Question virus / disfonctionnement disque dur

Résolu
Gmita Messages postés 60 Statut Membre -  
Gmita Messages postés 60 Statut Membre -
Bonjour,

Je voudrais savoir si un Disque Dur (DD) qui claque est forcément (bientôt) mort, ou si cela peut être du à un virus ?

Je vous explique la situation, mon PC de bureau hier m'a laché. Je regardais une vidéo, pendant que j'effectuais un téléchargement (légal : freeware). D'un coup, de suite après le petit ding de fin de téléchargement, ma vidéo a gelé légèrement, sacadé, avant de reprendre. 10-15 minutes plus tard, elle a complétement gelé et mon disque dur s'est mis à claquer. J'ai alors cherché virus et autres malware, rien. J'ai aussi fait un test SMART complet qui a échoué, d'où mon hypothése de DD HS.

Avant cela rien d'anormal, pas de claquement, ou tout autre signe symptomatique de la mort du DD. Depuis, le PC démarre et géle complétement, je ne peux plus rien faire avec.

Alors votre avis ?

Merci



--
Avouer son ignorance n'est pas faiblesse, mais sagesse ...

6 réponses

  1.
    Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Bonjour,

    On va vérifier si c'est pas une cause logicielle ( malware ) à l'aide d'un live CD.

    -+-+-+-+-> OTLPENet <-+-+-+-+-

    Note : Ce fichier est assez volumineux, on utilisera donc ton lecteur CD/DVD et un CD vierge sur ta machine.
    Un Périphérique USB serait pratique également.

    [x] Télécharge OTLPENet sur ton bureau.

    [x] Insère dans ton lecteur/graveur CD/DVD , un CD vierge puis lance OTLPENet.

    [x] Une fenêtre s'ouvrira pour te demander si tu souhaites graver le CD, clique sur [Oui].

    [x] Patiente pendant la gravure. Une fois le CD gravé, insère le dans le lecteur CD/DVD du PC infecté.

    Note : Maintenant que le CD est gravé, il faut faire redémarrer le PC sur le lecteur CDROM.
    Un tutoriel est disponible ici.

    [x] Une fois le CD lancé, Windows se charge et tu arrives sur le bureau REATOGO-X-PE

    [x] Double clique sur OTLPE

    [x] Une fenêtre s'ouvre : Do you wish to load the remote registry , Clique sur [YES].
    [x] Une seconde : Do you wish to load remote user profile(s) for scanning , Clique sur [YES].
    [x] Veille à ce que la case Automatically Load All Remaining Users soit cochée et appuye sur [OK].

    [x] OTL va se lancer. Dans la partie " Custom Scan " , copie/colle le texte en gras ci dessous :


    netsvcs
    drivers32
    msconfig
    safebootminimal
    safebootnetwork
    activex
    c:\windows\*.* /U
    %SYSTEMDRIVE%\*.exe
    %ALLUSERSPROFILE%\Application Data\*.
    %ALLUSERSPROFILE%\Application Data\*.exe /s
    %APPDATA%\*.
    %APPDATA%\*.exe /s
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c
    HKLM\SOFTWARE\Microsoft\Internet Explorer|FEATURE_BROWSER_EMULATION /RS
    HKCU\SOFTWARE\Microsoft\Internet Explorer|FEATURE_BROWSER_EMULATION /RS


    [x] Clique sur [Run Scan] pour démarrer l'analyse.

    [x] Une fois l'analyse terminée, le fichier est sauvegardé sur ton disque dur C:\OTL.txt.

    [x] Copies le fichier sur une clé usb si tu n'as pas accès à Internet.

    [x] Poste le contenu du rapport OTL.txt dans ta prochaine réponse.
    0
  2. Gmita Messages postés 60 Statut Membre
     
    Salut,

    Je lance cette opération de suite. Merci :)

    Tu restes dispo combien de temps ?
    0
  3. Gmita Messages postés 60 Statut Membre
     
    Petite question,

    Je viens de commencer l'opération, mais je recontre un problème.

    Je viens de redémarrer mon PC sur le disque, le bureau REATOGO s'est ouvert. Après avoir cliquer sur OTLPE, j'ai une fenêtre : "Browse for Folder" qui s'est ouverte, avec la demande suivante : "Choose Windows Directory".

