: 91BE0000
Module End: 91BF9000
Hidden: No

Module Name: C:\Windows\System32\drivers\mpsdrv.sys
Service Name: mpsdrv
Module Base: 90AC9000
Module End: 90ADE000
Hidden: No

Module Name: C:\Windows\system32\drivers\mrxdav.sys
Service Name: MRxDAV
Module Base: A2206000
Module End: A2227000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb.sys
Service Name: mrxsmb
Module Base: A2227000
Module End: A2246000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Service Name: mrxsmb10
Module Base: A2246000
Module End: A227F000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Service Name: mrxsmb20
Module Base: A227F000
Module End: A2297000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srv2.sys
Service Name: srv2
Module Base: A2297000
Module End: A22BE000
Hidden: No

Module Name: C:\Windows\System32\DRIVERS\srv.sys
Service Name: srv
Module Base: A22BE000
Module End: A230A000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\parvdm.sys
Service Name: Parvdm
Module Base: A230A000
Module End: A2311000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\atksgt.sys
Service Name: atksgt
Module Base: A2311000
Module End: A2354000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\epfwwfpr.sys
Service Name: epfwwfpr
Module Base: A2354000
Module End: A236D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\lirsgt.sys
Service Name: lirsgt
Module Base: A236D000
Module End: A2372000
Hidden: No

Module Name: C:\Windows\system32\drivers\peauth.sys
Service Name: PEAUTH
Module Base: A300C000
Module End: A30EA000
Hidden: No

Module Name: C:\Windows\System32\Drivers\secdrv.SYS
Service Name: secdrv
Module Base: A30EA000
Module End: A30F4000
Hidden: No

Module Name: C:\Windows\System32\drivers\tcpipreg.sys
Service Name: tcpipreg
Module Base: A30F4000
Module End: A3100000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\WUDFRd.sys
Service Name: WUDFRd
Module Base: A3100000
Module End: A3115000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\WUDFPf.sys
Service Name: ---
Module Base: A3115000
Module End: A3127000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\ipnat.sys
Service Name: IPNAT
Module Base: A3127000
Module End: A314D000
Hidden: No

Module Name: C:\Windows\system32\DRIVERS\cdfs.sys
Service Name: cdfs
Module Base: A314D000
Module End: A3163000
Hidden: No

******************************************************************************************
******************************************************************************************
No SSDT Hooks found

******************************************************************************************
******************************************************************************************
Kernel Hooks:
Hooked Function: ZwSaveKeyEx
At Address: 82652B07
Jump To: 86FC0AFA
Module Name: _unknown_

Hooked Function: ZwSaveKey
At Address: 82652969
Jump To: 87505AE2
Module Name: _unknown_

Hooked Function: ZwFlushInstructionCache
At Address: 825AFEF5
Jump To: 8750EABC
Module Name: _unknown_

Hooked Function: ZwEnumerateKey
At Address: 825FD0BA
Jump To: 86FC0AC4
Module Name: _unknown_

Hooked Function: PsGetCurrentThread
At Address: 82444912
Jump To: 8750EB9A
Module Name: _unknown_

Hooked Function: KeGetCurrentThread
At Address: 82444912
Jump To: 8750EB9A
Module Name: _unknown_

Hooked Function: IofCompleteRequest
At Address: 8244497F
Jump To: 8750B6B3
Module Name: _unknown_

Hooked Function: IofCallDriver
At Address: 82444912
Jump To: 8750EB9A
Module Name: _unknown_

******************************************************************************************
******************************************************************************************
IRP Hooks:
Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\atapi.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 852E51E8
Hooking Module: _unknown_

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_CREATE
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_CLOSE
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_READ
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_WRITE
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_QUERY_INFORMATION
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SET_INFORMATION
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_QUERY_EA
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SET_EA
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_FLUSH_BUFFERS
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_DIRECTORY_CONTROL
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SHUTDOWN
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_LOCK_CONTROL
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_CLEANUP
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_CREATE_MAILSLOT
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_QUERY_SECURITY
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SET_SECURITY
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_POWER
Jump To: 806A0DB8
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 806BB344
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_DEVICE_CHANGE
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_QUERY_QUOTA
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: \Driver\PCI_NTPNP1364
Hooked IRP: IRP_MJ_SET_QUOTA
Jump To: 806BEF18
Hooking Module: C:\Windows\System32\Drivers\sptd.sys

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_CREATE
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_CLOSE
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_READ
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_WRITE
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_POWER
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 872101E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbuhci.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 86CC3918
Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 87668980
Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 87668980
Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 87668980
Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 87668980
Hooking Module: _unknown_

Hooked Module: C:\Windows\System32\DRIVERS\netbt.sys
Hooked IRP: IRP_MJ_CLEANUP
Jump To: 87668980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_READ
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_WRITE
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_FLUSH_BUFFERS
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_SHUTDOWN
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\cdrom.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 86CBC1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\msiscsi.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 86CCB1E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_READ
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_WRITE
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_FLUSH_BUFFERS
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_SHUTDOWN
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_CLEANUP
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\drivers\volmgr.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 852E31E8
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_CREATE
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_CLOSE
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_POWER
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: C:\Windows\system32\DRIVERS\usbehci.sys
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 85FEF980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_CREATE
Jump To: 86CF8980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_CLOSE
Jump To: 86CF8980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_DEVICE_CONTROL
Jump To: 86CF8980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL
Jump To: 86CF8980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_POWER
Jump To: 86CF8980
Hooking Module: _unknown_

Hooked Module: \SystemRoot\System32\Drivers\asnhsr7x.SYS
Hooked IRP: IRP_MJ_SYSTEM_CONTROL
Jump To: 86CF8980
Hooking Module: _unknown_

******************************************************************************************
******************************************************************************************
Ports:
Local Address: 192.168.2.2:49430
Remote Address: 209.85.229.138:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49428
Remote Address: 193.159.160.32:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49427
Remote Address: 193.159.160.32:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49426
Remote Address: 193.159.160.32:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49425
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49424
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49423
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49422
Remote Address: 193.159.160.32:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49421
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49420
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49419
Remote Address: 62.41.82.58:HTTP
Type: TCP
Process: [System Idle Process]
State: TIME_WAIT

Local Address: 192.168.2.2:49404
Remote Address: 213.133.110.21:HTTPS
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: CLOSE_WAIT

Local Address: 192.168.2.2:49402
Remote Address: 78.46.213.91:HTTPS
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: CLOSE_WAIT

Local Address: PC-DE-Fryct:7438
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:DCCM
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:49159
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:49157
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\services.exe
State: LISTENING

Local Address: PC-DE-Fryct:49156
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\lsass.exe
State: LISTENING

Local Address: PC-DE-Fryct:49155
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\spoolsv.exe
State: LISTENING

Local Address: PC-DE-Fryct:49154
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:49153
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:49152
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\wininit.exe
State: LISTENING

Local Address: PC-DE-Fryct:5357
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: PC-DE-Fryct:ICSLAP
Remote Address: 0.0.0.0:0
Type: TCP
Process: System
State: LISTENING

Local Address: PC-DE-Fryct:FTPS
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: PC-DE-Fryct:RTSP
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Program Files\Windows Media Player\wmpnetwk.exe
State: LISTENING

Local Address: PC-DE-Fryct:EPMAP
Remote Address: 0.0.0.0:0
Type: TCP
Process: C:\Windows\System32\svchost.exe
State: LISTENING

Local Address: 192.168.2.2:60790
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: 192.168.2.2:SSDP
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:60792
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:60791
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:49157
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:44301
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\PnkBstrA.exe
State: NA

Local Address: PC-DE-Fryct:SSDP
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:63368
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:49156
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:5005
Remote Address: NA
Type: UDP
Process: C:\Program Files\Windows Media Player\wmpnetwk.exe
State: NA

Local Address: PC-DE-Fryct:5004
Remote Address: NA
Type: UDP
Process: C:\Program Files\Windows Media Player\wmpnetwk.exe
State: NA

Local Address: PC-DE-Fryct:IPSEC-MSFT
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:UPNP-DISCOVERY
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:UPNP-DISCOVERY
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:500
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

Local Address: PC-DE-Fryct:123
Remote Address: NA
Type: UDP
Process: C:\Windows\System32\svchost.exe
State: NA

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: F:\System Volume Information\MountPointManagerRemoteDatabase
Status: Access denied

Object: F:\System Volume Information\tracking.log
Status: Access denied

Object: F:\System Volume Information\_restore{797C2C08-ED79-4713-9D1D-667F818CCFF5}
Status: Access denied

