PC gele et lent

Salut,

1)
* Télécharge AD-Remover sur ton Bureau. (Merci à C_XX)
http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Miroir:

https://www.androidworld.fr/

/!\ Ferme toutes applications en cours /!\

/!\ Désactive provisoirement et seulement le temps de l'utilisation de AD-Remover, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

- Double-clique sur l'icône Ad-remover située sur ton Bureau.
- Sur la page, clique sur le bouton « Nettoyer »
- Confirme lancement du scan
- Laisse travailler l'outil.
- Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(Scan/clean).Txt)

2)

Télécharge ZHPDiag ( de Nicolas coolman ).
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Double clique sur le fichier d'installation, puis installe le avec les? paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista )

Clique sur la loupe? en haut à gauche, puis laisse l'outil scanner.

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

Rend toi sur Cjoint :? http://www.cijoint.fr/

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Créer le lien cjoint " et copie/colle le dans ton prochain message

salut archet 9, merci pour votre réponse
1/ rapport du AD remover:

======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:46:44 le 10/10/2010, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 2 (X86)
TOSHIBA@DA7DOU7 (TOSHIBA Satellite A300)

============== ACTION(S) ==============

(!) -- Fichiers temporaires supprimés.

0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKCU\Software\Conduit
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}

============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.10 (fr)] **

-- C:\Users\TOSHIBA\AppData\Roaming\Mozilla\FireFox\Profiles\4jd29lhe.default\Prefs.js --
browser.download.dir, C:\\Users\\TOSHIBA\\Desktop
browser.download.lastDir, C:\\Users\\TOSHIBA\\Desktop
browser.startup.homepage_override.mstone, rv:1.9.2.8

-- C:\Users\Invité\AppData\Roaming\Mozilla\FireFox\Profiles\ajaw764i.default\Prefs.js --
browser.download.dir, C:\\Users\\Invité\\Downloads
browser.startup.homepage_override.mstone, rv:1.9.0.11

========================================

** Internet Explorer Version [8.0.6001.18943] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Local Page: C:\Windows\system32\blank.htm
SearchAssistant:
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst:

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 10/10/2010 (2509 Octet(s))

Fin à: 20:49:13, 10/10/2010

============== E.O.F ==============

2/ le lien : http://www.cijoint.fr/cjlink.php?file=cj201010/cijdxhh4hc.txt
merci

Il reste qques petits soucis...Je pense que MBAM va règler cela:

Fais un scan avec cet antispyware :
Malwarebytes + tutoriel

Tu l'installes; mets le a jour...(onglet mise a jour)
Click maintenant sur l'onglet recherche et coche la case :
"Executer un examen rapide".
Puis click sur "rechercher".
Laisses le scanner le pc...
A la fin du scan, clique sur Afficher les résultats
Si des elements on ete trouvés :
> click sur supprimer la selection.si il t'es demandé de redemarrer > click sur "oui".
A la fin un rapport va s'ouvrir;
sauvegarde le de maniere a le retrouver en vue de le poster sur le forum.
Copies et colles le rapport stp.

a+

re,
j utilise frequemment MBAM mais il ne me trouve rien.
je vous poste le rapport :

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Version de la base de données: 4791

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

10/10/2010 21:36:36
mbam-log-2010-10-10 (21-36-36).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 151149
Temps écoulé: 6 minute(s), 4 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Bon....On va faire différement alors:

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe

---> Installe la console de récupération si l'outil te le propose.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\
En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

re,
j ai eu des problemes au redemarrage du pc après avoir executé combofix.
j ai du restaurer le systeme pour que windows puisse enfin redemarrer.
tout est revenu a la case depart, c est a dire y a plus le AD remover et les autres programmes.
qu'est ce que je dois faire?
merci

je m excuse y a bien AD remover et l autre programme je me suis trompée
seulement combofix n est plus la

on recomence alors:

Télécharge ZHPDiag ( de Nicolas coolman ).
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Double clique sur le fichier d'installation, puis installe le avec les? paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista )

Clique sur la loupe? en haut à gauche, puis laisse l'outil scanner.

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

Rend toi sur Cjoint :? http://www.cijoint.fr/

Clique sur "Parcourir " dans la partie " Joindre un fichier[...] "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Créer le lien cjoint " et copie/colle le dans ton prochain message

bonjour,
je m excuse pour le retard j avais un probleme de connxion
voici le lien
merci

http://www.cijoint.fr/cjlink.php?file=cj201010/cijTaiBxX2.txt

-Relance AD remover option nettoyer

-Desinstalle Sunbelt Personal Firewall

c'est bon. je vous poste le rapport de AD remover.
j ai desinstallé SFP, est ce que je dois installer un autre parefeu? qu'est ce que vous me proposez?