    Pour ne pas faire de gaffe; comme je ne connais pas OTLPE, je choisis bien le répertoire de mon Windows (C://Windows/) ?

    Merci.
    Avouer son ignorance n'est pas faiblesse, mais sagesse ...
    0
    1. Xplode Messages postés 9212 Statut Contributeur sécurité 726
       
      Oui , c'est bien ça.

      Et je suis dispo jusque tard dans la soirée, donc pas de soucis ;-)
      0
  4. Gmita Messages postés 60 Statut Membre
     
    Bilan OTL.txt :

    OTL logfile created on: 9/14/2010 12:35:51 PM - Run
    OTLPE by OldTimer - Version 3.1.41.0 Folder = X:\Programs\OTLPE
    Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
    Internet Explorer (Version = 8.0.6001.18943)
    Locale: 00000C0C | Country: Canada | Language: FRC | Date Format: yyyy-MM-dd

    3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
    3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 288.73 Gb Total Space | 196.38 Gb Free Space | 68.02% Space Free | Partition Type: NTFS
    Drive D: | 298.09 Gb Total Space | 150.90 Gb Free Space | 50.62% Space Free | Partition Type: NTFS
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    Drive I: | 9.36 Gb Total Space | 2.11 Gb Free Space | 22.59% Space Free | Partition Type: NTFS
    Drive X: | 434.85 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

    Computer Name: REATOGO
    Current User Name: SYSTEM
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: All users
    Company Name Whitelist: Off
    Skip Microsoft Files: Off
    File Age = 30 Days
    Output = Standard
    Using ControlSet: ControlSet001

    [color=#E56717]========== Win32 Services (SafeList) ==========[/color]

    SRV - [2010/07/31 17:22:34 | 000,049,504 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
    SRV - [2010/07/29 21:39:20 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
    SRV - [2010/06/01 19:00:52 | 001,778,480 | ---- | M] (COMODO) [Auto] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
    SRV - [2010/04/21 08:03:08 | 000,267,432 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
    SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010/02/24 09:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
    SRV - [2009/09/24 21:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\WINDOWS\System32\FntCache.dll -- (FontCache)
    SRV - [2009/07/24 15:05:24 | 000,139,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
    SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
    SRV - [2008/06/02 18:50:34 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
    SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/04/03 17:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto] -- C:\Program Files\UnivLaval\VPN Client\cvpnd.exe -- (CVPND)

    [color=#E56717]========== Driver Services (SafeList) ==========[/color]