Object: F:\System Volume Information\_restore{B7C6254F-1504-49D8-BE82-56F653418BDB}
Status: Access denied

Object: E:\System Volume Information\tracking.log
Status: Access denied

Object: D:\System Volume Information\tracking.log
Status: Access denied

Object: C:\ProgramData\Microsoft\Windows\GameExplorer\{F65F3C34-B03E-473B-891B-845F17C98FAD}\SupportTasks\0\Visiter le site officiel de Hellgate
Status: Hidden

Object: C:\Users\All Users\Microsoft\Windows\GameExplorer\{F65F3C34-B03E-473B-891B-845F17C98FAD}\SupportTasks\0\Visiter le site officiel de Hellgate
Status: Hidden

Object: C:\Users\Fryct\AppData\Roaming\SecuROM\UserData\???????????p?????????
Status: Hidden

Object: C:\Users\Fryct\AppData\Roaming\SecuROM\UserData\???????????p?????????
Status: Hidden

Object: C:\Windows\System32\drivers\geyekrnxsbucwe.sys
Status: Hidden

Object: C:\Windows\System32\geyekrixjpcbxm.dll
Status: Hidden

Object: C:\Windows\System32\geyekrlxsxoqje.dat
Status: Hidden

Object: C:\Windows\System32\geyekrnhttpmvx.dat
Status: Hidden

Object: C:\Windows\System32\geyekrpahvfrqw.dll
Status: Hidden

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl
Status: Access denied

Object: C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl
Status: Access denied

Object: C:\Windows\temp\geyekrrcqnfmciar.tmp
Status: Hidden

Object: C:\Windows\temp\geyekrruembkfxsi.tmp
Status: Hidden

Et bien, finalement, il semblerait qu'il a disparu ! ComboFix a fait son scan et ses opérations mais ne m'a pas demandé de rebooter. A la fin, il m'a demandé d'activer ma connexion internet pour envoyer des fichiers à analyser, ce que j'ai fait si ça peut servir à d'autres.
J'ai rebooté moi-même et au démarrage, tout s'est bien passé aucun message d'erreur. J'ai lancé Malware et nod32 qui ne m'ont rien trouvé.

D'autres outils à lancer pour être sûr que c'est bien fini l'histoire ? :p


ComboFix 09-07-14.08 - Fryct 16/07/2009 17:00.12.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3583.2295 [GMT 2:00]
Running from: c:\users\Fryct\Desktop\ske.exe
Command switches used :: c:\users\Fryct\Desktop\CFScript.txt
SP: AdwareBot *disabled* (Updated) {2BFC08CE-6B66-47D4-BA62-0A39887A0229}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point

FILE ::
"c:\windows\system32\drivers\geyekrnxsbucwe.sys"
"c:\windows\system32\drivers\geyekrpahvfrqw.dll"
"c:\windows\System32\geyekrixjpcbxm.dll"
"c:\windows\System32\geyekrlxsxoqje.dat"
"c:\windows\System32\geyekrnhttpmvx.dat"
"c:\windows\system32\geyekrpahvfrqw.dll"
"c:\windows\temp\geyekrrcqnfmciar.tmp"
"c:\windows\temp\geyekrruembkfxsi.tmp"
.

((((((((((((((((((((((((( Files Created from 2009-06-16 to 2009-07-16 )))))))))))))))))))))))))))))))
.