======= RAPPORT D'AD-REMOVER 2.0.0.1,F | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par C_XX le 16/09/10 à 13:30
Contact: AdRemover.contact[AT]gmail.com
Site web: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 19:28:28 le 14/10/2010, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium Service Pack 2 (X86)
TOSHIBA@DA7DOU7 (TOSHIBA Satellite A300)

============== ACTION(S) ==============

(!) -- Fichiers temporaires supprimés.

0,Clé supprimée: HKLM\Software\Conduit
0,Clé supprimée: HKCU\Software\Conduit
3,Clé supprimée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}

============== SCAN ADDITIONNEL ==============

** Mozilla Firefox Version [3.6.10 (fr)] **

-- C:\Users\TOSHIBA\AppData\Roaming\Mozilla\FireFox\Profiles\4jd29lhe.default\Prefs.js --
browser.download.dir, C:\\Users\\TOSHIBA\\Desktop
browser.download.lastDir, C:\\Users\\TOSHIBA\\Desktop
browser.startup.homepage_override.mstone, rv:1.9.2.10

-- C:\Users\Invité\AppData\Roaming\Mozilla\FireFox\Profiles\ajaw764i.default\Prefs.js --
browser.download.dir, C:\\Users\\Invité\\Downloads
browser.startup.homepage_override.mstone, rv:1.9.0.11

========================================

** Internet Explorer Version [8.0.6001.18975] **

[HKCU\Software\Microsoft\Internet Explorer\Main]
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Do404Search: 0x01000000
Local Page: C:\Windows\system32\blank.htm
SearchAssistant:
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Show_ToolBar: yes
Start Page: hxxp://fr.msn.com/
Use Search Asst:

[HKLM\Software\Microsoft\Internet Explorer\Main]
AutoHide: yes
Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Delete_Temp_Files_On_Exit: yes
Local Page: C:\Windows\System32\blank.htm
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]
Tabs: res://ieframe.dll/tabswelcome.htm
Blank: res://mshtml.dll/blank.htm

========================================

C:\Program Files\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files\Ad-Remover\Backup: 16 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 10/10/2010 (2510 Octet(s))

Fin à: 19:30:40, 14/10/2010

============== E.O.F ==============

"j ai desinstallé SFP, est ce que je dois installer un autre parefeu? qu'est ce que vous me proposez? "

Tu as déja le pare feu de Vista et il est suffisant ...

* Lance ZHPFix (soit via le raccourci sur ton Bureau, soit via ZHPDiag en cliquant sur l'écusson vert)
Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)
Copie/colle les lignes suivantes en gras et place les dans ZHPFix :

----------------------------------------------------------
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: Modified
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- E:\i tunes\iTunesHelper.exe
O4 - Global Startup: C:\Users\TOSHIBA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk . (.Pas de propriétaire.) -- C:\Program Files\OpenOffice.org 3\program\quickstart.exe
[HKCU\Software\Boonty]
[HKLM\Software\Boonty]
O44 - LFC:[MD5.E2ACB0C2AFB0D62B2D79F757D09C16DC] - 10/10/2010 - 19:49:13 ---A- . (.Pas de propriétaire - Pas de description.) -- C:\Ad-Report-CLEAN[1].txt [2639]
SS - | Demand 27/07/2010 0 | C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (Boonty Games) . (.Pas de propriétaire.) - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

----------------------------------------------------------

- Clique sur « Tous », puis sur « Nettoyer »
- Copie/colle la totalité du rapport dans ta prochaine réponse
Tuto :
http://www.premiumorange.com/zeb-help-process/zhpfix.html

Dis moi ensuite ou en sont tes soucis de départ.

j ai encore qlq problemes. tout a l heure (avant de faire la desinfection d aujourd hui) j ai mis mon pc en veille. quand j voulais le demarrer, il s est planté et le lecteur cd s est ouvert tt seul! le comble quoi :) je vais observer aujourd hui s il y a une amélioration. en tt cas je vous remercie bcp pour votre aide c'est gentil a vous
voici le rapport
Rapport de ZHPFix 1.12.3209 par Nicolas Coolman, Update du 12/10/2010
Fichier d'export Registre : C:\ZHPExportRegistry-14-10-2010-20-06-24.txt
Run by TOSHIBA at 14/10/2010 20:06:24
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKCU\Software\Boonty => Clé supprimée avec succès
HKLM\Software\Boonty => Clé supprimée avec succès
SS - | Demand 27/07/2010 0 | C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (Boonty Games) . (.Pas de propriétaire.) - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe => Clé supprimée avec succès

