Alureon-CY

Résolu

broussel1967 -

Bonjour,

Mon PC est infecté parAlureon-CY et manifestement, je en vais pas arriver à m'en débarrasser tout seul (il infeste Avast, empêche la mise à jour d'Avira, m'oblige à démarrer en mode sans échec sur base de la dernière configuration connue, etc.).

Toute aide sera très appréciée.

Comme j'ai vu qu'on commençait généralement par demander le résultat de HijackThis, voilà :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:51, on 18/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Belgium Identity Card\beid35gui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot SD\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Benoit\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot SD\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ASETRES.EXE
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Service Google Update (gupdate1c9a5714e0d1af8) (gupdate1c9a5714e0d1af8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot SD\SDWinSec.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 10927 bytes

Configuration: Windows Vista
Firefox 3.0.6

Afficher la suite

43 réponses

Résumé de la discussion

Infection par Alureon-CY et contraintes associées, comme l'impossibilité de mettre à jour Avast et le démarrage en mode sans échec, motivent la demande d'aide et l'examen d'un log HijackThis. Le sujet inclut le besoin de comprendre le contenu du log et les mesures initiales possibles, notamment l'identification des éléments suspectés comme responsables de la persistance de l'infection. Des conseils typiques évoqués dans ce contexte visent à désactiver les éléments de démarrage suspects, réaliser des analyses et effectuer des nettoyages croisés entre Avast et BitDefender. D'autres éléments de la discussion soulignent l'importance de confirmer l'infection par des outils spécialisés et de considérer une réinstallation propre en dernier recours lorsque les solutions logicielles ne suffisent pas.

Réponse 1 / 43 - Meilleure réponse
La meilleure réponse est la réponse qui a été validée par nos équipes.
Narco!4 Contributeur
===> Telecharge AVZ http://z-oleg.com/avz4.zip

- extrait sur ton bureau
- ouvre le dossier AVZ4
- double clique sur avz.exe
- clique sur file (en haut à gauche)
- dans la liste choisie Custom scripts
- dans le carré qui apparait colle ce qui est en gras dessous
- puis clique sur Run
- valide le message, ton PC va redémarrer
- une fois redémarrer ouvre le dossier AVZ4
- poste le contenu de AvzBootCleaner.log

var
service, driverfile, AvzDir : string;

begin
AvzDir:=GetAVZDirectory;
service:=('gasfkyjipxbmhq');
driverfile:=('gasfkyircnrcqe.sys');
ShowMessage('Le PC va redémarrer.');
SearchRootKit(true,true);
SetAVZGuardStatus(true);
BC_QrFile('%System32%\Drivers\'+driverfile);
BC_DeleteSvc(service);
BC_LogFile(AvzDir + 'AvzBootCleaner.log');
BC_Activate;
RebootWindows(true);
end.

2
1. broussel1967 Auteur
  
  L'ordi se coupe dans le but d'éviter un "attempt to write to read-only memory". Pas de log.
  
  0
Réponse 2 / 43
Narco!4 Contributeur
Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

1
1. broussel1967 Auteur
  
  Je suis les instructions.
  
  Rapport GenProc 2.627 [1] - ven. 18/09/2009 à 10:45:24
  @ Windows Vista Service Pack 1 - Mode normal
  @ Mozilla Firefox (3.0.6) [Navigateur par défaut]
  
  ~~ CM DISK ERROR ~~
  
  Il est impératif de désactiver le résident TeaTimer de Spybot pendant l'ensemble des manipulations qui vont suivre. Aide Tea-Timer : http://ww11.genproc.com/spybot/spybot.html
  
  # Etape 1/ Télécharge :
  
  - CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.
  
  - ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe (sUBs) sur ton Bureau.
  
  Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/ ; Choisis ta session courante *** Benoit *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).
  
  # Etape 2/
  
  Double clique sur combofix.exe et suis les instructions. Attention de ne pas utiliser ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne au risque de figer l'ordinateur.
  
  # Etape 3/
  
  Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.
  
  # Etape 4/
  
  Redémarre normalement et poste, dans la même réponse :
  
  - Le contenu du rapport Combofix.txt situé dans C:\ ;
  - Un nouveau rapport HijackThis ;
  - Un nouveau rapport GenProc ;
  
  Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.
  
  ~~ Arguments de la procédure ~~
  
  # Détections [1] GenProc 2.627 ven. 18/09/2009 à 10:46:00
  TDSS:le ven. 18/09/2009 à 10:46:17 PFROP gasfky*
  
  ----------------------------------------------------------------------
  Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
  ----------------------------------------------------------------------
  
  ~~ Fin à 10:46:23 ~~
  
  0
Réponse 3 / 43
Narco!4 Contributeur
mais non, on va réussir;)

télécharge sysprot https://3c416dfc-a-62cb3a1a-s-sites.googlegroups.com/site/sysprotantirootkit/Home/SysProt.zip?attachauth=ANoY7cqxnzQSAOweMB1j1RjBx63qHLQnx1RrB041ebnNnUkA2E7iUZlFXPn94FP1IUHBJSwoSr5WblYwsVBjiyaDOKhebdI3IV9oewennApIgI_z92W9PJmfwsnozJcQn66wJBG1RP0eCl1Xv_HZjeP-n-Pf2uHskwiOLYePagIzgigsE9RUmK40KwAL0DRxju5sEcAU_uOSbkivGezpyqu7eDpAxIo2TUMVmuDywLmABSKQ80dw0gw%3D&attredirects=2
extrait le
ouvre le dossier clique droit sur sysprot.exe choisie exécuter en tant qu'administrateur
une fenêtre s'ouvre, va dans l'onglet log
coche kermel modules
clique sur create log en bas à droite
au message created succcessfully clique ok
le rapport est crée a coté de sysprot.exe, poste le

1
1. broussel1967 Auteur
  
  SysProt AntiRootkit v1.0.1.0
  by swatkat
  
  ******************************************************************************************
  ******************************************************************************************
  ******************************************************************************************
  ******************************************************************************************
  Kernel Modules:
  Module Name: \systemroot\system32\drivers\gasfkyircnrcqe.sys
  Service Name: gasfkyjipxbmhq
  Module Base: ---
  Module End: ---
  Hidden: Yes
  
  Module Name: \??\C:\Users\Benoit\Desktop\SysProtDrv.sys
  Service Name: SysProtDrv.sys
  Module Base: A854C000
  Module End: A8557000
  Hidden: No
  