2009-07-16 15:06 . 2009-07-16 15:06 -------- d-----w- c:\users\Fryct\AppData\Local\temp
2009-07-16 12:42 . 2009-07-16 12:42 -------- d-----w- C:\rsit
2009-07-15 09:24 . 2009-07-15 09:24 -------- d-----w- c:\program files\CCleaner
2009-07-14 21:45 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-14 21:45 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-14 21:45 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-14 21:45 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-14 21:45 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-14 13:35 . 2009-07-16 12:38 -------- d-----w- c:\program files\Trend Micro
2009-07-14 11:56 . 2009-07-14 12:49 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-07-14 09:45 . 2009-07-14 09:45 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-13 22:27 . 2009-07-13 23:19 -------- d-----w- c:\windows\BDOSCAN8
2009-07-13 18:41 . 2009-07-13 18:41 -------- d-----w- c:\users\Fryct\AppData\Roaming\Malwarebytes
2009-07-13 18:41 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 18:41 . 2009-07-14 16:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-13 18:41 . 2009-07-13 18:41 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-13 18:41 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-13 16:23 . 2009-07-13 16:23 -------- d---a-w- c:\program files\Common Files\Nero
2009-07-13 16:07 . 2009-07-13 16:07 -------- d-----w- c:\progra~2\SlySoft
2009-07-13 16:04 . 2009-07-13 16:04 -------- d-----w- c:\program files\SlySoft
2009-07-12 21:47 . 2009-07-12 22:17 -------- d-----w- c:\users\Fryct\AppData\Roaming\CyberLink
2009-07-12 21:47 . 2009-07-12 21:47 -------- d-----w- c:\users\Public\CyberLink
2009-07-12 21:44 . 2009-07-12 21:44 -------- dc----w- c:\windows\system32\DRVSTORE
2009-07-12 21:40 . 2009-07-12 22:07 -------- d-----w- c:\progra~2\CyberLink
2009-07-12 21:40 . 2008-05-14 12:48 29480 ------w- c:\windows\system32\msxml3a.dll
2009-07-12 21:39 . 2008-05-14 12:48 505128 ----a-w- c:\windows\system32\msvcp71.dll
2009-07-12 21:39 . 2009-07-13 16:15 -------- d-----w- c:\program files\CyberLink
2009-07-12 08:45 . 2009-07-12 08:45 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-12 08:45 . 2009-07-12 08:45 -------- d-----w- c:\windows\system32\AGEIA
2009-07-12 08:29 . 2009-07-12 08:29 -------- d-----w- c:\users\Fryct\{c904a8d4-a5d3-4d40-a799-60f6c462408a}
2009-07-12 08:29 . 2009-06-04 14:39 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-07-08 17:58 . 2005-07-25 09:59 28672 ----a-w- c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\{3502a070-ea2f-11dd-ba2f-0800200c9a66}\components\mintray-9178506d-2005072516-trunk.dll
2009-07-05 17:55 . 2008-04-16 12:13 65536 ----a-w- c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
2009-07-05 00:33 . 2009-07-05 07:17 -------- d-----w- c:\users\Fryct\AppData\Roaming\IGN_DLM
2009-07-01 15:57 . 2009-07-01 15:57 0 ----a-w- c:\windows\nsreg.dat
2009-07-01 15:57 . 2009-07-01 15:57 -------- d-----w- c:\users\Fryct\AppData\Local\Mozilla
2009-06-20 09:48 . 2009-06-20 09:48 -------- d-----w- c:\users\Fryct\AppData\Local\ArmA 2
2009-06-20 09:47 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
2009-06-20 09:47 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2009-06-20 09:47 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2009-06-20 09:47 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2009-06-20 09:35 . 2009-06-20 09:35 -------- d-----w- c:\program files\Bohemia Interactive
2009-06-17 19:46 . 2009-06-17 19:46 -------- d-----w- c:\users\Fryct\AppData\Local\Monte Cristo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-16 12:40 . 2006-11-02 15:48 716060 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-16 12:40 . 2006-11-02 15:48 144214 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-16 12:36 . 2009-07-12 08:52 31966 ----a-w- c:\progra~2\nvModes.dat
2009-07-16 12:36 . 2008-07-24 14:48 -------- d-----w- c:\progra~2\NVIDIA
2009-07-15 09:32 . 2009-04-08 20:19 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2009-07-14 21:47 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-14 21:47 . 2008-07-26 07:13 -------- d-----w- c:\progra~2\Microsoft Help
2009-07-13 16:23 . 2008-07-24 17:11 -------- d-----w- c:\program files\Nero
2009-07-13 16:15 . 2008-07-25 22:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-13 14:56 . 2008-07-24 19:34 -------- d-----w- c:\program files\Steam
2009-07-12 21:47 . 2008-07-24 14:42 106240 ----a-w- c:\users\Fryct\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-12 21:38 . 2008-07-24 14:44 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-12 16:03 . 2008-09-25 15:16 -------- d-----w- c:\users\Fryct\AppData\Roaming\vlc
2009-07-12 08:45 . 2008-11-08 12:55 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-12 03:21 . 2008-07-26 17:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-11 20:42 . 2008-07-24 18:19 -------- d-----w- c:\users\Fryct\AppData\Roaming\MxBoost
2009-07-05 11:08 . 2008-07-24 19:34 -------- d-----w- c:\program files\Common Files\Steam
2009-07-05 09:32 . 2008-08-23 11:39 -------- d-----w- c:\program files\City of Heroes
2009-06-30 16:50 . 2008-07-26 21:32 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-23 12:11 . 2008-07-25 22:10 137888 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-23 12:11 . 2008-07-25 22:09 189288 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-22 11:51 . 2008-07-25 22:09 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 17:47 . 2009-05-09 10:38 -------- d-----w- c:\program files\Common Files\BioWare
2009-06-17 17:46 . 2008-07-26 15:49 -------- d-----w- c:\progra~2\Media Center Programs
2009-06-14 15:15 . 2009-06-13 13:26 -------- d-----w- c:\program files\Sony Online Entertainment
2009-06-11 18:46 . 2008-08-02 09:51 -------- d-----w- c:\progra~2\Steam
2009-06-11 18:46 . 2008-08-02 09:50 -------- d-----w- c:\progra~2\PopCap Games
2009-06-10 16:33 . 2009-06-10 16:33 9899296 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2009-06-10 16:33 . 2009-06-10 16:33 989696 ----a-w- c:\windows\system32\nvapi.dll
2009-06-10 16:33 . 2009-06-10 16:33 7611904 ----a-w- c:\windows\system32\nvd3dum.dll
2009-06-10 16:33 . 2009-06-10 16:33 678432 ----a-w- c:\windows\system32\nvcuvid.dll
2009-06-10 16:33 . 2009-06-10 16:33 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-10 16:33 . 2009-06-10 16:33 4224 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2009-06-10 16:33 . 2009-06-10 16:33 3148288 ----a-w- c:\windows\system32\nvwgf2um.dll
2009-06-10 16:33 . 2009-06-10 16:33 1704960 ----a-w- c:\windows\system32\nvcuda.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod155.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-06-10 16:33 . 2009-06-10 16:33 1317408 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-06-10 16:33 . 2009-06-10 16:33 10379264 ----a-w- c:\windows\system32\nvoglv32.dll
2009-06-10 06:35 . 2009-06-10 06:35 1505824 ----a-w- c:\windows\system32\nvcpluir.dll
2009-06-10 06:35 . 2009-06-10 06:35 1358368 ----a-w- c:\windows\system32\nvsvsr.dll
2009-06-10 06:35 . 2009-06-10 06:35 1194528 ----a-w- c:\windows\system32\nvcplui.exe
2009-06-10 06:35 . 2009-06-10 06:35 1296928 ----a-w- c:\windows\system32\nvsvs.dll
2009-06-10 04:33 . 2009-06-10 04:33 244736 ----a-w- c:\windows\system32\nvStInst.exe
2009-06-10 04:33 . 2009-06-10 04:33 467968 ----a-w- c:\windows\system32\nvstlink.exe
2009-06-10 04:33 . 2009-06-10 04:33 3953152 ----a-w- c:\windows\system32\nvstwiz.exe
2009-06-10 04:33 . 2009-06-10 04:33 141824 ----a-w- c:\windows\system32\nvStereoApiI.dll
2009-06-10 04:33 . 2009-06-10 04:33 171520 ----a-w- c:\windows\system32\nvStereoApiI64.dll
2009-06-10 04:33 . 2009-06-10 04:33 232960 ----a-w- c:\windows\system32\nvSCPAPISvr.exe
2009-06-10 04:32 . 2009-06-10 04:32 257536 ----a-w- c:\windows\system32\nvSCPAPI.dll
2009-06-10 04:32 . 2009-06-10 04:32 301568 ----a-w- c:\windows\system32\nvSCPAPI64.dll
2009-06-10 04:32 . 2009-06-10 04:32 3293184 ----a-w- c:\windows\system32\nvstres.dll
2009-06-10 04:32 . 2009-06-10 04:32 5847 ----a-w- c:\windows\system32\oglstreg.reg
2009-06-10 04:31 . 2009-06-10 04:31 167424 ----a-w- c:\windows\system32\nvstreg.exe
2009-06-10 04:31 . 2009-06-10 04:31 1718272 ----a-w- c:\windows\system32\nvsttest.exe
2009-06-10 04:31 . 2009-06-10 04:31 1034752 ----a-w- c:\windows\system32\nvstview.exe
2009-06-10 04:31 . 2009-06-10 04:31 89088 ----a-w- c:\windows\system32\nvimage.dll
2009-06-10 04:29 . 2009-06-10 04:29 1656 ----a-w- c:\windows\system32\nvstdef.reg
2009-06-08 17:01 . 2008-07-31 19:40 -------- d-----w- c:\progra~2\TrackMania
2009-06-07 08:52 . 2009-06-07 08:52 10134 ----a-r- c:\users\Fryct\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-07 08:52 . 2009-06-07 08:52 -------- d-----w- c:\program files\Microsoft WSE
2009-06-06 16:12 . 2008-07-26 15:36 -------- d-----w- c:\program files\Electronic Arts
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-05-28 15:07 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-05-28 10:55 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-05-21 20:49 . 2009-05-10 10:46 -------- d-----w- c:\program files\rFactor
2009-05-10 19:21 . 2009-05-10 19:21 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-05-09 05:50 . 2009-06-10 09:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-10 09:09 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-28 07:55 . 2009-04-28 07:55 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-04-23 12:15 . 2009-06-10 09:07 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:14 . 2009-06-10 09:07 623616 ----a-w- c:\windows\system32\localspl.dll
2009-04-21 22:20 . 2009-04-21 22:20 14311680 ----a-w- c:\windows\system32\xlive.dll
2009-04-21 22:20 . 2009-04-21 22:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll
2009-04-21 11:39 . 2009-06-10 09:07 2034688 ----a-w- c:\windows\system32\win32k.sys
2009-06-24 15:27 . 2009-07-01 15:56 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-01 215552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-17 6793760]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13785632]

c:\users\Fryct\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-7-26 3581680]