========== Valeur(s) du Registre ==========
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: Modified => Valeur absente
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- E:\i tunes\iTunesHelper.exe => Valeur supprimée avec succès

========== Fichier(s) ==========
e:\i tunes\ituneshelper.exe => Supprimé et mis en quarantaine
c:\users\toshiba\appdata\roaming\microsoft\windows\start menu\programs\startup\openoffice.org 3.1.lnk => Supprimé et mis en quarantaine
c:\program files\openoffice.org 3\program\quickstart.exe => Supprimé et mis en quarantaine
c:\ad-report-clean[1].txt => Supprimé et mis en quarantaine
c:\program files\common files\boonty shared\service\boonty.exe () => Fichier absent

========== Récapitulatif ==========
3 : Clé(s) du Registre
2 : Valeur(s) du Registre
5 : Fichier(s)

End of the scan

Pas normal...

Télécharge load tdsskiller (de Loup blanc) sur ton Bureau.
https://support.kaspersky.com/fr/14421

Cet outil est conçu pour automatiser les différentes tâches proposées par TDSSKiller, un fix de Kaspersky.

* Lance load tdsskiller
Sous Vista => Clic-droit "Exécuter en tant qu'administrateur"
* L'outil va se connecter à internet pour télécharger une copie à jour de TDSSKiller et lancer le scan.
* Un message dans la fenêtre noire d'invite de commande te demandera d'appuyer sur une touche pour continuer.
* Le rapport s'ouvre spontanément, copie-colle le dans la prochaine réponse.

Si le rapport ne s'ouvre pas , il se trouve à la racine du disque : C:\tdsskiller\report.txt