    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\SymIM.sys -- (SymIMMP)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\SymIM.sys -- (SymIM)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\pcdrndisuio.sys -- (PcdrNdisuio)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
    DRV - File not found [Kernel | On_Demand] -- C:\Windows\System32\drivers\EagleNT.sys -- (EagleNT)
    DRV - [2010/06/04 11:55:40 | 000,224,240 | ---- | M] (COMODO) [File_System | System] -- C:\WINDOWS\System32\drivers\cmdGuard.sys -- (cmdGuard)
    DRV - [2010/06/01 19:00:06 | 000,075,944 | ---- | M] (COMODO) [Kernel | System] -- C:\WINDOWS\System32\drivers\inspect.sys -- (inspect)
    DRV - [2010/06/01 19:00:06 | 000,030,112 | ---- | M] (COMODO) [Kernel | System] -- C:\WINDOWS\System32\drivers\cmdhlp.sys -- (cmdHlp)
    DRV - [2010/03/01 09:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\System32\drivers\avipbb.sys -- (avipbb)
    DRV - [2010/02/16 13:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\System32\drivers\avgntflt.sys -- (avgntflt)
    DRV - [2009/09/02 17:31:54 | 000,722,416 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\sptd.sys -- (sptd)
    DRV - [2009/08/04 09:48:20 | 002,744,800 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
    DRV - [2009/07/25 10:54:13 | 000,278,984 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\atksgt.sys -- (atksgt)
    DRV - [2009/07/25 09:03:08 | 000,025,416 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\System32\drivers\lirsgt.sys -- (lirsgt)
    DRV - [2009/06/26 22:01:00 | 009,777,376 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2009/06/26 17:21:02 | 001,956,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\VX1000.sys -- (VX1000)
    DRV - [2009/05/11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\System32\drivers\ssmdrv.sys -- (ssmdrv)
    DRV - [2009/04/11 00:42:54 | 000,073,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\USBAUDIO.sys -- (usbaudio) Pilote USB audio (WDM)
    DRV - [2009/02/13 12:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
    DRV - [2008/12/04 20:34:52 | 000,328,728 | ---- | M] (Intel Corporation) [Kernel | Boot] -- C:\WINDOWS\System32\drivers\iaStor.sys -- (iaStor)
    DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2008/05/08 05:04:16 | 000,661,504 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys -- (winachsf)
    DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\HSX_DP.sys -- (HSF_DP)
    DRV - [2008/01/20 22:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
    DRV - [2008/01/20 22:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
    DRV - [2008/01/20 22:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
    DRV - [2008/01/20 22:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
    DRV - [2008/01/20 22:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
    DRV - [2008/01/20 22:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
    DRV - [2008/01/20 22:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
    DRV - [2008/01/20 22:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
    DRV - [2008/01/20 22:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
    DRV - [2008/01/20 22:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
    DRV - [2008/01/20 22:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
    DRV - [2008/01/20 22:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
    DRV - [2008/01/20 22:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
    DRV - [2008/01/20 22:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
    DRV - [2008/01/20 22:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
    DRV - [2008/01/20 22:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
    DRV - [2008/01/20 22:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\arc.sys -- (arc)
    DRV - [2008/01/20 22:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
    DRV - [2008/01/20 22:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
    DRV - [2008/01/20 22:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
    DRV - [2008/01/20 22:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
    DRV - [2008/01/20 22:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
    DRV - [2008/01/20 22:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
    DRV - [2008/01/20 22:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
    DRV - [2008/01/20 22:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
    DRV - [2007/12/11 19:51:28 | 000,021,280 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand] -- C:\Program Files\PC-Doctor 5 for Windows\pcd5srvc.pkms -- (PCD5SRVC{BD6912E3-AC9D80E8-05040000})
    DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\XAudio.sys -- (XAudio)
    DRV - [2007/10/03 12:18:12 | 000,099,840 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\Rtlh86.sys -- (RTL8169)
    DRV - [2007/04/03 17:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto] -- C:\WINDOWS\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
    DRV - [2007/01/31 14:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\dne2000.sys -- (DNE)
    DRV - [2007/01/18 14:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\CVirtA.sys -- (CVirtA)
    DRV - [2006/11/02 05:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
    DRV - [2006/11/02 05:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
    DRV - [2006/11/02 05:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
    DRV - [2006/11/02 05:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
    DRV - [2006/11/02 05:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
    DRV - [2006/11/02 05:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
    DRV - [2006/11/02 05:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
    DRV - [2006/11/02 05:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
    DRV - [2006/11/02 05:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
    DRV - [2006/11/02 05:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
    DRV - [2006/11/02 05:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
    DRV - [2006/11/02 04:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
    DRV - [2006/11/02 04:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
    DRV - [2006/11/02 04:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
    DRV - [2006/11/02 04:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
    DRV - [2006/11/02 04:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
    DRV - [2006/11/02 04:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
    DRV - [2006/11/02 03:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
    DRV - [2005/12/12 12:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand] -- C:\WINDOWS\System32\drivers\PS2.sys -- (Ps2)

    [color=#E56717]========== Standard Registry (SafeList) ==========[/color]

    [color=#E56717]========== Internet Explorer ==========[/color]

    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hp-consumer.my.aol.qc.ca/?icid=desktop
    IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hp-consumer.my.aol.qc.ca/?icid=desktop

    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\Ben_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hp-consumer.my.aol.qc.ca/?icid=desktop
    IE - HKU\Ben_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
    IE - HKU\Ben_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = https://www.msn.com/fr-ca?lang=fr-ca&OCID=FW69157
    IE - HKU\Ben_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fr-ca
    IE - HKU\Ben_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\Ben_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local

    IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    FF - HKLM\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2010/07/31 09:19:57 | 000,000,000 | ---D | M]