  Module Name: C:\Windows\system32\ntkrnlpa.exe
  Service Name: ---
  Module Base: 82A13000
  Module End: 82DCC000
  Hidden: No
  
  Module Name: C:\Windows\system32\hal.dll
  Service Name: ---
  Module Base: 82DCC000
  Module End: 82DFF000
  Hidden: No
  
  Module Name: C:\Windows\system32\kdcom.dll
  Service Name: ---
  Module Base: 80604000
  Module End: 8060C000
  Hidden: No
  
  Module Name: C:\Windows\system32\mcupdate_GenuineIntel.dll
  Service Name: ---
  Module Base: 8060C000
  Module End: 8066C000
  Hidden: No
  
  Module Name: C:\Windows\system32\PSHED.dll
  Service Name: ---
  Module Base: 8066C000
  Module End: 8067D000
  Hidden: No
  
  Module Name: C:\Windows\system32\BOOTVID.dll
  Service Name: ---
  Module Base: 8067D000
  Module End: 80685000
  Hidden: No
  
  Module Name: C:\Windows\system32\CLFS.SYS
  Service Name: CLFS
  Module Base: 80685000
  Module End: 806C6000
  Hidden: No
  
  Module Name: C:\Windows\system32\CI.dll
  Service Name: ---
  Module Base: 806C6000
  Module End: 807A6000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\Wdf01000.sys
  Service Name: Wdf01000
  Module Base: 8A80C000
  Module End: 8A888000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\WDFLDR.SYS
  Service Name: ---
  Module Base: 8A888000
  Module End: 8A895000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\acpi.sys
  Service Name: ACPI
  Module Base: 8A895000
  Module End: 8A8DB000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\WMILIB.SYS
  Service Name: ---
  Module Base: 8A8DB000
  Module End: 8A8E4000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\msisadrv.sys
  Service Name: msisadrv
  Module Base: 8A8E4000
  Module End: 8A8EC000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\pci.sys
  Service Name: pci
  Module Base: 8A8EC000
  Module End: 8A913000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\partmgr.sys
  Service Name: partmgr
  Module Base: 8A913000
  Module End: 8A922000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\volmgr.sys
  Service Name: volmgr
  Module Base: 8A922000
  Module End: 8A931000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\volmgrx.sys
  Service Name: volmgrx
  Module Base: 8A931000
  Module End: 8A97B000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\nvrd32.sys
  Service Name: nvrd32
  Module Base: 8A97B000
  Module End: 8A99F000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\CLASSPNP.SYS
  Service Name: ---
  Module Base: 8A99F000
  Module End: 8A9C0000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\pciide.sys
  Service Name: pciide
  Module Base: 8A9C0000
  Module End: 8A9C7000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\PCIIDEX.SYS
  Service Name: ---
  Module Base: 8A9C7000
  Module End: 8A9D5000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\mountmgr.sys
  Service Name: MountMgr
  Module Base: 8A9D5000
  Module End: 8A9E5000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\nvraid.sys
  Service Name: nvraid
  Module Base: 8A9E5000
  Module End: 8AA00000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\atapi.sys
  Service Name: atapi
  Module Base: 8A800000
  Module End: 8A808000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\ataport.SYS
  Service Name: ---
  Module Base: 807A6000
  Module End: 807C4000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\nvstor32.sys
  Service Name: nvstor32
  Module Base: 807C4000
  Module End: 807E9000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\storport.sys
  Service Name: ---
  Module Base: 8AA0F000
  Module End: 8AA50000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\fltmgr.sys
  Service Name: FltMgr
  Module Base: 8AA50000
  Module End: 8AA82000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\fileinfo.sys
  Service Name: FileInfo
  Module Base: 8AA82000
  Module End: 8AA92000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\psdfilter.sys
  Service Name: PSDFilter
  Module Base: 8AA92000
  Module End: 8AA9B000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\Lbd.sys
  Service Name: Lbd
  Module Base: 8AA9B000
  Module End: 8AAAA000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\ksecdd.sys
  Service Name: KSecDD
  Module Base: 8AAAA000
  Module End: 8AB1B000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\ndis.sys
  Service Name: NDIS
  Module Base: 8AC0D000
  Module End: 8AD18000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\msrpc.sys
  Service Name: MsRPC
  Module Base: 8AD18000
  Module End: 8AD43000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\NETIO.SYS
  Service Name: ---
  Module Base: 8AD43000
  Module End: 8AD7D000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Ntfs.sys
  Service Name: Ntfs
  Module Base: 8AE07000
  Module End: 8AF16000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\wd.sys
  Service Name: Wd
  Module Base: 8AF16000
  Module End: 8AF1E000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\volsnap.sys
  Service Name: volsnap
  Module Base: 8AF1E000
  Module End: 8AF57000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\spldr.sys
  Service Name: spldr
  Module Base: 8AF57000
  Module End: 8AF5F000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\mup.sys
  Service Name: Mup
  Module Base: 8AF5F000
  Module End: 8AF6E000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\ecache.sys
  Service Name: Ecache
  Module Base: 8AF6E000
  Module End: 8AF95000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\disk.sys
  Service Name: disk
  Module Base: 8AF95000
  Module End: 8AFA6000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\crcdisk.sys
  Service Name: crcdisk
  Module Base: 8AFA6000
  Module End: 8AFAF000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\tunnel.sys
  Service Name: tunnel
  Module Base: 8AFEB000
  Module End: 8AFF6000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\tunmp.sys
  Service Name: tunmp
  Module Base: 8AFF6000
  Module End: 8AFFF000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\intelppm.sys
  Service Name: intelppm
  Module Base: 8AD7D000
  Module End: 8AD8C000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\serial.sys
  Service Name: Serial
  Module Base: 8AD8C000
  Module End: 8ADA6000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\serenum.sys
  Service Name: Serenum
  Module Base: 8ADA6000
  Module End: 8ADB0000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\i8042prt.sys
  Service Name: i8042prt
  Module Base: 8ADB0000
  Module End: 8ADC3000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\kbdclass.sys
  Service Name: kbdclass
  Module Base: 8ADC3000
  Module End: 8ADCE000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mouclass.sys
  Service Name: mouclass
  Module Base: 8ADCE000
  Module End: 8ADD9000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\nvsmu.sys
  Service Name: nvsmu
  Module Base: 8AE00000
  Module End: 8AE03000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\usbohci.sys
  Service Name: usbohci
  Module Base: 8ADD9000
  Module End: 8ADE3000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\USBPORT.SYS
  Service Name: ---
  Module Base: 8AB1B000
  Module End: 8AB59000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\usbehci.sys
  Service Name: usbehci
  Module Base: 8ADE3000
  Module End: 8ADF2000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\HDAudBus.sys
  Service Name: HDAudBus
  Module Base: 8AB59000
  Module End: 8AB6B000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\ohci1394.sys
  Service Name: ohci1394
  Module Base: 8AB6B000
  Module End: 8AB7B000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\1394BUS.SYS
  Service Name: ---
  Module Base: 8ADF2000
  Module End: 8AE00000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\nvlddmkm.sys
  Service Name: nvlddmkm
  Module Base: 90405000
  Module End: 90D6A000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\nvBridge.kmd
  Service Name: ---