2010/10/14 20:23:00.0455 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/14 20:23:00.0455 ================================================================================
2010/10/14 20:23:00.0455 SystemInfo:
2010/10/14 20:23:00.0455
2010/10/14 20:23:00.0455 OS Version: 6.0.6002 ServicePack: 2.0
2010/10/14 20:23:00.0456 Product type: Workstation
2010/10/14 20:23:00.0456 ComputerName: DA7DOU7
2010/10/14 20:23:00.0456 UserName: TOSHIBA
2010/10/14 20:23:00.0456 Windows directory: C:\Windows
2010/10/14 20:23:00.0456 System windows directory: C:\Windows
2010/10/14 20:23:00.0456 Processor architecture: Intel x86
2010/10/14 20:23:00.0456 Number of processors: 2
2010/10/14 20:23:00.0456 Page size: 0x1000
2010/10/14 20:23:00.0456 Boot type: Normal boot
2010/10/14 20:23:00.0456 ================================================================================
2010/10/14 20:23:01.0093 Initialize success
2010/10/14 20:23:06.0390 ================================================================================
2010/10/14 20:23:06.0390 Scan started
2010/10/14 20:23:06.0390 Mode: Manual;
2010/10/14 20:23:06.0390 ================================================================================
2010/10/14 20:23:06.0829 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2010/10/14 20:23:06.0965 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
2010/10/14 20:23:07.0107 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
2010/10/14 20:23:07.0155 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
2010/10/14 20:23:07.0280 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
2010/10/14 20:23:07.0445 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2010/10/14 20:23:07.0578 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
2010/10/14 20:23:07.0634 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2010/10/14 20:23:07.0742 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
2010/10/14 20:23:07.0860 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
2010/10/14 20:23:07.0888 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
2010/10/14 20:23:08.0010 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
2010/10/14 20:23:08.0048 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
2010/10/14 20:23:08.0226 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
2010/10/14 20:23:08.0281 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
2010/10/14 20:23:08.0407 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/10/14 20:23:08.0472 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2010/10/14 20:23:08.0616 athr (6046a55f79de9c581b8d5e9c1366cc81) C:\Windows\system32\DRIVERS\athr.sys
2010/10/14 20:23:08.0842 atikmdag (d5ab32f003780f21325f1c1df613f867) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/10/14 20:23:08.0986 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2010/10/14 20:23:09.0044 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
2010/10/14 20:23:09.0186 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2010/10/14 20:23:09.0315 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2010/10/14 20:23:09.0354 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2010/10/14 20:23:09.0488 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2010/10/14 20:23:09.0525 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2010/10/14 20:23:09.0640 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2010/10/14 20:23:09.0685 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2010/10/14 20:23:09.0815 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2010/10/14 20:23:10.0106 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/10/14 20:23:10.0237 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2010/10/14 20:23:10.0286 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
2010/10/14 20:23:10.0418 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2010/10/14 20:23:10.0577 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2010/10/14 20:23:10.0629 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
2010/10/14 20:23:10.0686 CnxtHdAudAddService (76ffd950394c45196d09239edc9b006b) C:\Windows\system32\drivers\CHDART.sys
2010/10/14 20:23:10.0783 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2010/10/14 20:23:10.0828 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
2010/10/14 20:23:10.0864 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
2010/10/14 20:23:11.0019 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2010/10/14 20:23:11.0188 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2010/10/14 20:23:11.0330 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2010/10/14 20:23:11.0383 DXGKrnl (5c7e2097b91d689ded7a6ff90f0f3a25) C:\Windows\System32\drivers\dxgkrnl.sys
2010/10/14 20:23:11.0519 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
2010/10/14 20:23:11.0675 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2010/10/14 20:23:11.0773 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
2010/10/14 20:23:11.0910 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
2010/10/14 20:23:12.0013 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2010/10/14 20:23:12.0121 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2010/10/14 20:23:12.0182 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
2010/10/14 20:23:12.0292 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2010/10/14 20:23:12.0346 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2010/10/14 20:23:12.0426 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/10/14 20:23:12.0496 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2010/10/14 20:23:12.0626 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2010/10/14 20:23:12.0682 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
2010/10/14 20:23:12.0774 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2010/10/14 20:23:12.0957 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
2010/10/14 20:23:13.0033 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/10/14 20:23:13.0160 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2010/10/14 20:23:13.0202 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
2010/10/14 20:23:13.0366 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2010/10/14 20:23:13.0405 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
2010/10/14 20:23:13.0484 HSF_DPV (cc267848cb3508e72762be65734e764d) C:\Windows\system32\DRIVERS\HSX_DPV.sys
2010/10/14 20:23:13.0613 HSXHWAZL (a2882945cc4b6e3e4e9e825590438888) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
2010/10/14 20:23:13.0693 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2010/10/14 20:23:13.0804 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
2010/10/14 20:23:13.0854 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/10/14 20:23:13.0989 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\Windows\system32\DRIVERS\iaStor.sys
2010/10/14 20:23:14.0056 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