    O1 HOSTS File: ([2010/09/11 10:46:12 | 000,419,188 | R--- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: ::1 localhost
    O1 - Hosts: 127.0.0.1 www.007guard.com
    O1 - Hosts: 127.0.0.1 007guard.com
    O1 - Hosts: 127.0.0.1 008i.com
    O1 - Hosts: 127.0.0.1 www.008k.com
    O1 - Hosts: 127.0.0.1 008k.com
    O1 - Hosts: 127.0.0.1 www.00hq.com
    O1 - Hosts: 127.0.0.1 00hq.com
    O1 - Hosts: 127.0.0.1 010402.com
    O1 - Hosts: 127.0.0.1 www.032439.com
    O1 - Hosts: 127.0.0.1 032439.com
    O1 - Hosts: 127.0.0.1 www.0scan.com
    O1 - Hosts: 127.0.0.1 0scan.com
    O1 - Hosts: 127.0.0.1 1000gratisproben.com
    O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
    O1 - Hosts: 127.0.0.1 1001namen.com
    O1 - Hosts: 127.0.0.1 www.1001namen.com
    O1 - Hosts: 127.0.0.1 100888290cs.com
    O1 - Hosts: 127.0.0.1 www.100888290cs.com
    O1 - Hosts: 127.0.0.1 www.100sexlinks.com
    O1 - Hosts: 127.0.0.1 100sexlinks.com
    O1 - Hosts: 127.0.0.1 10sek.com
    O1 - Hosts: 127.0.0.1 www.10sek.com
    O1 - Hosts: 127.0.0.1 www.1-2005-search.com
    O1 - Hosts: 14467 more lines...
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
    O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
    O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
    O4 - HKLM..\Run: [] File not found
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
    O4 - HKLM..\Run: [EEventManager] C:\Program Files\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
    O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
    O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
    O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [VX1000] C:\WINDOWS\vVX1000.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
    O4 - HKU\Ben_ON_C..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe File not found
    O4 - HKU\Ben_ON_C..\Run: [EPSON NX210 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFDA.EXE (SEIKO EPSON CORPORATION)
    O4 - HKU\Ben_ON_C..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
    O4 - HKU\Ben_ON_C..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
    O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
    O4 - Startup: C:\Users\Ben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notification de cadeaux MSN.lnk = File not found
    O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
    O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
    O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
    O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll ()
    O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
    O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
    O13 - gopher Prefix: missing
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
    O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
    O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\WINDOWS\System32\guard32.dll (COMODO)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\img16.jpg
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\img16.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/02/22 21:50:31 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
    O33 - MountPoints2\{2f1a5331-9808-11de-bb2d-001e8cdeb242}\Shell - "" = AutoRun
    O33 - MountPoints2\{2f1a5331-9808-11de-bb2d-001e8cdeb242}\Shell\AutoRun\command - "" = L:\Autorun.exe -- File not found
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.VP60 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: vidc.VP61 - C:\WINDOWS\System32\vp6vfw.dll (On2.com)
    Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll ()

    SafeBootMin: AppMgmt - Service
    SafeBootMin: Base - Driver Group
    SafeBootMin: Boot Bus Extender - Driver Group
    SafeBootMin: Boot file system - Driver Group
    SafeBootMin: File system - Driver Group
    SafeBootMin: Filter - Driver Group
    SafeBootMin: HelpSvc - Service
    SafeBootMin: NTDS - File not found
    SafeBootMin: PCI Configuration - Driver Group
    SafeBootMin: PNP Filter - Driver Group
    SafeBootMin: Primary disk - Driver Group
    SafeBootMin: sacsvr - Service
    SafeBootMin: SCSI Class - Driver Group
    SafeBootMin: System Bus Extender - Driver Group
    SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
    SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
    SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
    SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
    SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
    SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
    SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
    SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
    SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
    SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
    SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
    SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
    SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
    SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
    SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
    SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
    SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