  Module Base: 90D6A000
  Module End: 90D6C000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\dxgkrnl.sys
  Service Name: DXGKrnl
  Module Base: 92800000
  Module End: 9289F000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\watchdog.sys
  Service Name: ---
  Module Base: 9289F000
  Module End: 928AC000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\ElbyCDFL.sys
  Service Name: ElbyCDFL
  Module Base: 928AC000
  Module End: 928B3000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\cdrom.sys
  Service Name: cdrom
  Module Base: 928B3000
  Module End: 928CB000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\NTIDrvr.sys
  Service Name: NTIDrvr
  Module Base: 928CB000
  Module End: 928CD000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\nvmfdx32.sys
  Service Name: NVENETFD
  Module Base: 928CD000
  Module End: 929CA000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\wmiacpi.sys
  Service Name: WmiAcpi
  Module Base: 929CA000
  Module End: 929D3000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\msiscsi.sys
  Service Name: iScsiPrt
  Module Base: 90D6C000
  Module End: 90D9A000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\TDI.SYS
  Service Name: ---
  Module Base: 929D3000
  Module End: 929DE000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\rasl2tp.sys
  Service Name: Rasl2tp
  Module Base: 929DE000
  Module End: 929F5000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\ndistapi.sys
  Service Name: NdisTapi
  Module Base: 929F5000
  Module End: 92A00000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\ndiswan.sys
  Service Name: NdisWan
  Module Base: 90D9A000
  Module End: 90DBD000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\raspppoe.sys
  Service Name: RasPppoe
  Module Base: 90DBD000
  Module End: 90DCC000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\raspptp.sys
  Service Name: PptpMiniport
  Module Base: 90DCC000
  Module End: 90DE0000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\rassstp.sys
  Service Name: RasSstp
  Module Base: 90DE0000
  Module End: 90DF5000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\pcouffin.sys
  Service Name: pcouffin
  Module Base: 8AC00000
  Module End: 8AC0C000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\termdd.sys
  Service Name: TermDD
  Module Base: 8AB7B000
  Module End: 8AB8B000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\swenum.sys
  Service Name: swenum
  Module Base: 90DF5000
  Module End: 90DF7000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\ks.sys
  Service Name: ---
  Module Base: 8AB8B000
  Module End: 8ABB5000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\MarvinBus.sys
  Service Name: MarvinBus
  Module Base: 8ABB5000
  Module End: 8ABE3000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mssmbios.sys
  Service Name: mssmbios
  Module Base: 8ABE3000
  Module End: 8ABED000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\umbus.sys
  Service Name: umbus
  Module Base: 8ABED000
  Module End: 8ABFA000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\usbhub.sys
  Service Name: usbhub
  Module Base: 94A07000
  Module End: 94A3B000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\NDProxy.SYS
  Service Name: NDProxy
  Module Base: 94A3B000
  Module End: 94A4C000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\RTKVHDA.sys
  Service Name: IntcAzAudAddService
  Module Base: 95202000
  Module End: 95403000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\portcls.sys
  Service Name: ---
  Module Base: 95403000
  Module End: 95430000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\drmk.sys
  Service Name: ---
  Module Base: 95430000
  Module End: 95455000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\nvhda32v.sys
  Service Name: NVHDA
  Module Base: 95455000
  Module End: 95463000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Fs_Rec.SYS
  Service Name: Fs_Rec
  Module Base: 95463000
  Module End: 9546C000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Null.SYS
  Service Name: Null
  Module Base: 9546C000
  Module End: 95473000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Beep.SYS
  Service Name: Beep
  Module Base: 95473000
  Module End: 9547A000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\vga.sys
  Service Name: vga
  Module Base: 9547A000
  Module End: 95486000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\VIDEOPRT.SYS
  Service Name: ---
  Module Base: 95486000
  Module End: 954A7000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\RDPCDD.sys
  Service Name: RDPCDD
  Module Base: 954A7000
  Module End: 954AF000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\rdpencdd.sys
  Service Name: RDPENCDD
  Module Base: 954AF000
  Module End: 954B7000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\USBSTOR.SYS
  Service Name: USBSTOR
  Module Base: 954D8000
  Module End: 954EA000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\USBD.SYS
  Service Name: ---
  Module Base: 954EA000
  Module End: 954EC000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\hidusb.sys
  Service Name: HidUsb
  Module Base: 954EC000
  Module End: 954F5000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
  Service Name: ---
  Module Base: 954F5000
  Module End: 95505000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
  Service Name: ---
  Module Base: 95505000
  Module End: 9550C000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\dot4usb.sys
  Service Name: dot4usb
  Module Base: 9550C000
  Module End: 95519000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\Dot4.sys
  Service Name: dot4
  Module Base: 95519000
  Module End: 9553E000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mouhid.sys
  Service Name: mouhid
  Module Base: 9553E000
  Module End: 95546000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\NuidFltr.sys
  Service Name: NuidFltr
  Module Base: 95546000
  Module End: 9554D000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\Dot4Prt.sys
  Service Name: Dot4Print
  Module Base: 9554D000
  Module End: 95556000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Msfs.SYS
  Service Name: Msfs
  Module Base: 95556000
  Module End: 95561000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\Npfs.SYS
  Service Name: Npfs
  Module Base: 95561000
  Module End: 9556F000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\rasacd.sys
  Service Name: RasAcd
  Module Base: 9556F000
  Module End: 95578000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\tcpip.sys
  Service Name: Tcpip
  Module Base: 94A4C000
  Module End: 94B35000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\fwpkclnt.sys
  Service Name: ---
  Module Base: 95578000
  Module End: 95593000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\tdx.sys
  Service Name: tdx
  Module Base: 95593000
  Module End: 955A9000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\aswTdi.SYS
  Service Name: aswTdi
  Module Base: 955A9000
  Module End: 955B4000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\smb.sys
  Service Name: Smb
  Module Base: 955B4000
  Module End: 955C8000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\afd.sys
  Service Name: AFD
  Module Base: 94B35000
  Module End: 94B7D000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\aswRdr.SYS
  Service Name: aswRdr
  Module Base: 955C8000
  Module End: 955CC000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\netbt.sys
  Service Name: netbt
  Module Base: 955CC000
  Module End: 955FE000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\pacer.sys
  Service Name: PSched
  Module Base: 94B7D000
  Module End: 94B93000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\netbios.sys
  Service Name: NetBIOS
  Module Base: 94B93000
  Module End: 94BA1000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\wanarp.sys
  Service Name: Wanarp
  Module Base: 94BA1000
  Module End: 94BB4000
  Hidden: No
  
  Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
  Service Name: SASKUTIL
  Module Base: 94BB4000
  Module End: 94BD9000
  Hidden: No
  
  Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
  Service Name: SASDIFSV
  Module Base: 94BD9000
  Module End: 94BDF000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\rdbss.sys
  Service Name: rdbss
  Module Base: 96806000
  Module End: 96842000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\nsiproxy.sys
  Service Name: nsiproxy
  Module Base: 96842000
  Module End: 9684C000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\ISODisk.SYS
  Service Name: ISODisk
  Module Base: 9684C000
  Module End: 9684F000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\ElbyCDIO.sys
  Service Name: ElbyCDIO
  Module Base: 9684F000
  Module End: 96854000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\dfsc.sys
  Service Name: DfsC
  Module Base: 96854000
  Module End: 9686B000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\aswSP.SYS
  Service Name: aswSP
  Module Base: 9686B000
  Module End: 9688C000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\cdfs.sys
  Service Name: cdfs
  Module Base: 9688C000
  Module End: 968A2000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\crashdmp.sys
  Service Name: ---
  Module Base: 968A2000
  Module End: 968AF000
  Hidden: No
  
  Module Name: \SystemRoot\System32\Drivers\dump_diskdump.sys
  Service Name: ---
  Module Base: 968AF000
  Module End: 968B9000
  Hidden: Yes
  
  Module Name: \SystemRoot\System32\Drivers\dump_nvstor32.sys
  Service Name: ---
  Module Base: 968B9000
  Module End: 968DE000
  Hidden: Yes
  
  Module Name: C:\Windows\System32\drivers\Dxapi.sys
  Service Name: ---
  Module Base: 968DE000
  Module End: 968E8000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\monitor.sys
  Service Name: monitor
  Module Base: 968E8000
  Module End: 968F7000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\luafv.sys
  Service Name: luafv
  Module Base: 968F7000
  Module End: 96912000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\aswMonFlt.sys
  Service Name: aswMonFlt
  Module Base: 96912000
  Module End: 96929000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\aswFsBlk.sys
  Service Name: aswFsBlk
  Module Base: 96929000
  Module End: 96931000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\spsys.sys
  Service Name: ---
  Module Base: 96931000
  Module End: 969E0000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\lltdio.sys
  Service Name: lltdio
  Module Base: 969E0000
  Module End: 969F0000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\rspndr.sys
  Service Name: rspndr
  Module Base: 94BDF000
  Module End: 94BF2000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\HTTP.sys
  Service Name: HTTP
  Module Base: A3C06000
  Module End: A3C71000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\srvnet.sys
  Service Name: srvnet
  Module Base: A3C71000
  Module End: A3C8E000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\bowser.sys
  Service Name: bowser
  Module Base: A3C8E000
  Module End: A3CA7000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\mrxdav.sys
  Service Name: MRxDAV
  Module Base: A3CA7000
  Module End: A3CC7000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mrxsmb.sys
  Service Name: mrxsmb
  Module Base: A3CC7000
  Module End: A3CE6000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mrxsmb10.sys
  Service Name: mrxsmb10
  Module Base: A3CE6000
  Module End: A3D1F000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\mrxsmb20.sys
  Service Name: mrxsmb20
  Module Base: A3D1F000
  Module End: A3D37000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\srv2.sys
  Service Name: srv2
  Module Base: A3D37000
  Module End: A3D5E000
  Hidden: No
  
  Module Name: C:\Windows\System32\DRIVERS\srv.sys
  Service Name: srv
  Module Base: A3D5E000
  Module End: A3DAA000
  Hidden: No
  
  Module Name: \??\C:\Acer\Empowering Technology\eRecovery\int15.sys
  Service Name: int15
  Module Base: A3DAA000
  Module End: A3DB1000
  Hidden: No
  
  Module Name: C:\Windows\system32\drivers\peauth.sys
  Service Name: PEAUTH
  Module Base: A840D000
  Module End: A84EB000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\PSDNServ.sys
  Service Name: PSDNServ
  Module Base: A84EB000
  Module End: A84F4000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\PSDVdisk.sys
  Service Name: psdvdisk
  Module Base: A84F4000
  Module End: A8506000
  Hidden: No
  
  Module Name: C:\Windows\System32\Drivers\secdrv.SYS
  Service Name: secdrv
  Module Base: A8506000
  Module End: A8510000
  Hidden: No
  
  Module Name: C:\Windows\System32\drivers\tcpipreg.sys
  Service Name: tcpipreg
  Module Base: A8510000
  Module End: A851C000
  Hidden: No
  
  Module Name: \??\C:\Windows\system32\drivers\tvicport.sys
  Service Name: tvicport
  Module Base: A851C000
  Module End: A851F000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\WUDFRd.sys
  Service Name: WUDFRd
  Module Base: A851F000
  Module End: A8534000
  Hidden: No
  
  Module Name: C:\Windows\system32\DRIVERS\WUDFPf.sys
  Service Name: ---
  Module Base: A8534000
  Module End: A8546000
  Hidden: No
  
  Module Name: \??\C:\Windows\system32\drivers\zntport.sys
  Service Name: zntport
  Module Base: A8546000
  Module End: A8547000
  Hidden: No
  