2010/10/14 20:23:14.0220 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2010/10/14 20:23:14.0344 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2010/10/14 20:23:14.0420 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2010/10/14 20:23:14.0505 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/10/14 20:23:14.0615 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
2010/10/14 20:23:14.0658 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2010/10/14 20:23:14.0772 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2010/10/14 20:23:14.0808 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
2010/10/14 20:23:14.0859 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/10/14 20:23:14.0953 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2010/10/14 20:23:14.0990 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2010/10/14 20:23:15.0019 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/10/14 20:23:15.0131 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/10/14 20:23:15.0302 kl1 (45056287cdd70803bad130bf71fe6890) C:\Windows\system32\DRIVERS\kl1.sys
2010/10/14 20:23:15.0404 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2010/10/14 20:23:15.0561 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2010/10/14 20:23:15.0728 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
2010/10/14 20:23:15.0770 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
2010/10/14 20:23:15.0914 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
2010/10/14 20:23:15.0955 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2010/10/14 20:23:16.0214 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2010/10/14 20:23:16.0248 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
2010/10/14 20:23:16.0378 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
2010/10/14 20:23:16.0506 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2010/10/14 20:23:16.0635 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2010/10/14 20:23:16.0672 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2010/10/14 20:23:16.0790 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2010/10/14 20:23:16.0833 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2010/10/14 20:23:16.0976 MpFilter (c98301ad8173a2235a9ab828955c32bb) C:\Windows\system32\DRIVERS\MpFilter.sys
2010/10/14 20:23:17.0120 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
2010/10/14 20:23:17.0249 MpNWMon (aeb186afff5d9cfed823c15d846aac3b) C:\Windows\system32\DRIVERS\MpNWMon.sys
2010/10/14 20:23:17.0320 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2010/10/14 20:23:17.0396 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2010/10/14 20:23:17.0525 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2010/10/14 20:23:17.0586 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/10/14 20:23:17.0682 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/10/14 20:23:17.0759 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/10/14 20:23:17.0869 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
2010/10/14 20:23:17.0900 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
2010/10/14 20:23:17.0954 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2010/10/14 20:23:18.0071 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2010/10/14 20:23:18.0139 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2010/10/14 20:23:18.0247 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/10/14 20:23:18.0284 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2010/10/14 20:23:18.0408 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2010/10/14 20:23:18.0483 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/10/14 20:23:18.0625 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2010/10/14 20:23:18.0691 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2010/10/14 20:23:18.0835 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2010/10/14 20:23:18.0996 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2010/10/14 20:23:19.0110 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2010/10/14 20:23:19.0148 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2010/10/14 20:23:19.0272 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2010/10/14 20:23:19.0323 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2010/10/14 20:23:19.0416 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2010/10/14 20:23:19.0480 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2010/10/14 20:23:19.0663 NETw4v32 (6522dd40a5f67ced020bd81b856613fb) C:\Windows\system32\DRIVERS\NETw4v32.sys
2010/10/14 20:23:19.0894 NETw5v32 (8de67bd902095a13329fd82c85a1fa09) C:\Windows\system32\DRIVERS\NETw5v32.sys
2010/10/14 20:23:20.0015 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2010/10/14 20:23:20.0072 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2010/10/14 20:23:20.0198 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2010/10/14 20:23:20.0295 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2010/10/14 20:23:20.0431 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2010/10/14 20:23:20.0455 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2010/10/14 20:23:20.0497 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
2010/10/14 20:23:20.0595 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
2010/10/14 20:23:20.0635 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
2010/10/14 20:23:20.0793 O2MDRDR (d51942f12090fc947ca8aa01736dade2) C:\Windows\system32\DRIVERS\o2media.sys
2010/10/14 20:23:20.0933 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2010/10/14 20:23:20.0988 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2010/10/14 20:23:21.0109 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2010/10/14 20:23:21.0146 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2010/10/14 20:23:21.0281 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2010/10/14 20:23:21.0344 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys
2010/10/14 20:23:21.0411 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
2010/10/14 20:23:21.0510 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2010/10/14 20:23:21.0850 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2010/10/14 20:23:22.0067 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
2010/10/14 20:23:22.0244 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2010/10/14 20:23:22.0303 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\Windows\system32\Drivers\PxHelp20.sys
2010/10/14 20:23:22.0501 QIOMem (674eba70a52c02696e503b0a57ae6372) C:\Windows\system32\DRIVERS\QIOMem.sys
2010/10/14 20:23:22.0720 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
2010/10/14 20:23:22.0897 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2010/10/14 20:23:23.0076 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2010/10/14 20:23:23.0187 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2010/10/14 20:23:23.0305 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2010/10/14 20:23:23.0421 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2010/10/14 20:23:23.0526 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2010/10/14 20:23:23.0614 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2010/10/14 20:23:23.0698 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/10/14 20:23:23.0740 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