c:\users\Fryct\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-7-26 3581680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):84,f2,65,d2,a6,df,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3017709691-804468469-1464511852-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{101D2057-1C16-420A-906F-E3C44D627292}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8383F2A-5385-46A6-8BFA-1E8EE34798EE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{6E1B9AAE-98B5-427D-B821-B6378835474B}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{189A5AF6-EAEC-4117-A744-187E90D5BB2B}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{CD5DA0EC-732B-48A3-9546-F11402E8B70A}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{E53F93DE-736E-4106-8758-65DC804075E1}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{12AD7443-1084-433B-BBE6-FCFE92D07171}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{2114042D-FBB9-43F2-91CA-7792702A75A7}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{9E808409-3B11-427C-B17B-16688660CDB3}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{DB5EF49C-23F0-4508-9FA9-987ED80E18D5}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{F5958A01-E278-4574-8ADE-A23ACB4F8E3F}"= UDP:c:\program files\IGWarlord\igwarlord.exe:IGWarlord
"{DEE2E5F3-2040-40D0-9F92-A22BAA14AFAB}"= TCP:c:\program files\IGWarlord\igwarlord.exe:IGWarlord
"{61843F1F-BF99-4E05-A217-F92B4A1ADB2D}"= UDP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{8F0E10BD-8BAC-47CB-8B46-33A2A948205F}"= TCP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{FDAFF9FE-B8B7-4CAB-BC25-EE0CBD4CCA80}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{22E23C74-7242-4685-A4FB-7F6BC351EE28}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{FF9A2C3C-0D16-4FDC-9040-D1B3EF3A4226}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{4B8BEBA6-80B0-45BA-8867-B013CF2ECA79}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{530425C9-0F63-416B-8B84-99A437E8B0EE}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BD1AED9B-66F7-42D5-973F-3CD6CFB018DA}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{3BCB6A29-7AE3-4304-96F3-AC616D14D646}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{87C52663-2039-479C-A0FF-537DBE081EB7}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CF4F955D-6822-44C2-A772-F2A680F83C59}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{1E4DB4E0-6A3D-4C28-BE8F-968F93B9F3A6}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{83E8973F-F3CD-43C0-915F-3FAAB66F24F5}"= UDP:c:\program files\Steam\steamapps\common\trackmania united\TmForever.exe:TrackMania United Forever
"{F200D435-B063-4BD4-94F2-8B6077F964BD}"= TCP:c:\program files\Steam\steamapps\common\trackmania united\TmForever.exe:TrackMania United Forever
"{9CA93B90-7E0A-4464-AAB7-B3E6B9B7E073}"= UDP:c:\program files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe:TrackMania United Forever
"{E9D5835A-8BEA-4041-9D8D-92D840EF0E44}"= TCP:c:\program files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe:TrackMania United Forever
"{9C0C5B0E-354D-4175-AD3E-ED9B251DCAD7}"= UDP:c:\program files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:Peggle Extreme
"{11FD57B5-4A28-422E-BBA6-C19BF9D10C75}"= TCP:c:\program files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:Peggle Extreme
"{80126E6C-8F0B-4004-B875-22A334D4027D}"= UDP:c:\program files\Steam\steamapps\common\titan quest\help.htm:Titan Quest
"{16B4B97C-6E57-4785-8D80-E61248DB0C25}"= TCP:c:\program files\Steam\steamapps\common\titan quest\help.htm:Titan Quest
"{AA1C9932-7B6F-4730-A8C0-07735C9805C8}"= UDP:c:\program files\Steam\steamapps\common\titan quest immortal throne\Tqit.exe:Titan Quest: Immortal Throne
"{5C44A1D4-E9C3-4F6B-BF09-6043D5245191}"= TCP:c:\program files\Steam\steamapps\common\titan quest immortal throne\Tqit.exe:Titan Quest: Immortal Throne
"{5EC5A276-4BE0-4A72-83ED-CB8C045D8591}"= UDP:c:\program files\Steam\steamapps\common\titan quest immortal throne\help.htm:Titan Quest: Immortal Throne
"{C0C74C27-C2F3-4596-A503-FB8E26C42C0B}"= TCP:c:\program files\Steam\steamapps\common\titan quest immortal throne\help.htm:Titan Quest: Immortal Throne
"{D9775FD4-3FBC-4949-A6D7-D99BB24C5399}"= UDP:c:\program files\Steam\steamapps\common\trials 2 second edition\launcher.exe:Trials 2: Second Edition
"{623BC05D-93B6-4A0B-8BA1-A0AE2DCF9726}"= TCP:c:\program files\Steam\steamapps\common\trials 2 second edition\launcher.exe:Trials 2: Second Edition
"{FDD7CF1D-6AF2-49D8-B1C9-7D0809E19FC8}"= UDP:c:\program files\Steam\steamapps\common\x3 terran conflict\X3TC.exe:X3: Terran Conflict
"{BD3053F5-FDC1-43C8-BF0E-935CA6B28362}"= TCP:c:\program files\Steam\steamapps\common\x3 terran conflict\X3TC.exe:X3: Terran Conflict
"{4CDD6878-4548-4EDE-81AC-F80B359CC549}"= UDP:c:\program files\Steam\steamapps\common\company of heroes\help.htm:Company of Heroes
"{EBD9DF36-8BAD-4688-B9BF-C5DADF31DF0A}"= TCP:c:\program files\Steam\steamapps\common\company of heroes\help.htm:Company of Heroes
"{7A378ADA-706A-46AB-B1C7-3C681500BC39}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{7F3CCEF5-BFDB-4BE7-804D-1F6857DBC07A}"= UDP:c:\program files\Steam\steamapps\common\the last remnant\Binaries\TLR.exe:The Last Remnant
"{17B89F98-B2E3-4FF6-AD6A-F24030AB0DB0}"= TCP:c:\program files\Steam\steamapps\common\the last remnant\Binaries\TLR.exe:The Last Remnant
"{95213D48-9D1E-430A-81B7-5942AAE3A917}"= UDP:c:\program files\Steam\steamapps\common\unreal tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{53E6152D-9FDE-4D0E-8EF3-89988CC311E8}"= TCP:c:\program files\Steam\steamapps\common\unreal tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{29733425-D2A2-49DA-8466-51BECA6B482A}"= UDP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{DA9C1B56-1DDD-4212-80FA-FD98ABFC3125}"= TCP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{A9CF6801-94F7-444C-A1C3-5FB9445E1552}"= UDP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{F37BC531-42A8-46F0-9D50-748A3F01B289}"= TCP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{39F3C5BA-DD85-45F9-BED7-CB02F7757781}"= UDP:c:\program files\Steam\steamapps\common\peggle deluxe\Peggle.exe:Peggle Deluxe
"{61190302-9076-4F54-BD68-845C1174C736}"= TCP:c:\program files\Steam\steamapps\common\peggle deluxe\Peggle.exe:Peggle Deluxe
"{A1957312-D880-4A9C-BA63-3C6A9D12269C}"= UDP:c:\program files\Steam\steamapps\common\peggle nights\PeggleNights.exe:Peggle Nights
"{0A14D283-CB35-4278-874E-EBC2D28EB7C2}"= TCP:c:\program files\Steam\steamapps\common\peggle nights\PeggleNights.exe:Peggle Nights
"{61D72F24-DC12-46D3-A73A-E0CF6A809B04}"= UDP:c:\program files\Steam\steamapps\common\company of heroes\RelicCOH.exe:Company of Heroes: Opposing Fronts
"{8E3A8E66-68CD-49E6-B98F-AE95E4CB9F2E}"= TCP:c:\program files\Steam\steamapps\common\company of heroes\RelicCOH.exe:Company of Heroes: Opposing Fronts
"{6CBF54B0-1EFE-4A20-BDDE-53B4152E5C3E}"= UDP:c:\program files\Steam\steamapps\common\prototype\prototypef.exe:Prototype
"{216C3479-379E-4B80-824B-BC6A4F5351BD}"= TCP:c:\program files\Steam\steamapps\common\prototype\prototypef.exe:Prototype
"{62B3ED5F-D096-41C1-AE37-F7EB12D7B748}"= UDP:c:\program files\Steam\steamapps\common\red orchestra\System\RedOrchestra.exe:Red Orchestra
"{595778B3-1656-449D-8B09-8379B7F66E54}"= TCP:c:\program files\Steam\steamapps\common\red orchestra\System\RedOrchestra.exe:Red Orchestra
"{800EA7D6-2A21-42A5-9C20-AB68008B708F}"= UDP:c:\program files\Steam\steamapps\common\shadowgrounds\Shadowgrounds.exe:Shadowgrounds
"{84D0B703-303F-46C5-A146-9BF8BCCBE6D4}"= TCP:c:\program files\Steam\steamapps\common\shadowgrounds\Shadowgrounds.exe:Shadowgrounds
"{B19F27EF-32AF-44C6-8BD3-3B9D208CDE43}"= UDP:c:\program files\Steam\steamapps\common\shadowgrounds\ShadowgroundsLauncher.exe:Shadowgrounds
"{FCDF5311-1CC7-40BE-8872-DAB61223EDAC}"= TCP:c:\program files\Steam\steamapps\common\shadowgrounds\ShadowgroundsLauncher.exe:Shadowgrounds
"{DD27ABE2-A9D8-44D5-AB6F-E7CB46A5F269}"= UDP:c:\program files\Steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead
"{DB624513-F49B-4FD8-9A60-E63BC63232E9}"= TCP:c:\program files\Steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead
"{9F6C31A3-4A02-4596-B9FE-ABA70F81E714}"= UDP:d:\streetfighteriv\StreetFighterIV.exe:STREET FIGHTER IV
"{FCB9D426-12A3-47B5-AADB-B7FB05A70FDE}"= TCP:d:\streetfighteriv\StreetFighterIV.exe:STREET FIGHTER IV
"{6AE9B028-EC14-439A-92D0-A765243722B6}"= UDP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{24145960-6301-4880-83DA-E154F76347BC}"= TCP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{C2A6EA39-0D9A-4CBE-9999-F80B8064C4D7}"= UDP:c:\program files\Stardock Games\Demigod\bin\Demigod.exe:Demigod
"{C6C881ED-5ACB-4197-8B6C-A57910CCB895}"= TCP:c:\program files\Stardock Games\Demigod\bin\Demigod.exe:Demigod
"{458616C4-2F77-4590-946B-E26323046FB5}"= UDP:c:\program files\Steam\steamapps\common\trine\trine_launcher.exe:Trine
"{538E8070-ED91-4ACA-A245-33A0679DEEC7}"= TCP:c:\program files\Steam\steamapps\common\trine\trine_launcher.exe:Trine
"{90618E61-22A7-4EDC-9A38-593985B9C439}"= UDP:c:\program files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:Killing Floor
"{82ED241A-ACB0-4BAC-A15B-6652A8D97643}"= TCP:c:\program files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:Killing Floor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Persona\\Persona.exe"= c:\program files\Persona\Persona.exe:*:Enabled:Persona