  Module Name: \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
  Service Name: SASENUM
  Module Base: A8547000
  Module End: A854C000
  Hidden: No
  
  0
Réponse 4 / 43
broussel1967 Auteur
Je viens aussi de passer Toolbar SD :

USER : Benoit ( Administrator )
BOOT : Normal boot
Antivirus : Bitdefender Antivirus 8.0 (Activated)
C:\ (Local Disk) - NTFS - Total:151 Go (Free:84 Go)
D:\ (Local Disk) - NTFS - Total:293 Go (Free:92 Go)
E:\ (Local Disk) - NTFS - Total:141 Go (Free:90 Go)
H:\ (CD or DVD)
V:\ (USB)
W:\ (USB)
X:\ (USB)
Y:\ (USB)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [2] ( ven. 18/09/2009|10:29 )

-----------\\ SUPPRESSION

Supprime! - C:\Windows\iun6002.exe

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Start Page"="https://fr.yahoo.com/"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://fr.yahoo.com/"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\Windows\\System32\\blank.htm"

--------------------\\ Recherche d'autres infections

--------------------\\ ROOTKIT !!

Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_SROSA]
Rootkit Bagle ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]

--------------------\\ Cracks & Keygens ..

C:\Users\Benoit\Documents\DOCUMENTS XP\ARTDOC\biellese blanket\PlaidMaker Plus 1.1 + Keygen
C:\Users\Benoit\Documents\DOCUMENTS XP\ARTDOC\biellese blanket\PlaidMaker Plus 1.1 + Keygen\eatpm121kg.exe
C:\Users\Benoit\Documents\DOCUMENTS XP\ARTDOC\biellese blanket\PlaidMaker Plus 1.1 + Keygen\PlaidMakerPlus1_1.exe
C:\Users\Benoit\Documents\DOCUMENTS XP\ARTDOC\biellese blanket\PlaidMaker Plus 1.1 + Keygen\plaidmakerplusserial.rtf
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Embrace
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Paradox
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Embrace\embrace.nfo
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Embrace\file_id.diz
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Paradox\file_id.diz
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Paradox\Nero7Keygen.exe
C:\Users\Benoit\Documents\DOCUMENTS XP\_NERO\Nero 7 Keygen from Paradox\Paradox.nfo

1 - "C:\ToolBar SD\TB_1.txt" - ven. 18/09/2009|10:28 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - ven. 18/09/2009|10:30 - Option : [2]

-----------\\ Fin du rapport a 10:30:16,73

0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 43
broussel1967 Auteur
Voici le log.txt de RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Benoit at 2009-09-18 10:33:39
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 86 GB (55%) free of 156 GB
Total RAM: 3070 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:49, on 18/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\nvraidservice.exe
C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Belgium Identity Card\beid35gui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot SD\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\MailWasher Pro\MailWasher.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Benoit\Desktop\RSIT.exe
C:\Users\Benoit\Desktop\Benoit.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Apanel] C:\ACERSW\config\SetApanel.cmd
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [NVRaidService] C:\Windows\system32\nvraidservice.exe
O4 - HKLM\..\Run: [diagnostics] "C:\Program Files\Thomson\ST330\diagnostics\diagnostics.exe" /icon -l:fr
O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\Windows\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [beid] "C:\Program Files\Belgium Identity Card\beid35gui.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot SD\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ASETRES.EXE
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Service Google Update (gupdate1c9a5714e0d1af8) (gupdate1c9a5714e0d1af8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot SD\SDWinSec.exe
O23 - Service: SpeedTouch 330 Manager (st330service) - THOMSON Telecom Belgium - C:\Program Files/Thomson/ST330/service/st330service.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