    SafeBootNet: AppMgmt - Service
    SafeBootNet: Base - Driver Group
    SafeBootNet: Boot Bus Extender - Driver Group
    SafeBootNet: Boot file system - Driver Group
    SafeBootNet: File system - Driver Group
    SafeBootNet: Filter - Driver Group
    SafeBootNet: HelpSvc - Service
    SafeBootNet: Messenger - Service
    SafeBootNet: NDIS Wrapper - Driver Group
    SafeBootNet: NetBIOSGroup - Driver Group
    SafeBootNet: NetDDEGroup - Driver Group
    SafeBootNet: Network - Driver Group
    SafeBootNet: NetworkProvider - Driver Group
    SafeBootNet: NTDS - File not found
    SafeBootNet: PCI Configuration - Driver Group
    SafeBootNet: PNP Filter - Driver Group
    SafeBootNet: PNP_TDI - Driver Group
    SafeBootNet: Primary disk - Driver Group
    SafeBootNet: rdsessmgr - Service
    SafeBootNet: sacsvr - Service
    SafeBootNet: SCSI Class - Driver Group
    SafeBootNet: Streams Drivers - Driver Group
    SafeBootNet: System Bus Extender - Driver Group
    SafeBootNet: TDI - Driver Group
    SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SafeBootNet: WudfPf - Driver
    SafeBootNet: WudfUsbccidDriver - Driver
    SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
    SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
    SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
    SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
    SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
    SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
    SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
    SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
    SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
    SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
    SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
    SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
    SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
    SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
    SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
    SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
    SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
    SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
    SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
    SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
    SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
    SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

    ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
    ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
    ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
    ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
    ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
    ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
    ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
    ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
    ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
    ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
    ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
    ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
    ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
    ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
    ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
    ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
    ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
    ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
    ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
    ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
    ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
    ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
    ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
    ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
    ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
    ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
    ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
    ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
    ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
    ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

    [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

    [2010/09/13 22:26:25 | 000,000,000 | ---D | C] -- C:\Users\Ben\Documents\Oberon Media
    [2010/09/09 19:35:26 | 000,000,000 | ---D | C] -- C:\Users\Ben\AppData\Roaming\vlc
    [2010/09/08 18:55:01 | 000,000,000 | ---D | C] -- C:\Users\Ben\Desktop\Dexter
    [2010/08/29 14:10:35 | 000,000,000 | ---D | C] -- C:\Users\Ben\Desktop\Seq_Art2
    [2010/08/27 13:07:28 | 000,000,000 | ---D | C] -- C:\Users\Ben\Documents\Vidéos
    [2010/08/22 07:06:00 | 000,000,000 | ---D | C] -- C:\Windows\fr

    [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

    [2010/09/14 08:23:52 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2010/09/14 08:23:52 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2010/09/14 08:23:50 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
    [2010/09/14 08:23:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2010/09/13 23:28:06 | 002,390,283 | -H-- | M] () -- C:\Users\Ben\AppData\Local\IconCache.db
    [2010/09/13 19:15:28 | 000,093,184 | ---- | M] () -- C:\Users\Ben\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/09/11 10:46:12 | 000,419,188 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2010/08/30 08:37:06 | 001,495,948 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
    [2010/08/30 08:37:06 | 000,678,804 | ---- | M] () -- C:\Windows\System32\perfh00C.dat
    [2010/08/30 08:37:06 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2010/08/30 08:37:06 | 000,126,420 | ---- | M] () -- C:\Windows\System32\perfc00C.dat
    [2010/08/30 08:37:06 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2010/08/29 14:23:26 | 000,001,734 | -H-- | M] () -- C:\Users\Ben\Documents\Default.rdp

    [color=#E56717]========== Files Created - No Company Name ==========[/color]

    [2010/05/16 16:19:23 | 000,000,003 | ---- | C] () -- C:\Windows\treeskp.sys
    [2010/05/14 11:45:43 | 000,000,000 | ---- | C] () -- C:\Windows\EEventManager.INI
    [2010/02/01 12:48:39 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
    [2009/11/30 20:35:42 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
    [2009/11/30 20:30:16 | 000,000,044 | ---- | C] () -- C:\Windows\EPNX210.ini
    [2009/11/11 18:32:55 | 000,000,158 | ---- | C] () -- C:\Windows\SITESEER.INI
    [2009/09/26 14:10:03 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
    [2009/09/25 18:21:54 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
    [2009/09/03 08:38:13 | 000,000,322 | ---- | C] () -- C:\Users\Ben\AppData\Local\msOffice.info
    [2009/09/03 08:38:13 | 000,000,322 | ---- | C] () -- C:\Users\Ben\AppData\Roaming\lpt_config.ini
    [2009/07/25 09:03:09 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
    [2009/07/25 09:03:08 | 000,025,416 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
    [2009/07/24 11:54:56 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/07/23 19:08:05 | 000,093,184 | ---- | C] () -- C:\Users\Ben\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2009/07/23 08:10:52 | 000,000,680 | ---- | C] () -- C:\Users\Ben\AppData\Local\d3d9caps.dat
    [2009/04/10 14:50:24 | 000,015,498 | ---- | C] () -- C:\Windows\VX1000.ini
    [2008/02/22 21:50:47 | 000,000,060 | ---- | C] () -- C:\Windows\System32\HP_Demo.ini
    [2008/02/22 21:35:37 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
    [2008/02/22 21:35:37 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
    [2007/04/03 17:18:26 | 000,197,672 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
    [2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