2010/10/14 20:23:23.0759 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2010/10/14 20:23:23.0831 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2010/10/14 20:23:23.0944 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2010/10/14 20:23:24.0002 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2010/10/14 20:23:24.0153 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2010/10/14 20:23:24.0288 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2010/10/14 20:23:24.0337 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2010/10/14 20:23:24.0387 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2010/10/14 20:23:24.0441 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2010/10/14 20:23:24.0565 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
2010/10/14 20:23:24.0589 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
2010/10/14 20:23:24.0660 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
2010/10/14 20:23:24.0758 sfloppy (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\drivers\sfloppy.sys
2010/10/14 20:23:24.0827 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
2010/10/14 20:23:24.0920 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
2010/10/14 20:23:24.0998 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
2010/10/14 20:23:25.0134 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2010/10/14 20:23:25.0212 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2010/10/14 20:23:25.0361 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2010/10/14 20:23:25.0506 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2010/10/14 20:23:25.0546 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2010/10/14 20:23:25.0700 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2010/10/14 20:23:25.0741 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2010/10/14 20:23:25.0764 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2010/10/14 20:23:25.0876 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2010/10/14 20:23:25.0942 SynTP (91ac243740ca09a907e7cbd2da274c96) C:\Windows\system32\DRIVERS\SynTP.sys
2010/10/14 20:23:26.0103 Tcpip (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\drivers\tcpip.sys
2010/10/14 20:23:26.0249 Tcpip6 (a474879afa4a596b3a531f3e69730dbf) C:\Windows\system32\DRIVERS\tcpip.sys
2010/10/14 20:23:26.0368 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
2010/10/14 20:23:26.0489 tdcmdpst (1825bceb47bf41c5a9f0e44de82fc27a) C:\Windows\system32\DRIVERS\tdcmdpst.sys
2010/10/14 20:23:26.0542 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2010/10/14 20:23:26.0653 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2010/10/14 20:23:26.0720 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2010/10/14 20:23:26.0839 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2010/10/14 20:23:27.0047 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:\Windows\system32\DRIVERS\tosrfec.sys
2010/10/14 20:23:27.0182 tos_sps32 (1ea5f27c29405bf49799feca77186da9) C:\Windows\system32\DRIVERS\tos_sps32.sys
2010/10/14 20:23:27.0252 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2010/10/14 20:23:27.0343 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2010/10/14 20:23:27.0392 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2010/10/14 20:23:27.0438 TVALZ (792a8b80f8188aba4b2be271583f3e46) C:\Windows\system32\DRIVERS\TVALZ_O.SYS
2010/10/14 20:23:27.0554 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
2010/10/14 20:23:27.0610 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2010/10/14 20:23:27.0836 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
2010/10/14 20:23:27.0943 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
2010/10/14 20:23:28.0027 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2010/10/14 20:23:28.0122 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2010/10/14 20:23:28.0177 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2010/10/14 20:23:28.0293 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\Windows\system32\Drivers\usbaapl.sys
2010/10/14 20:23:28.0358 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/10/14 20:23:28.0445 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2010/10/14 20:23:28.0508 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2010/10/14 20:23:28.0546 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2010/10/14 20:23:28.0659 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2010/10/14 20:23:28.0704 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2010/10/14 20:23:28.0821 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/10/14 20:23:28.0850 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/10/14 20:23:28.0898 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
2010/10/14 20:23:29.0027 UVCFTR (8c5094a8ab24de7496c7c19942f2df04) C:\Windows\system32\Drivers\UVCFTR_S.SYS
2010/10/14 20:23:29.0079 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/10/14 20:23:29.0106 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2010/10/14 20:23:29.0216 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
2010/10/14 20:23:29.0261 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
2010/10/14 20:23:29.0370 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
2010/10/14 20:23:29.0419 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2010/10/14 20:23:29.0548 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2010/10/14 20:23:29.0611 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2010/10/14 20:23:29.0721 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
2010/10/14 20:23:29.0774 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2010/10/14 20:23:29.0826 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/14 20:23:29.0843 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/14 20:23:29.0954 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
2010/10/14 20:23:29.0989 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2010/10/14 20:23:30.0133 winachsf (0acd399f5db3df1b58903cf4949ab5a8) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
2010/10/14 20:23:30.0296 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/10/14 20:23:30.0370 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2010/10/14 20:23:30.0520 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/10/14 20:23:30.0561 XAudio (dab33cfa9dd24251aaa389ff36b64d4b) C:\Windows\system32\DRIVERS\xaudio.sys
2010/10/14 20:23:30.0621 yukonwlh (d51febb9f6869512ea2b636e2b30df7b) C:\Windows\system32\DRIVERS\yk60x86.sys
2010/10/14 20:23:30.0676 ================================================================================
2010/10/14 20:23:30.0676 Scan finished
2010/10/14 20:23:30.0676 ================================================================================
2010/10/14 20:23:33.0847 Deinitialize success