0
Réponse 6 / 43
broussel1967 Auteur
Et l'info.txt de RSIT :

info.txt logfile of random's system information tool 1.06 2009-09-18 10:33:51

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\Windows\UNRecode.exe /UNINSTALL
-->MsiExec /X{1C4551A6-4743-4093-91E4-1477CD655043}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6BE926E5-66F4-4166-A5E5-E14D7A165BBD}\setup.exe" -l0x40c
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x40c
Acer Arcade Live Main Page-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}\SETUP.exe" -uninstall
Acer DV Magician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F6EFFB76-4A07-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer DVDivine-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B145EC69-66F5-11D8-9D75-000129760D75}\SETUP.exe" -uninstall
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\x86\eDSnstHelper.exe -Operation UNINSTALL
Acer Empowering Technology-->"C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer ePerformance Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}\setup.exe" -l0x40c -removeonly
Acer eSettings Management-->"C:\Program Files\InstallShield Installation Information\{CE65A9A0-9686-45C6-9098-3C9543A412F0}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer GameZone Console DTV 2.0.1.1-->"C:\Program Files\Acer GameZone\GameConsole\unins000.exe"
Acer HomeMedia Connect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{132888AE-EF67-41C5-BCA2-7D5D2488AB63}\SETUP.exe" -uninstall
Acer HomeMedia Trial Creator-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B580C409-E16F-44FF-904D-3AE94E113BE0}\SETUP.EXE" -uninstall
Acer HomeMedia-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
Acer SlideShow DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{41581EF5-45A7-11DA-9D78-000129760D75}\SETUP.exe" -uninstall
Acer VideoMagician-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F79A208D-D929-11D9-9D77-000129760D75}\SETUP.exe" -uninstall
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->"C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\ProgramData\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Alice Greenfingers-->"C:\Program Files\Acer GameZone\Alice Greenfingers\Uninstall.exe" "C:\Program Files\Acer GameZone\Alice Greenfingers\install.log"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AVS DVD Player version 2.4-->"C:\Program Files\AVSDVDPlayer\unins000.exe"
Azada-->"C:\Program Files\Acer GameZone\Azada\Uninstall.exe" "C:\Program Files\Acer GameZone\Azada\install.log"
Backspin Billiards-->"C:\Program Files\Acer GameZone\Backspin Billiards\Uninstall.exe" "C:\Program Files\Acer GameZone\Backspin Billiards\install.log"
Belgium e-ID middleware 3.5.2 (build 5775)-->MsiExec.exe /I{824563DE-75AD-4166-9DC0-B6482F205775}
Big Kahuna Reef-->"C:\Program Files\Acer GameZone\Big Kahuna Reef\Uninstall.exe" "C:\Program Files\Acer GameZone\Big Kahuna Reef\install.log"
BitDefender Free Edition v10-->MsiExec.exe /I{CEFC581D-BEAE-4F75-989E-BD931970D8AD}
Bricks of Egypt-->"C:\Program Files\Acer GameZone\Bricks of Egypt\Uninstall.exe" "C:\Program Files\Acer GameZone\Bricks of Egypt\install.log"
Cake Mania-->"C:\Program Files\Acer GameZone\Cake Mania\Uninstall.exe" "C:\Program Files\Acer GameZone\Cake Mania\install.log"
CanoScan Toolbox Ver4.1-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\Setup.exe" -l0x40c anything
Chicken Invaders 3-->"C:\Program Files\Acer GameZone\Chicken Invaders 3\Uninstall.exe" "C:\Program Files\Acer GameZone\Chicken Invaders 3\install.log"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Chuzzle-->"C:\Program Files\Acer GameZone\Chuzzle\Uninstall.exe" "C:\Program Files\Acer GameZone\Chuzzle\install.log"
CloneCD-->"C:\Program Files\SlySoft\CloneCD\ccd-uninst.exe" /D="C:\Program Files\SlySoft\CloneCD"
CloneDVD2-->"C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"
Creative Live! Cam Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6BE926E5-66F4-4166-A5E5-E14D7A165BBD}\setup.exe" -l0x40c /remove
Creative WebCam Vista Driver (1.04.05.0421)-->C:\Windows\CtDrvIns.exe -uninstall -script VF0010b.uns -unsext NT -plugin V0010bPn.dll -pluginres V0010bPn.crl
Diner Dash Flo on the Go-->"C:\Program Files\Acer GameZone\Diner Dash Flo on the Go\Uninstall.exe" "C:\Program Files\Acer GameZone\Diner Dash Flo on the Go\install.log"
DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"
DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.2.2-->"C:\Program Files\DVDFab 5 HD\unins000.exe"
DVDFab 6.0.2.0 (June 24, 2009)-->"C:\Program Files\DVDFab 6\unins000.exe"
eMule-->"C:\Program Files\eMule\Uninstall.exe"
eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x040c
Eudora (8.0.0b5)-->C:\Program Files\Eudora 8\uninstall\helper.exe
Free Video Converter V 2.0-->"C:\Program Files\Free Video Converter\unins000.exe"
Gadwin PrintScreen-->C:\Program Files\Gadwin Systems\PrintScreen\Uninstall.exe
GIMP 2.6.7-->"C:\Program Files\GIMP\setup\unins000.exe"
Google SketchUp 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c -removeonly
Google SketchUp 6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}\setup.exe" -l0x40c -removeonly
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
HijackThis 2.0.2-->"C:\Users\Benoit\Desktop\HijackThis.exe" /uninstall
Home'Bank Light 3.3.3-->"unins000.exe"
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
ISODisk 1.1-->"C:\Program Files\ISODisk\unins000.exe"
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Jewel Quest Solitaire-->"C:\Program Files\Acer GameZone\Jewel Quest Solitaire\Uninstall.exe" "C:\Program Files\Acer GameZone\Jewel Quest Solitaire\install.log"
Kick N Rush-->"C:\Program Files\Acer GameZone\Kick N Rush\Uninstall.exe" "C:\Program Files\Acer GameZone\Kick N Rush\install.log"
K-Lite Codec Pack 4.6.2 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Macromedia Dreamweaver MX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B4AB829-DFD3-436D-B808-D9733D76C590}\Setup.exe" -l0x9 mmUninstall
Macromedia Extension Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}\setup.exe" -l0x9 mmUninstall
Mahjong Escape Ancient China-->"C:\Program Files\Acer GameZone\Mahjong Escape Ancient China\Uninstall.exe" "C:\Program Files\Acer GameZone\Mahjong Escape Ancient China\install.log"
Mahjongg Artifacts-->"C:\Program Files\Acer GameZone\Mahjongg Artifacts\Uninstall.exe" "C:\Program Files\Acer GameZone\Mahjongg Artifacts\install.log"
MailWasher Pro-->"C:\Program Files\MailWasher Pro\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Mystery Case Files - Huntsville-->"C:\Program Files\Acer GameZone\Mystery Case Files - Huntsville\Uninstall.exe" "C:\Program Files\Acer GameZone\Mystery Case Files - Huntsville\install.log"
Mystery Solitaire - Secret Island-->"C:\Program Files\Acer GameZone\Mystery Solitaire - Secret Island\Uninstall.exe" "C:\Program Files\Acer GameZone\Mystery Solitaire - Secret Island\install.log"
Nero 8-->MsiExec.exe /X{F296739D-AF5C-4426-972A-0DC916D11036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NTI Backup NOW! 4.7-->C:\Program Files\InstallShield Installation Information\{1598034D-7147-432C-8CA8-888E0632D124}\setup.exe -runfromtemp -l0x040c
NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{1C4551A6-4743-4093-91E4-1477CD655043}
OceanDive 1.2-->C:\Program Files\OceanDive\uninst.exe
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Philips Intelligent Agent-->"C:\Program Files\Philips Intelligent Agent\Uninst\unins000.exe"
QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -removeonly
RM Converter 2.21-->"C:\Program Files\RM Converter\unins000.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SolveigMM AVI Trimmer-->"C:\Program Files\AVI Trimmer\Uninstall.exe" "C:\Program Files\AVI Trimmer\install.log" -u
SpeedTouch 330-->C:\Program Files\Thomson\ST330\Uninstall\stInstall.exe -s:scen_uninstall_st330.xml -l:fr
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy-->"C:\Program Files\Spybot SD\unins000.exe"
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
The Endless Forest-->"C:\Program Files\Tale of Tales\The Endless Forest 3\unins000.exe"
Tomb Raider II-->C:\Windows\IsUn040c.exe -f"C:\Program Files\TR\Tomb Raider II\Uninst.isu"
Turbo Pizza-->"C:\Program Files\Acer GameZone\Turbo Pizza\Uninstall.exe" "C:\Program Files\Acer GameZone\Turbo Pizza\install.log"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
Virtual Earth 3D (Bêta)-->MsiExec.exe /I{2D87E961-577B-492B-AD54-1368680FB9A7}
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
WinPcap 4.0.2-->C:\Program Files\WinPcap\uninstall.exe
Zuma Deluxe-->"C:\Program Files\Acer GameZone\Zuma Deluxe\Uninstall.exe" "C:\Program Files\Acer GameZone\Zuma Deluxe\install.log"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Bitdefender Antivirus
AS: Spybot - Search and Destroy (outdated)
AS: Lavasoft Ad-Watch Live!
AS: Windows Defender
AS: SUPERAntiSpyware