    [color=#E56717]========== LOP Check ==========[/color]

    [2009/09/26 14:25:18 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\BITS
    [2009/09/02 17:31:01 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\CodonCode Aligner
    [2009/09/02 17:43:25 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\DAEMON Tools Pro
    [2010/01/18 14:00:43 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\Dragon Altar Games
    [2009/12/13 22:40:33 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\Epson
    [2009/09/26 14:09:58 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\FlashGet
    [2009/09/26 14:09:30 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\FlashGetBHO
    [2009/07/24 09:01:37 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\ICAClient
    [2009/11/30 20:40:26 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\Leadertech
    [2009/12/18 16:34:30 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\MEGA4_4028
    [2009/11/13 12:21:33 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\PlayFirst
    [2010/05/30 12:40:29 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\thriXXX
    [2010/09/08 18:17:06 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\uTorrent
    [2010/05/17 09:47:13 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\vghd
    [2009/07/24 09:09:07 | 000,000,000 | ---D | M] -- C:\Users\Ben\AppData\Roaming\WinBatch
    [2010/09/14 07:40:07 | 000,032,564 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

    [color=#E56717]========== Purity Check ==========[/color]

    [color=#E56717]========== Custom Scans ==========[/color]

    [color=#A23BEC]< c:\windows\*.* /U >[/color]

    [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

    Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.

    Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe

    Invalid Environment Variable: %APPDATA%\*.

    Invalid Environment Variable: %APPDATA%\*.exe

    [color=#A23BEC]< %systemroot%\*. /mp /s >[/color]

    [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
    [2009/04/11 02:28:19 | 000,142,336 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\System32\fontext.dll
    [2010/07/26 11:51:48 | 011,584,512 | ---- | M] (Microsoft Corporation)[b] Unable to obtain MD5[/b] -- C:\WINDOWS\System32\shell32.dll

    [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]

    [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]

    [color=#A23BEC]< %systemroot%\System32\config\*.sav >[/color]
    [2008/01/20 23:14:18 | 016,846,848 | ---- | M] () -- C:\WINDOWS\System32\config\COMPONENTS.SAV
    [2008/01/20 23:14:08 | 000,106,496 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
    [2008/01/20 23:14:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\config\SECURITY.SAV
    [2006/11/02 06:34:08 | 010,133,504 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
    [2006/11/02 06:34:08 | 001,826,816 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

    [color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >[/color]
    "Sidebar" = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun -- [2009/04/11 02:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation)
    "ehTray.exe" = C:\Windows\ehome\ehTray.exe -- [2008/01/20 22:25:11 | 000,125,952 | ---- | M] (Microsoft Corporation)
    "SpybotSD TeaTimer" = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe -- [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.)
    "FileHippo.com" = "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background -- [2010/04/29 08:57:16 | 000,248,832 | ---- | M] (FileHippo.com)
    "EA Core" = "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent -- File not found
    "HPADVISOR" = C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN -- [2009/08/05 11:27:00 | 001,644,088 | ---- | M] (Hewlett-Packard)
    "EPSON NX210 Series" = C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFDA.EXE /FU "C:\Windows\TEMP\E_S5D1D.tmp" /EF "HKCU" -- [2008/11/05 02:00:00 | 000,199,680 | ---- | M] (SEIKO EPSON CORPORATION)
    "WMPNSCFG" = C:\Program Files\Windows Media Player\WMPNSCFG.exe -- [2008/01/20 22:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation)
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OsdMaestro]
    "ModelName" = 5189URF
    "Version" = 1.00.007
    "Language" = 1
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OsdMaestro\Config]
    "DisplayLabel" = 0
    "TaskbarIcon" = 1
    "ShowLockOSD" = 1