Je coupe ce soir....

RAS sur le dernier scan....

DESACTIVE TON ANTIVIRUS ET TON PAREFEU SI PRESENTS !!!!!(car il est detecté a tort comme infection)

Télécharge List_Kill'em et enregistre le sur ton bureau

http://sd-4.archive-host.com/membres/up/829108531491024/Mes_Tools/List_Killem_Install.exe

double clique ( clic droit "executer en tant qu'administrateur" pour Vista/7 ) sur le raccourci sur ton bureau pour lancer l'installation

une fois terminée , clic sur "terminer" et le programme se lancera seul

choisis choisis l'option Search

un icone blanc et noir va s'afficher sur le bureau , il te servira à rappeler le programme si besoin.

laisse travailler l'outil

à l'apparition de la fenetre blanche , c'est un peu long , c'est normal , le programme n'est pas bloqué.

un rapport du nom de catchme apparait sur ton bureau , ignore-le,ne le poste pas , , il s'auto supprimera a la fin du scan

Poste le contenu du rapport qui s'ouvre aux 100 % du scan à l'ecran "COMPLETED"

coucou

¤¤¤¤¤¤¤¤¤¤ List'em by g3n-h@ckm@n 2.1.1.0 ¤¤¤¤¤¤¤¤¤¤

User : TOSHIBA (Administrateurs)
Update on 13/10/2010 by g3n-h@ckm@n ::::: 19.00
Start at: 21:41:52 | 14/10/2010

Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18975
Windows Firewall Status : Disabled

C:\ -> Disque fixe local | 149,41 Go (65,17 Go free) [Vista] | NTFS
E:\ -> Disque fixe local | 147,21 Go (131,41 Go free) [Data] | NTFS
F:\ -> Disque CD-ROM