======System event log======

Computer Name: ACER
Event Code: 3004
Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
Pour plus d’informations, consultez les données suivantes :
Non applicable
ID d’analyse : {39742E6C-7A22-4E5E-9D47-9A8E11A7B1C1}
Utilisateur : ACER\Benoit
Nom : Unknown
ID :
ID de gravité :
ID de catégorie :
Chemin d’accès trouvé : driver:rootrepeal
Type d’alerte : Logiciel non classifié
Type de détection :
Record Number: 103887
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20090918074709.000000-000
Event Type: Avertissement
User:

Computer Name: ACER
Event Code: 7000
Message: Le service bdfdll n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.
Record Number: 103893
Source Name: Service Control Manager
Time Written: 20090918082240.000000-000
Event Type: Erreur
User:

Computer Name: ACER
Event Code: 7000
Message: Le service BDFsDrv n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.
Record Number: 103894
Source Name: Service Control Manager
Time Written: 20090918082240.000000-000
Event Type: Erreur
User:

Computer Name: ACER
Event Code: 7000
Message: Le service BDRsDrv n'a pas pu démarrer en raison de l'erreur :
Le fichier spécifié est introuvable.
Record Number: 103895
Source Name: Service Control Manager
Time Written: 20090918082240.000000-000
Event Type: Erreur
User:

Computer Name: ACER
Event Code: 3004
Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
Pour plus d’informations, consultez les données suivantes :
Non applicable
ID d’analyse : {871AC6BE-7C2D-4D13-8B99-C74F25B5C500}
Utilisateur : ACER\Benoit
Nom : Unknown
ID :
ID de gravité :
ID de catégorie :
Chemin d’accès trouvé : iemain:HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page
Type d’alerte : Logiciel non classifié
Type de détection :
Record Number: 103896
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20090918082959.000000-000
Event Type: Avertissement
User:

=====Application event log=====

Computer Name: ACER
Event Code: 6000
Message: L’abonné aux notifications Winlogon <GPClient> n’était pas disponible pour traiter un événement de notification.
Record Number: 21588
Source Name: Microsoft-Windows-Winlogon
Time Written: 20090917225254.000000-000
Event Type: Avertissement
User:

Computer Name: ACER
Event Code: 6000
Message: L’abonné aux notifications Winlogon <Profiles> n’était pas disponible pour traiter un événement de notification.
Record Number: 21589
Source Name: Microsoft-Windows-Winlogon
Time Written: 20090917225254.000000-000
Event Type: Avertissement
User:

Computer Name: ACER
Event Code: 4102
Message: La licence Windows n’est pas valide. Erreur 0xC004F012. Valeur de stratégie 0x00000000.
Record Number: 21593
Source Name: Microsoft-Windows-Winlogon
Time Written: 20090918063845.000000-000
Event Type: Erreur
User:

Computer Name: ACER
Event Code: 10
Message: Le filtre d’événement avec la requête « SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99 » n’a pas pu être réactivé dans l’espace de noms « //./root/CIMV2 » à cause de l’erreur 0x80041003. Les événements ne peuvent pas être délivrés à travers ce filtre tant que le problème ne sera pas corrigé.
Record Number: 21614
Source Name: Microsoft-Windows-WMI
Time Written: 20090918070717.000000-000
Event Type: Erreur
User:

Computer Name: ACER
Event Code: 4113
Message: AntiVir has detected 'TR/Agent.626688.B' in the file C:\Program Files\Acer GameZone\Bricks of Egypt\Bricks of Egypt.exe
Record Number: 21635
Source Name: Avira AntiVir
Time Written: 20090918073929.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

=====Security event log=====

Computer Name: ACER
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\avipbb.sys
Record Number: 21132
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090918072711.931737-000
Event Type: Échec de l'audit
User:

Computer Name: ACER
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Program Files\Avira\AntiVir Desktop\avgio.sys
Record Number: 21133
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090918072712.274937-000
Event Type: Échec de l'audit
User:

Computer Name: ACER
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\avgntflt.sys
Record Number: 21134
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090918072712.602537-000
Event Type: Échec de l'audit
User:

Computer Name: ACER
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\rootrepeal.sys
Record Number: 21135
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090918074508.192237-000
Event Type: Échec de l'audit
User:

Computer Name: ACER
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\rootrepeal.sys
Record Number: 21136
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090918074707.588037-000
Event Type: Échec de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Acer\Empowering Technology\eDataSecurity\;C:\Acer\Empowering Technology\eDataSecurity\x86;C:\Acer\Empowering Technology\eDataSecurity\x64;C:\Program Files\Belgium Identity Card;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel
"PROCESSOR_REVISION"=0f0b
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"CLASSPATH"=.;C:\Program Files\Belgium Identity Card;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

0
Réponse 7 / 43
Narco!4 Contributeur
https://forums.commentcamarche.net/forum/affich-14424196-alureon-cy#5

ok

0
1. broussel1967 Auteur
  
  Pas pu dépasser le stade ComboFix pour l'instant (j'ai dû désinstaller BitDefender 10 aussi) : en mode sans échec : Failed to get data for "EnableLUA", PEV.cfxxe a cessé de fonctionner, arrêt et redémarrage.
  Pas trouvé de rapport ComboFix.
  
  0
Réponse 8 / 43
Narco!4 Contributeur
---> Télécharge Gmer http://www2.gmer.net/gmer.zip sur ton Bureau.

---> Extrais le contenu de l'archive puis renomme gmer.exe en tib.exe (Le .exe n'est pas forcément visible).
sur ton burreau

---> Double-clique sur tib.exe.

---> si tu as un message warning
comme celui la
http://www.genproc.com/gmer.JPG
clique non puis save, et enregistre sur ton Bureau "gmer.txt".

---> Double-clique sur "gmer.txt", le rapport apparaît, poste-le.