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [19/03/2009 11:44 107256]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [01/10/2008 16:44 20384]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [19/03/2009 11:44 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [19/03/2009 11:45 93312]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\System32\nvSCPAPISvr.exe [10/06/2009 06:33 232960]
R3 LycoFltr;Lycosa Keyboard;c:\windows\System32\drivers\Lycosa.sys [18/01/2008 06:43 16128]
S3 A5AGU;D-Link Wireless LAN 802.11 USB device driver;c:\windows\System32\drivers\AGUx86.sys [08/10/2007 09:53 892416]
S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNIMP50.sys [16/11/2006 14:36 21504]
S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNISP50.sys [16/11/2006 14:36 20480]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [29/02/2008 02:07 942080]
S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\System32\drivers\WN111v2v.sys [30/09/2008 03:20 449536]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: dogsoftheseas.com
Trusted Zone: dogsoftheseas.com\realm01
Trusted Zone: dogsoftheseas.com\www
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\{3502a070-ea2f-11dd-ba2f-0800200c9a66}\components\mintray-9178506d-2005072516-trunk.dll
FF - component: c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - plugin: c:\progra~1\SONYON~1\npsoe.dll
FF - plugin: c:\program files\IGN\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Opera\program\plugins\npsoestb.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-16 17:06
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3620)
geyekrpahvfrqw.dll 10000000 36864 \\?\globalroot\systemroot\system32\geyekrpahvfrqw.dll
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\program files\Stardock\Object Desktop\DeskScapes\deskscapes.dll
c:\program files\Stardock\Object Desktop\DeskScapes\deskscape.dll
c:\progra~1\Stardock\OBJECT~2\DESKSC~1\DesktopControlPanel.dll
c:\program files\Stardock\Object Desktop\DeskScapes\DreamControl.dll
.
Completion time: 2009-07-16 17:09
ComboFix-quarantined-files.txt 2009-07-16 15:09

Pre-Run: 68 200 570 880 octets libres
Post-Run: 68 195 643 392 octets libres

Current=3 Default=3 Failed=1 LastKnownGood=5 Sets=1,2,3,4,5
377 --- E O F --- 2009-07-14 21:47

Hey, on dirait que ça a bien marché ! héhé :)

Pour tout à l'heure, je pensais vraiment que ça avait marché. Mais si aucun des logiciels que j'avais me le détectait, que faut-il utiliser périodiquement pour être plus ou moins sûr que l'on n'a pas attrapé une saloperie invisible ?

Voici en tout cas le dernier log ComboFix:


ComboFix 09-07-14.08 - Fryct 16/07/2009 17:44.13.4 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3583.2607 [GMT 2:00]
Running from: c:\users\Fryct\Desktop\ske.exe
Command switches used :: c:\users\Fryct\Desktop\CFScript.txt
SP: AdwareBot *disabled* (Updated) {2BFC08CE-6B66-47D4-BA62-0A39887A0229}
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point

FILE ::
"c:\windows\system32\drivers\geyekrnxsbucwe.sys"
"c:\windows\system32\drivers\geyekrpahvfrqw.dll"
"c:\windows\System32\geyekrixjpcbxm.dll"
"c:\windows\System32\geyekrlxsxoqje.dat"
"c:\windows\System32\geyekrnhttpmvx.dat"
"c:\windows\system32\geyekrpahvfrqw.dll"
"c:\windows\temp\geyekrrcqnfmciar.tmp"
"c:\windows\temp\geyekrruembkfxsi.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\geyekrnxsbucwe.sys
c:\windows\System32\geyekrixjpcbxm.dll
c:\windows\System32\geyekrlxsxoqje.dat
c:\windows\System32\geyekrnhttpmvx.dat
c:\windows\system32\geyekrpahvfrqw.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_geyekrvgmpndef


((((((((((((((((((((((((( Files Created from 2009-06-16 to 2009-07-16 )))))))))))))))))))))))))))))))
.

2009-07-16 15:48 . 2009-07-16 15:49 -------- d-----w- c:\users\Fryct\AppData\Local\temp
2009-07-16 12:42 . 2009-07-16 12:42 -------- d-----w- C:\rsit
2009-07-15 09:24 . 2009-07-15 09:24 -------- d-----w- c:\program files\CCleaner
2009-07-14 21:45 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-14 21:45 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-14 21:45 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-14 21:45 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-14 21:45 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-14 13:35 . 2009-07-16 12:38 -------- d-----w- c:\program files\Trend Micro
2009-07-14 11:56 . 2009-07-14 12:49 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-07-14 09:45 . 2009-07-14 09:45 -------- d-----w- c:\progra~2\Simply Super Software
2009-07-13 22:27 . 2009-07-13 23:19 -------- d-----w- c:\windows\BDOSCAN8
2009-07-13 18:41 . 2009-07-13 18:41 -------- d-----w- c:\users\Fryct\AppData\Roaming\Malwarebytes
2009-07-13 18:41 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 18:41 . 2009-07-14 16:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-13 18:41 . 2009-07-13 18:41 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-13 18:41 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-13 16:23 . 2009-07-13 16:23 -------- d---a-w- c:\program files\Common Files\Nero
2009-07-13 16:07 . 2009-07-13 16:07 -------- d-----w- c:\progra~2\SlySoft
2009-07-13 16:04 . 2009-07-13 16:04 -------- d-----w- c:\program files\SlySoft
2009-07-12 21:47 . 2009-07-12 22:17 -------- d-----w- c:\users\Fryct\AppData\Roaming\CyberLink
2009-07-12 21:47 . 2009-07-12 21:47 -------- d-----w- c:\users\Public\CyberLink
2009-07-12 21:44 . 2009-07-12 21:44 -------- dc----w- c:\windows\system32\DRVSTORE
2009-07-12 21:40 . 2009-07-12 22:07 -------- d-----w- c:\progra~2\CyberLink
2009-07-12 21:40 . 2008-05-14 12:48 29480 ------w- c:\windows\system32\msxml3a.dll
2009-07-12 21:39 . 2008-05-14 12:48 505128 ----a-w- c:\windows\system32\msvcp71.dll
2009-07-12 21:39 . 2009-07-13 16:15 -------- d-----w- c:\program files\CyberLink
2009-07-12 08:45 . 2009-07-12 08:45 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-12 08:45 . 2009-07-12 08:45 -------- d-----w- c:\windows\system32\AGEIA
2009-07-12 08:29 . 2009-07-12 08:29 -------- d-----w- c:\users\Fryct\{c904a8d4-a5d3-4d40-a799-60f6c462408a}
2009-07-12 08:29 . 2009-06-04 14:39 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-07-08 17:58 . 2005-07-25 09:59 28672 ----a-w- c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\{3502a070-ea2f-11dd-ba2f-0800200c9a66}\components\mintray-9178506d-2005072516-trunk.dll
2009-07-05 17:55 . 2008-04-16 12:13 65536 ----a-w- c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
2009-07-05 00:33 . 2009-07-05 07:17 -------- d-----w- c:\users\Fryct\AppData\Roaming\IGN_DLM
2009-07-01 15:57 . 2009-07-01 15:57 0 ----a-w- c:\windows\nsreg.dat
2009-07-01 15:57 . 2009-07-01 15:57 -------- d-----w- c:\users\Fryct\AppData\Local\Mozilla
2009-06-20 09:48 . 2009-06-20 09:48 -------- d-----w- c:\users\Fryct\AppData\Local\ArmA 2
2009-06-20 09:47 . 2009-03-16 12:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
2009-06-20 09:47 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2009-06-20 09:47 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2009-06-20 09:47 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2009-06-20 09:35 . 2009-06-20 09:35 -------- d-----w- c:\program files\Bohemia Interactive
2009-06-17 19:46 . 2009-06-17 19:46 -------- d-----w- c:\users\Fryct\AppData\Local\Monte Cristo