    [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s >[/color]
    "Windows Defender" = %ProgramFiles%\Windows Defender\MSASCui.exe -hide -- [2008/01/20 22:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation)
    "RtHDVCpl" = RtHDVCpl.exe -- [2008/07/03 11:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor)
    "hpsysdrv" = c:\hp\support\hpsysdrv.exe -- [2007/04/18 11:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company)
    "KBD" = C:\HP\KBD\KbdStub.EXE -- [2006/12/08 11:16:56 | 000,065,536 | ---- | M] ()
    "OsdMaestro" = "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" -- [2007/02/15 07:59:00 | 000,118,784 | ---- | M] (OsdMaestro)
    "HP Health Check Scheduler" = [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    "" =
    "avgnt" = "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min -- [2010/03/02 10:28:31 | 000,282,792 | ---- | M] (Avira GmbH)
    "IAAnotif" = "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" -- [2008/06/02 18:50:32 | 000,178,712 | ---- | M] (Intel Corporation)
    "VX1000" = C:\Windows\vVX1000.exe -- [2009/06/26 17:21:00 | 000,757,248 | ---- | M] (Microsoft Corporation)
    "LifeCam" = "C:\Program Files\Microsoft LifeCam\LifeExp.exe" -- [2009/07/24 15:05:24 | 000,118,640 | ---- | M] (Microsoft Corporation)
    "HP Software Update" = C:\Program Files\HP\HP Software Update\HPWuSchd2.exe -- [2008/12/08 15:50:04 | 000,054,576 | ---- | M] (Hewlett-Packard)
    "NvCplDaemon" = RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup -- [2009/06/26 17:32:36 | 013,789,728 | ---- | M] (NVIDIA Corporation)
    "EEventManager" = C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe -- [2008/12/04 14:24:30 | 000,665,424 | ---- | M] (SEIKO EPSON CORPORATION)
    "Adobe Reader Speed Launcher" = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" -- [2010/06/19 22:04:47 | 000,035,760 | ---- | M] (Adobe Systems Incorporated)
    "Adobe ARM" = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" -- [2010/06/09 04:06:33 | 000,976,832 | ---- | M] (Adobe Systems Incorporated)
    "COMODO Internet Security" = "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h -- [2010/06/01 19:00:40 | 002,039,240 | ---- | M] (COMODO)
    "Microsoft Default Manager" = "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume -- [2010/05/10 14:12:28 | 000,439,568 | ---- | M] (Microsoft Corporation)
    "SunJavaUpdateSched" = "C:\Program Files\Common Files\Java\Java Update\jusched.exe" -- [2010/05/14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
    "" =
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "" =
    "Installed" = 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "" =
    "Installed" = 1
    "NoChange" = 1
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "" =
    "Installed" = 1

    [color=#A23BEC]< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c >[/color]
    ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\WUAUSERV
    IMAGEPATH REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs

    [color=#A23BEC]< reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c >[/color]
    ! REG.EXE VERSION 3.0
    HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS
    IMAGEPATH REG_EXPAND_SZ %SystemRoot%\System32\svchost.exe -k netsvcs

    [color=#A23BEC]< HKLM\SOFTWARE\Microsoft\Internet Explorer|FEATURE_BROWSER_EMULATION /RS >[/color]
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\\sllauncher.exe: 8000

    [color=#A23BEC]< HKCU\SOFTWARE\Microsoft\Internet Explorer|FEATURE_BROWSER_EMULATION /RS >[/color]
    < End of report >
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Xplode Messages postés 9212 Statut Contributeur sécurité 726
     
    Re-bonsoir,

    Le rapport OTL ne montre aucune infection hormis des logiciels un peu douteux présent sur ton PC.. si tu vois ce que je veux dire ;-)

    A mon avis, ça doit être matériel.
    0
  7. Gmita Messages postés 60 Statut Membre
     
    Oki, dommage pour le DD. Merci. Pour le reste, ce qui peut etre douteux, c'est l'utilisation, pas le logiciel ;)

    Merci encore
    Bonne soiree
    0

Discussions similaires

disque dur et bbox bouygues
t671 -
CCMBot -

1 réponse