0
Réponse 9 / 43
broussel1967 Auteur
GMER 1.0.15.15087 - http://www.gmer.net
Rootkit quick scan 2009-09-18 11:44:13
Windows 6.0.6001 Service Pack 1
Running: tib.exe; Driver: C:\Users\Benoit\AppData\Local\Temp\pgldrpob.sys

---- System - GMER 1.0.15 ----

Code 87B56C50 ZwEnumerateKey
Code 87B590C0 ZwFlushInstructionCache
Code 875632E6 ZwSaveKey
Code 874A1086 ZwSaveKeyEx
Code 866B815D IofCallDriver
Code 8675A576 IofCompleteRequest

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----

0
Réponse 10 / 43
Narco!4 Contributeur
recommence encore une fois
poste le rapport si il est diffèrent de celui posté.

sinon:

Double-clique sur tib.exe ; vérifie que tout soit coché à droite :

1. System
2. Devices
3. Proceses
4. Libraries
5. Modules
6. Services
7. Registry
8. Files

Clique ensuite sur "Scan" et laisse-le faire son travail. A la fin du scan clique sur "Copy", et dans ton prochain message -> clic droit/coller

0
1. broussel1967 Auteur
  
  J'essaie de poste le log, mais mon message est "modéré".
  
  0
2. broussel1967 Auteur
  
  GMER 1.0.15.15087 - http://www.gmer.net
  Rootkit scan 2009-09-18 11:57:16
  Windows 6.0.6001 Service Pack 1
  Running: tib.exe; Driver: C:\Users\Benoit\AppData\Local\Temp\pgldrpob.sys
  
  ---- System - GMER 1.0.15 ----
  
  SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ZwTerminateProcess [0x943CC0B0]
  
  Code 87B56C50 ZwEnumerateKey
  Code 87B590C0 ZwFlushInstructionCache
  Code 875632E6 ZwSaveKey
  Code 874A1086 ZwSaveKeyEx
  Code 866B815D IofCallDriver
  Code 8675A576 IofCompleteRequest
  
  ---- Kernel code sections - GMER 1.0.15 ----
  
  .text ntkrnlpa.exe!IofCompleteRequest 82A4EFE2 5 Bytes JMP 8675A57B
  .text ntkrnlpa.exe!KeSetTimerEx + 854 82ACDE18 4 Bytes [B0, C0, 3C, 94] {MOV AL, 0xc0; CMP AL, 0x94}
  .text ntkrnlpa.exe!IofCallDriver
  
  0
Réponse 11 / 43
Narco!4 Contributeur
envoie le par MP entier

0
1. broussel1967 Auteur
  
  ---- User IAT/EAT - GMER 1.0.15 ----
  
  IAT C:\Windows\system32\services.exe[668] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 007B0002
  IAT C:\Windows\system32\services.exe[668] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 007B0000
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [741F7BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [742398C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [741FD3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [741EF527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [741F7599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [741EE43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7422B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [741FD68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [741F012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [741F0095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [741E71F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7427D802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [742175E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [741EDAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [741E668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [741E66BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [741F1E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [026927E0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [02691B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [02692B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [026911D0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [00CF2B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [00CF11D0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [00CF27E0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [00CF1B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
  
  0
Réponse 12 / 43
broussel1967 Auteur
C'est fait.

0
Réponse 13 / 43
Narco!4 Contributeur
ok vu,
derniére chose

--->clique droit sur tib.exe; exécuter en tant qu'administrateur

---> tu as un message warning comme celui la ?
http://www.genproc.com/gmer.JPG

ne touche a rien d'autre

0
Réponse 14 / 43
broussel1967 Auteur
Pas de warning.

0
Réponse 15 / 43
broussel1967 Auteur
Mais il a annoncé une modif due à un rootkit pendant le dernier scan, oui.

0
Réponse 16 / 43
Narco!4 Contributeur
coche que
Services
Registry

poste le rapport entier

0
Réponse 17 / 43
broussel1967 Auteur
> Quand tu dis exécuter, c'est ou démarrer ou démarrer + scanner ?

0
Réponse 18 / 43
broussel1967 Auteur
GMER 1.0.15.15087 - http://www.gmer.net
Rootkit scan 2009-09-18 11:57:16
Windows 6.0.6001 Service Pack 1
Running: tib.exe; Driver: C:\Users\Benoit\AppData\Local\Temp\pgldrpob.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ZwTerminateProcess [0x943CC0B0]

Code 87B56C50 ZwEnumerateKey
Code 87B590C0 ZwFlushInstructionCache
Code 875632E6 ZwSaveKey
Code 874A1086 ZwSaveKeyEx
Code 866B815D IofCallDriver
Code 8675A576 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCompleteRequest 82A4EFE2 5 Bytes JMP 8675A57B
.text ntkrnlpa.exe!KeSetTimerEx + 854 82ACDE18 4 Bytes [B0, C0, 3C, 94] {MOV AL, 0xc0; CMP AL, 0x94}
.text ntkrnlpa.exe!IofCallDriver 82AD0F6F 5 Bytes JMP 866B8162

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\system32\services.exe[668] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 007B0002
IAT C:\Windows\system32\services.exe[668] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 007B0000
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [741F7BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [742398C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [741FD3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [741EF527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [741F7599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [741EE43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7422B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [741FD68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [741F012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [741F0095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [741E71F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7427D802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [742175E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [741EDAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [741E668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [741E66BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [741F1E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [026927E0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [02691B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [02692B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Windows\Explorer.EXE[1840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [026911D0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [00CF2B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [00CF11D0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [00CF27E0] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT C:\Program Files\Mozilla Firefox\firefox.exe[5068] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [00CF1B60] C:\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\gasfkyfsipwxsm.dll (*** hidden *** ) @ C:\Windows\Explorer.EXE [1840] 0x10000000
Library \\?\globalroot\systemroot\system32\gasfkyfsipwxsm.dll (*** hidden *** ) @ C:\Program Files\Mozilla Firefox\firefox.exe [5068] 0x10000000

---- EOF - GMER 1.0.15 ----

0
Réponse 19 / 43
Narco!4 Contributeur
clique sur scan

0
Réponse 20 / 43
broussel1967 Auteur
J'ai posté le log em MP, ça ne passait pas à nouveau.
Il y avait un message disant que gmer n'avait trouvé aucune modif.

0
- 1
- 2
- 3
Suivant

Alureon-CY

43 réponses

Discussions similaires

Newsletters