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-16 15:49 . 2009-07-12 08:52 31966 ----a-w- c:\progra~2\nvModes.dat
2009-07-16 15:49 . 2008-07-24 14:48 -------- d-----w- c:\progra~2\NVIDIA
2009-07-16 15:18 . 2006-11-02 15:48 716060 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-16 15:18 . 2006-11-02 15:48 144214 ----a-w- c:\windows\system32\perfc00C.dat
2009-07-15 09:32 . 2009-04-08 20:19 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2009-07-14 21:47 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-14 21:47 . 2008-07-26 07:13 -------- d-----w- c:\progra~2\Microsoft Help
2009-07-13 16:23 . 2008-07-24 17:11 -------- d-----w- c:\program files\Nero
2009-07-13 16:15 . 2008-07-25 22:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-13 14:56 . 2008-07-24 19:34 -------- d-----w- c:\program files\Steam
2009-07-12 21:47 . 2008-07-24 14:42 106240 ----a-w- c:\users\Fryct\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-12 21:38 . 2008-07-24 14:44 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-12 16:03 . 2008-09-25 15:16 -------- d-----w- c:\users\Fryct\AppData\Roaming\vlc
2009-07-12 08:45 . 2008-11-08 12:55 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-12 03:21 . 2008-07-26 17:11 -------- d-----w- c:\program files\Messenger Plus! Live
2009-07-11 20:42 . 2008-07-24 18:19 -------- d-----w- c:\users\Fryct\AppData\Roaming\MxBoost
2009-07-05 11:08 . 2008-07-24 19:34 -------- d-----w- c:\program files\Common Files\Steam
2009-07-05 09:32 . 2008-08-23 11:39 -------- d-----w- c:\program files\City of Heroes
2009-06-30 16:50 . 2008-07-26 21:32 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-06-23 12:11 . 2008-07-25 22:10 137888 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-06-23 12:11 . 2008-07-25 22:09 189288 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-06-22 11:51 . 2008-07-25 22:09 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-06-17 17:47 . 2009-05-09 10:38 -------- d-----w- c:\program files\Common Files\BioWare
2009-06-17 17:46 . 2008-07-26 15:49 -------- d-----w- c:\progra~2\Media Center Programs
2009-06-14 15:15 . 2009-06-13 13:26 -------- d-----w- c:\program files\Sony Online Entertainment
2009-06-11 18:46 . 2008-08-02 09:51 -------- d-----w- c:\progra~2\Steam
2009-06-11 18:46 . 2008-08-02 09:50 -------- d-----w- c:\progra~2\PopCap Games
2009-06-10 16:33 . 2009-06-10 16:33 9899296 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2009-06-10 16:33 . 2009-06-10 16:33 989696 ----a-w- c:\windows\system32\nvapi.dll
2009-06-10 16:33 . 2009-06-10 16:33 7611904 ----a-w- c:\windows\system32\nvd3dum.dll
2009-06-10 16:33 . 2009-06-10 16:33 678432 ----a-w- c:\windows\system32\nvcuvid.dll
2009-06-10 16:33 . 2009-06-10 16:33 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-06-10 16:33 . 2009-06-10 16:33 4224 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2009-06-10 16:33 . 2009-06-10 16:33 3148288 ----a-w- c:\windows\system32\nvwgf2um.dll
2009-06-10 16:33 . 2009-06-10 16:33 1704960 ----a-w- c:\windows\system32\nvcuda.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod155.dll
2009-06-10 16:33 . 2009-06-10 16:33 151552 ----a-w- c:\windows\system32\nvcod.dll
2009-06-10 16:33 . 2009-06-10 16:33 1317408 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-06-10 16:33 . 2009-06-10 16:33 10379264 ----a-w- c:\windows\system32\nvoglv32.dll
2009-06-10 06:35 . 2009-06-10 06:35 1505824 ----a-w- c:\windows\system32\nvcpluir.dll
2009-06-10 06:35 . 2009-06-10 06:35 1358368 ----a-w- c:\windows\system32\nvsvsr.dll
2009-06-10 06:35 . 2009-06-10 06:35 1194528 ----a-w- c:\windows\system32\nvcplui.exe
2009-06-10 06:35 . 2009-06-10 06:35 1296928 ----a-w- c:\windows\system32\nvsvs.dll
2009-06-10 04:33 . 2009-06-10 04:33 244736 ----a-w- c:\windows\system32\nvStInst.exe
2009-06-10 04:33 . 2009-06-10 04:33 467968 ----a-w- c:\windows\system32\nvstlink.exe
2009-06-10 04:33 . 2009-06-10 04:33 3953152 ----a-w- c:\windows\system32\nvstwiz.exe
2009-06-10 04:33 . 2009-06-10 04:33 141824 ----a-w- c:\windows\system32\nvStereoApiI.dll
2009-06-10 04:33 . 2009-06-10 04:33 171520 ----a-w- c:\windows\system32\nvStereoApiI64.dll
2009-06-10 04:33 . 2009-06-10 04:33 232960 ----a-w- c:\windows\system32\nvSCPAPISvr.exe
2009-06-10 04:32 . 2009-06-10 04:32 257536 ----a-w- c:\windows\system32\nvSCPAPI.dll
2009-06-10 04:32 . 2009-06-10 04:32 301568 ----a-w- c:\windows\system32\nvSCPAPI64.dll
2009-06-10 04:32 . 2009-06-10 04:32 3293184 ----a-w- c:\windows\system32\nvstres.dll
2009-06-10 04:32 . 2009-06-10 04:32 5847 ----a-w- c:\windows\system32\oglstreg.reg
2009-06-10 04:31 . 2009-06-10 04:31 167424 ----a-w- c:\windows\system32\nvstreg.exe
2009-06-10 04:31 . 2009-06-10 04:31 1718272 ----a-w- c:\windows\system32\nvsttest.exe
2009-06-10 04:31 . 2009-06-10 04:31 1034752 ----a-w- c:\windows\system32\nvstview.exe
2009-06-10 04:31 . 2009-06-10 04:31 89088 ----a-w- c:\windows\system32\nvimage.dll
2009-06-10 04:29 . 2009-06-10 04:29 1656 ----a-w- c:\windows\system32\nvstdef.reg
2009-06-08 17:01 . 2008-07-31 19:40 -------- d-----w- c:\progra~2\TrackMania
2009-06-07 08:52 . 2009-06-07 08:52 10134 ----a-r- c:\users\Fryct\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-06-07 08:52 . 2009-06-07 08:52 -------- d-----w- c:\program files\Microsoft WSE
2009-06-06 16:12 . 2008-07-26 15:36 -------- d-----w- c:\program files\Electronic Arts
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-05-28 15:07 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-05-28 15:07 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-05-28 10:55 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-05-21 20:49 . 2009-05-10 10:46 -------- d-----w- c:\program files\rFactor
2009-05-10 19:21 . 2009-05-10 19:21 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-05-09 05:50 . 2009-06-10 09:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-10 09:09 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-28 07:55 . 2009-04-28 07:55 70936 ----a-w- c:\windows\system32\PhysXLoader.dll
2009-04-23 12:15 . 2009-06-10 09:07 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:14 . 2009-06-10 09:07 623616 ----a-w- c:\windows\system32\localspl.dll
2009-04-21 22:20 . 2009-04-21 22:20 14311680 ----a-w- c:\windows\system32\xlive.dll
2009-04-21 22:20 . 2009-04-21 22:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll
2009-04-21 11:39 . 2009-06-10 09:07 2034688 ----a-w- c:\windows\system32\win32k.sys
2009-06-24 15:27 . 2009-07-01 15:56 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-16_15.06.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-24 14:49 . 2009-07-16 12:37 34342 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-24 14:49 . 2009-07-16 15:15 34342 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-07-16 15:15 76398 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-07-24 14:43 . 2009-07-16 15:15 8382 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3017709691-804468469-1464511852-1000_UserData.bin
- 2008-07-24 14:43 . 2009-07-16 12:37 8382 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3017709691-804468469-1464511852-1000_UserData.bin
+ 2006-11-02 10:33 . 2009-07-16 15:18 624236 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-07-16 15:18 113738 c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-03-19 2029640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-01 215552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-17 6793760]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13785632]

c:\users\Fryct\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2008-7-26 3581680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):84,f2,65,d2,a6,df,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3017709691-804468469-1464511852-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{101D2057-1C16-420A-906F-E3C44D627292}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{D8383F2A-5385-46A6-8BFA-1E8EE34798EE}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{6E1B9AAE-98B5-427D-B821-B6378835474B}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{189A5AF6-EAEC-4117-A744-187E90D5BB2B}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{CD5DA0EC-732B-48A3-9546-F11402E8B70A}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{E53F93DE-736E-4106-8758-65DC804075E1}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{12AD7443-1084-433B-BBE6-FCFE92D07171}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{2114042D-FBB9-43F2-91CA-7792702A75A7}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{9E808409-3B11-427C-B17B-16688660CDB3}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{DB5EF49C-23F0-4508-9FA9-987ED80E18D5}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{F5958A01-E278-4574-8ADE-A23ACB4F8E3F}"= UDP:c:\program files\IGWarlord\igwarlord.exe:IGWarlord
"{DEE2E5F3-2040-40D0-9F92-A22BAA14AFAB}"= TCP:c:\program files\IGWarlord\igwarlord.exe:IGWarlord
"{61843F1F-BF99-4E05-A217-F92B4A1ADB2D}"= UDP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{8F0E10BD-8BAC-47CB-8B46-33A2A948205F}"= TCP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{FDAFF9FE-B8B7-4CAB-BC25-EE0CBD4CCA80}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{22E23C74-7242-4685-A4FB-7F6BC351EE28}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{FF9A2C3C-0D16-4FDC-9040-D1B3EF3A4226}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{4B8BEBA6-80B0-45BA-8867-B013CF2ECA79}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{530425C9-0F63-416B-8B84-99A437E8B0EE}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BD1AED9B-66F7-42D5-973F-3CD6CFB018DA}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{3BCB6A29-7AE3-4304-96F3-AC616D14D646}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{87C52663-2039-479C-A0FF-537DBE081EB7}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CF4F955D-6822-44C2-A772-F2A680F83C59}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{1E4DB4E0-6A3D-4C28-BE8F-968F93B9F3A6}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{83E8973F-F3CD-43C0-915F-3FAAB66F24F5}"= UDP:c:\program files\Steam\steamapps\common\trackmania united\TmForever.exe:TrackMania United Forever
"{F200D435-B063-4BD4-94F2-8B6077F964BD}"= TCP:c:\program files\Steam\steamapps\common\trackmania united\TmForever.exe:TrackMania United Forever
"{9CA93B90-7E0A-4464-AAB7-B3E6B9B7E073}"= UDP:c:\program files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe:TrackMania United Forever
"{E9D5835A-8BEA-4041-9D8D-92D840EF0E44}"= TCP:c:\program files\Steam\steamapps\common\trackmania united\TmForeverLauncher.exe:TrackMania United Forever
"{9C0C5B0E-354D-4175-AD3E-ED9B251DCAD7}"= UDP:c:\program files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:Peggle Extreme
"{11FD57B5-4A28-422E-BBA6-C19BF9D10C75}"= TCP:c:\program files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:Peggle Extreme
"{80126E6C-8F0B-4004-B875-22A334D4027D}"= UDP:c:\program files\Steam\steamapps\common\titan quest\help.htm:Titan Quest
"{16B4B97C-6E57-4785-8D80-E61248DB0C25}"= TCP:c:\program files\Steam\steamapps\common\titan quest\help.htm:Titan Quest
"{AA1C9932-7B6F-4730-A8C0-07735C9805C8}"= UDP:c:\program files\Steam\steamapps\common\titan quest immortal throne\Tqit.exe:Titan Quest: Immortal Throne
"{5C44A1D4-E9C3-4F6B-BF09-6043D5245191}"= TCP:c:\program files\Steam\steamapps\common\titan quest immortal throne\Tqit.exe:Titan Quest: Immortal Throne
"{5EC5A276-4BE0-4A72-83ED-CB8C045D8591}"= UDP:c:\program files\Steam\steamapps\common\titan quest immortal throne\help.htm:Titan Quest: Immortal Throne
"{C0C74C27-C2F3-4596-A503-FB8E26C42C0B}"= TCP:c:\program files\Steam\steamapps\common\titan quest immortal throne\help.htm:Titan Quest: Immortal Throne
"{D9775FD4-3FBC-4949-A6D7-D99BB24C5399}"= UDP:c:\program files\Steam\steamapps\common\trials 2 second edition\launcher.exe:Trials 2: Second Edition
"{623BC05D-93B6-4A0B-8BA1-A0AE2DCF9726}"= TCP:c:\program files\Steam\steamapps\common\trials 2 second edition\launcher.exe:Trials 2: Second Edition
"{FDD7CF1D-6AF2-49D8-B1C9-7D0809E19FC8}"= UDP:c:\program files\Steam\steamapps\common\x3 terran conflict\X3TC.exe:X3: Terran Conflict
"{BD3053F5-FDC1-43C8-BF0E-935CA6B28362}"= TCP:c:\program files\Steam\steamapps\common\x3 terran conflict\X3TC.exe:X3: Terran Conflict
"{4CDD6878-4548-4EDE-81AC-F80B359CC549}"= UDP:c:\program files\Steam\steamapps\common\company of heroes\help.htm:Company of Heroes
"{EBD9DF36-8BAD-4688-B9BF-C5DADF31DF0A}"= TCP:c:\program files\Steam\steamapps\common\company of heroes\help.htm:Company of Heroes
"{7A378ADA-706A-46AB-B1C7-3C681500BC39}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{7F3CCEF5-BFDB-4BE7-804D-1F6857DBC07A}"= UDP:c:\program files\Steam\steamapps\common\the last remnant\Binaries\TLR.exe:The Last Remnant
"{17B89F98-B2E3-4FF6-AD6A-F24030AB0DB0}"= TCP:c:\program files\Steam\steamapps\common\the last remnant\Binaries\TLR.exe:The Last Remnant
"{95213D48-9D1E-430A-81B7-5942AAE3A917}"= UDP:c:\program files\Steam\steamapps\common\unreal tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{53E6152D-9FDE-4D0E-8EF3-89988CC311E8}"= TCP:c:\program files\Steam\steamapps\common\unreal tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{29733425-D2A2-49DA-8466-51BECA6B482A}"= UDP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{DA9C1B56-1DDD-4212-80FA-FD98ABFC3125}"= TCP:c:\program files\Electronic Arts\BattleForge\Bootstrapper.exe:BattleForge™ Launcher
"{A9CF6801-94F7-444C-A1C3-5FB9445E1552}"= UDP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{F37BC531-42A8-46F0-9D50-748A3F01B289}"= TCP:c:\program files\Electronic Arts\BattleForge\BattleForge.exe:BattleForge™
"{39F3C5BA-DD85-45F9-BED7-CB02F7757781}"= UDP:c:\program files\Steam\steamapps\common\peggle deluxe\Peggle.exe:Peggle Deluxe
"{61190302-9076-4F54-BD68-845C1174C736}"= TCP:c:\program files\Steam\steamapps\common\peggle deluxe\Peggle.exe:Peggle Deluxe
"{A1957312-D880-4A9C-BA63-3C6A9D12269C}"= UDP:c:\program files\Steam\steamapps\common\peggle nights\PeggleNights.exe:Peggle Nights
"{0A14D283-CB35-4278-874E-EBC2D28EB7C2}"= TCP:c:\program files\Steam\steamapps\common\peggle nights\PeggleNights.exe:Peggle Nights
"{61D72F24-DC12-46D3-A73A-E0CF6A809B04}"= UDP:c:\program files\Steam\steamapps\common\company of heroes\RelicCOH.exe:Company of Heroes: Opposing Fronts
"{8E3A8E66-68CD-49E6-B98F-AE95E4CB9F2E}"= TCP:c:\program files\Steam\steamapps\common\company of heroes\RelicCOH.exe:Company of Heroes: Opposing Fronts
"{6CBF54B0-1EFE-4A20-BDDE-53B4152E5C3E}"= UDP:c:\program files\Steam\steamapps\common\prototype\prototypef.exe:Prototype
"{216C3479-379E-4B80-824B-BC6A4F5351BD}"= TCP:c:\program files\Steam\steamapps\common\prototype\prototypef.exe:Prototype
"{62B3ED5F-D096-41C1-AE37-F7EB12D7B748}"= UDP:c:\program files\Steam\steamapps\common\red orchestra\System\RedOrchestra.exe:Red Orchestra
"{595778B3-1656-449D-8B09-8379B7F66E54}"= TCP:c:\program files\Steam\steamapps\common\red orchestra\System\RedOrchestra.exe:Red Orchestra
"{800EA7D6-2A21-42A5-9C20-AB68008B708F}"= UDP:c:\program files\Steam\steamapps\common\shadowgrounds\Shadowgrounds.exe:Shadowgrounds
"{84D0B703-303F-46C5-A146-9BF8BCCBE6D4}"= TCP:c:\program files\Steam\steamapps\common\shadowgrounds\Shadowgrounds.exe:Shadowgrounds
"{B19F27EF-32AF-44C6-8BD3-3B9D208CDE43}"= UDP:c:\program files\Steam\steamapps\common\shadowgrounds\ShadowgroundsLauncher.exe:Shadowgrounds
"{FCDF5311-1CC7-40BE-8872-DAB61223EDAC}"= TCP:c:\program files\Steam\steamapps\common\shadowgrounds\ShadowgroundsLauncher.exe:Shadowgrounds
"{DD27ABE2-A9D8-44D5-AB6F-E7CB46A5F269}"= UDP:c:\program files\Steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead
"{DB624513-F49B-4FD8-9A60-E63BC63232E9}"= TCP:c:\program files\Steam\steamapps\common\left 4 dead\left4dead.exe:Left 4 Dead
"{9F6C31A3-4A02-4596-B9FE-ABA70F81E714}"= UDP:d:\streetfighteriv\StreetFighterIV.exe:STREET FIGHTER IV
"{FCB9D426-12A3-47B5-AADB-B7FB05A70FDE}"= TCP:d:\streetfighteriv\StreetFighterIV.exe:STREET FIGHTER IV
"{6AE9B028-EC14-439A-92D0-A765243722B6}"= UDP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{24145960-6301-4880-83DA-E154F76347BC}"= TCP:c:\program files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire
"{C2A6EA39-0D9A-4CBE-9999-F80B8064C4D7}"= UDP:c:\program files\Stardock Games\Demigod\bin\Demigod.exe:Demigod
"{C6C881ED-5ACB-4197-8B6C-A57910CCB895}"= TCP:c:\program files\Stardock Games\Demigod\bin\Demigod.exe:Demigod
"{458616C4-2F77-4590-946B-E26323046FB5}"= UDP:c:\program files\Steam\steamapps\common\trine\trine_launcher.exe:Trine
"{538E8070-ED91-4ACA-A245-33A0679DEEC7}"= TCP:c:\program files\Steam\steamapps\common\trine\trine_launcher.exe:Trine
"{90618E61-22A7-4EDC-9A38-593985B9C439}"= UDP:c:\program files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:Killing Floor
"{82ED241A-ACB0-4BAC-A15B-6652A8D97643}"= TCP:c:\program files\Steam\steamapps\common\killingfloor\System\KillingFloor.exe:Killing Floor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\Persona\\Persona.exe"= c:\program files\Persona\Persona.exe:*:Enabled:Persona

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [19/03/2009 11:44 107256]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [01/10/2008 16:44 20384]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [19/03/2009 11:44 731840]
R2 epfwwfpr;epfwwfpr;c:\windows\System32\drivers\epfwwfpr.sys [19/03/2009 11:45 93312]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\System32\nvSCPAPISvr.exe [10/06/2009 06:33 232960]
R3 LycoFltr;Lycosa Keyboard;c:\windows\System32\drivers\Lycosa.sys [18/01/2008 06:43 16128]
S3 A5AGU;D-Link Wireless LAN 802.11 USB device driver;c:\windows\System32\drivers\AGUx86.sys [08/10/2007 09:53 892416]
S3 DNIMp50;DNIMp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNIMP50.sys [16/11/2006 14:36 21504]
S3 DNISp50;DNISp50 NDIS Protocol Driver;c:\windows\System32\drivers\DNISP50.sys [16/11/2006 14:36 20480]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [29/02/2008 02:07 942080]
S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\System32\drivers\WN111v2v.sys [30/09/2008 03:20 449536]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: dogsoftheseas.com
Trusted Zone: dogsoftheseas.com\realm01
Trusted Zone: dogsoftheseas.com\www
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - component: c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\{3502a070-ea2f-11dd-ba2f-0800200c9a66}\components\mintray-9178506d-2005072516-trunk.dll
FF - component: c:\users\Fryct\AppData\Roaming\Mozilla\Firefox\Profiles\qcdel8hs.default\extensions\doudehou@gmail.com\components\statusbarEx.dll
FF - plugin: c:\progra~1\SONYON~1\npsoe.dll
FF - plugin: c:\program files\IGN\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll
FF - plugin: c:\program files\Opera\program\plugins\npsoestb.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-16 17:49
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3017709691-804468469-1464511852-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:31,fc,d5,70,dd,8f,73,99,79,8e,b3,22,01,6f,df,52,51,4c,c0,f3,7b,f4,4c,
39,ab,79,e4,12,bb,07,8e,b0,e3,c3,8e,64,7a,04,b8,12,03,80,51,33,c7,ee,42,8f,\
"??"=hex:0a,b9,d7,2a,9f,a3,5c,15,af,43,50,01,d3,5c,b9,eb

[HKEY_USERS\S-1-5-21-3017709691-804468469-1464511852-1000\Software\SecuROM\License information*]
"datasecu"=hex:47,75,00,0d,cc,63,d0,45,8d,37,da,77,88,92,42,fe,cd,dc,51,75,a2,
42,b1,43,17,e3,13,e0,9f,55,b0,e9,9f,7f,bb,96,1e,70,23,d8,5f,21,89,e1,78,9d,\
"rkeysecu"=hex:01,a8,a3,d0,1c,32,b3,d5,ab,e9,a0,17,12,71,11,ec
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3924)
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\program files\Stardock\Object Desktop\DeskScapes\deskscapes.dll
c:\program files\Stardock\Object Desktop\DeskScapes\deskscape.dll
c:\progra~1\Stardock\OBJECT~2\DESKSC~1\DesktopControlPanel.dll
c:\program files\Stardock\Object Desktop\DeskScapes\DreamControl.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\nvvsvc.exe
c:\windows\System32\PnkBstrA.exe
c:\windows\System32\conime.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2009-07-16 17:55 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-16 15:55
ComboFix2.txt 2009-07-16 15:09

Pre-Run: 68 094 021 632 octets libres
Post-Run: 67 858 526 208 octets libres

419 --- E O F --- 2009-07-14 21:47

Oui le PC va mieux forcément. Voici donc le rapport:

Rapport GenProc 2.604 [1] - 16/07/2009 à 19:02:43
@ Windows Vista Service Pack 2 - Mode normal
@ Mozilla Firefox (3.5) [Navigateur par défaut]

~~ "C:\Windows\sed.exe" a été renommé sed.exe_RenameGenProc ~~
~~ "C:\Windows\grep.exe" a été renommé grep.exe_RenameGenProc ~~
~~ ECHEC DU TELECHARGEMENT DE MBR.EXE ~~
~~ ECHEC DU TELECHARGEMENT D'HIJACKTHIS ~~

GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :


Poste un rapport NanoScan https://www.micro-astuce.com/securite/NanoScan-Panda.php




----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 19:03:15 ~~

Voilà le rapport:


16/07/2009 ---- 19:34:36,24

----------------------------------
§§§§§§ [geyekr] §§§§§§
----------------------------------
[X] Registre

-------------- [ ] rapide
-- Fichier --- [ ] disque systeme
------------- [X] complete


********************
[Registre]
********************

Aucune entrée détectée

*******************
[Fichier]
*******************



*********************
[Même date]
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§
----------------------------------

J'ai gardé CCleaner et Malware, nettoyé avec ToolsCleaner et manuellement, vu qu'il y avait des programmes que j'avais installé depuis le début de ce sujet et qui n'étaient pas reconnus par ToolsCleaner. Après, un petit coup de CCleaner (nettoyage+registre).
Concernant la restauration système, je l'avais déjà désactivé lorsque je cherchais une solution pour ce trojan. Il était conseillé un peu partout de la désactiver, et vu que le trojan m'avait effacé tous les points de restauration héhé. Je l'ai donc réactivé et tout fonctionne bien.
J'ai lancé un coup de Malware qui n'a rien trouvé.

Je lance le scan de Kaspersky cette nuit et je posterais le résultat demain matin.

En tout cas, merci beaucoup sKe69 pour l'aide et ta patience ! Il était un peu pénible celui-là. Merci aussi à toi fix200 et à tous les autres pour l'aide ;)

Re,

J'ai pas pu poster ce matin, l'analyse fut plus longue que je n'avais prévu ^^ Tout semble maintenant ok, d'après le rapport:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: rapport d'analyse
vendredi 17 juillet 2009
Système d'exploitation : Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Version de Kaspersky Online Scanner : 7.0.26.13
Dernière mise à jour de la base : Thursday, July 16, 2009 23:32:21
Enregistrements dans la base : 2477336
--------------------------------------------------------------------------------

Paramètres d'analyse:
analyser avec la base suivante: étendue
Analyser les archives: oui
Analyser les bases de messagerie: oui

Zone d'analyse - Poste de travail:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Statistiques d'analyse:
Objets analysés: 609962
Menaces trouvées: 0
Objets infectés trouvés: 0
Objets suspects trouvés: 0
Durée d'analyse: 08:19:18

Aucune menace trouvée. La zone d'analyse est propre.

La zone sélectionnée a été analysée.