Boot: Normal

¤¤¤¤¤¤ Processes ------- Memory(Ko) ------- Priority ------ Command ------- Signer

C:\Windows\System32\smss.exe ---- 720 Ko ---- Normal ---- \SystemRoot\System32\smss.exe ----
C:\Windows\system32\csrss.exe ---- 6676 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\csrss.exe ---- 8308 Ko ---- Normal ---- C:\Windows\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ----
C:\Windows\system32\wininit.exe ---- 3796 Ko ---- High ---- wininit.exe ----
C:\Windows\system32\services.exe ---- 6784 Ko ---- Normal ---- C:\Windows\system32\services.exe ----
C:\Windows\system32\lsass.exe ---- 2588 Ko ---- Normal ---- C:\Windows\system32\lsass.exe ----
C:\Windows\system32\lsm.exe ---- 3868 Ko ---- Normal ---- C:\Windows\system32\lsm.exe ----
C:\Windows\system32\svchost.exe ---- 6092 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k DcomLaunch ----
C:\Windows\system32\winlogon.exe ---- 5616 Ko ---- High ---- winlogon.exe ----
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe ---- 10392 Ko ---- Normal ---- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe ---- Microsoft Corporation
C:\Windows\system32\svchost.exe ---- 6936 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k rpcss ----
C:\Program Files\Microsoft Security Essentials\MsMpEng.exe ---- 73680 Ko ---- Normal ---- "C:\Program Files\Microsoft Security Essentials\MsMpEng.exe" ---- Microsoft Corporation
C:\Windows\system32\Ati2evxx.exe ---- 3956 Ko ---- Normal ---- C:\Windows\system32\Ati2evxx.exe ----
C:\Windows\System32\svchost.exe ---- 12768 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted ----
C:\Windows\System32\svchost.exe ---- 80628 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted ----
C:\Windows\system32\svchost.exe ---- 25056 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k netsvcs ----
C:\Windows\system32\svchost.exe ---- 4548 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k GPSvcGroup ----
C:\Windows\system32\SLsvc.exe ---- 9888 Ko ---- Normal ---- C:\Windows\system32\SLsvc.exe ----
C:\Windows\system32\svchost.exe ---- 12580 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalService ----
C:\Windows\system32\Ati2evxx.exe ---- 6164 Ko ---- Normal ---- Ati2evxx.exe -Client ----
C:\Windows\system32\svchost.exe ---- 18184 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkService ----
C:\Windows\System32\spoolsv.exe ---- 11404 Ko ---- Normal ---- C:\Windows\System32\spoolsv.exe ----
C:\Windows\system32\svchost.exe ---- 17488 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork ----
C:\Windows\system32\Dwm.exe ---- 47232 Ko ---- High ---- "C:\Windows\system32\Dwm.exe" ----
C:\Windows\system32\taskeng.exe ---- 5724 Ko ---- Below Normal ---- taskeng.exe {BB817E8D-3B4F-459B-89DC-330E423CB960} ----
C:\Windows\Explorer.EXE ---- 56024 Ko ---- Normal ---- C:\Windows\Explorer.EXE ----
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe ---- 7384 Ko ---- Normal ---- "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe" ----
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ---- 11900 Ko ---- Above Normal ---- "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ---- Synaptics Incorporated
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe ---- 5832 Ko ---- Normal ---- "C:\Program Files\Toshiba\Power Saver\TPwrMain.exe" ---- TOSHIBA CORPORATION
C:\Program Files\Toshiba\SmoothView\SmoothView.exe ---- 3004 Ko ---- Normal ---- "C:\Program Files\Toshiba\SmoothView\SmoothView.exe" ---- TOSHIBA CORPORATION
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe ---- 9632 Ko ---- Normal ---- "C:\Program Files\Toshiba\FlashCards\TCrdMain.exe" ----
C:\Program Files\Common Files\Java\Java Update\jusched.exe ---- 3708 Ko ---- Normal ---- "C:\Program Files\Common Files\Java\Java Update\jusched.exe" ---- Sun Microsystems, Inc.
C:\Program Files\Microsoft Security Essentials\msseces.exe ---- 12808 Ko ---- Normal ---- "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey ---- Microsoft Corporation
E:\i tunes\iTunesHelper.exe ---- 11352 Ko ---- Normal ---- "E:\i tunes\iTunesHelper.exe" ---- Apple Inc.
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE ---- 5600 Ko ---- Normal ---- "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE" ----
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe ---- 3488 Ko ---- Normal ---- "C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe" ----
C:\Program Files\Windows Media Player\wmpnscfg.exe ---- 4888 Ko ---- Normal ---- "C:\Program Files\Windows Media Player\wmpnscfg.exe" ----
C:\Windows\system32\taskeng.exe ---- 10440 Ko ---- Normal ---- taskeng.exe {7C8ED256-6AA9-434B-BFAA-C2DAFC67A952} ----
C:\Program Files\OpenOffice.org 3\program\soffice.exe ---- 2772 Ko ---- Normal ---- "C:\Program Files\OpenOffice.org 3\program\soffice.exe" -quickstart ----
C:\Program Files\OpenOffice.org 3\program\soffice.bin ---- 19924 Ko ---- Normal ---- "C:\Program Files\OpenOffice.org 3\program\soffice.exe" "-quickstart" "-env:OOO_CWD=2C:\Program Files\OpenOffice.org 3\program" ----
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ---- 3620 Ko ---- Normal ---- "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" ---- Apple Inc.
C:\Program Files\Bonjour\mDNSResponder.exe ---- 4648 Ko ---- Normal ---- "C:\Program Files\Bonjour\mDNSResponder.exe" ---- Apple Inc.
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe ---- 2312 Ko ---- Normal ---- "C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe" ----
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe ---- 2420 Ko ---- Normal ---- "C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe" ----
C:\Windows\system32\svchost.exe ---- 5220 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted ----
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ---- 7888 Ko ---- Normal ---- "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" ---- Microsoft Corporation
C:\Windows\system32\svchost.exe ---- 5932 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k imgsvc ----
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe ---- 3028 Ko ---- Normal ---- "C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe" ---- TOSHIBA CORPORATION
C:\Windows\system32\TODDSrv.exe ---- 3540 Ko ---- Normal ---- C:\Windows\system32\TODDSrv.exe ---- TOSHIBA CORPORATION
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe ---- 4060 Ko ---- Normal ---- "C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe" ---- TOSHIBA CORPORATION
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe ---- 2472 Ko ---- Normal ---- "C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe" ----
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe ---- 1600 Ko ---- Normal ---- "C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe" ----
C:\Windows\System32\svchost.exe ---- 1912 Ko ---- Normal ---- C:\Windows\System32\svchost.exe -k WerSvcGroup ----
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ---- 8824 Ko ---- Normal ---- "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE" ---- Microsoft Corporation
C:\Windows\system32\SearchIndexer.exe ---- 16468 Ko ---- Normal ---- C:\Windows\system32\SearchIndexer.exe /Embedding ----
C:\Windows\system32\DRIVERS\xaudio.exe ---- 2424 Ko ---- Normal ---- C:\Windows\system32\DRIVERS\xaudio.exe ----
C:\Program Files\Spybot - Search & Destroy2\SDWinSec.exe ---- 8356 Ko ---- Normal ---- "C:\Program Files\Spybot - Search & Destroy2\SDWinSec.exe" ---- Safer Networking Ltd.
C:\Program Files\Windows Media Player\wmpnetwk.exe ---- 8084 Ko ---- Normal ---- "C:\Program Files\Windows Media Player\wmpnetwk.exe" ----
C:\Program Files\iPod\bin\iPodService.exe ---- 5028 Ko ---- Normal ---- "C:\Program Files\iPod\bin\iPodService.exe" ---- Apple Inc.
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe ---- 15968 Ko ---- Normal ---- "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0 ----
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe ---- 2688 Ko ---- Normal ---- WLIDSvcM.exe 3640 ---- Microsoft Corporation
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe ---- 7716 Ko ---- Normal ---- "C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe" ----
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe ---- 2668 Ko ---- Above Normal ---- "C:\Program Files\Synaptics\SynTP\SynTPHelper.exe" ---- Synaptics Incorporated
C:\Windows\system32\svchost.exe ---- 14168 Ko ---- Normal ---- C:\Windows\system32\svchost.exe -k netsvcs ----
C:\Windows\system32\conime.exe ---- 3428 Ko ---- Normal ---- C:\Windows\system32\conime.exe ----
C:\Program Files\Mozilla Firefox\firefox.exe ---- 89676 Ko ---- Normal ---- "C:\Program Files\Mozilla Firefox\firefox.exe" ---- Mozilla Corporation
C:\Windows\system32\SearchProtocolHost.exe ---- 8216 Ko ---- Idle ---- "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" ----
C:\Windows\system32\SearchFilterHost.exe ---- 6700 Ko ---- Idle ---- "C:\Windows\system32\SearchFilterHost.exe" 0 620 624 632 65536 628 ----
C:\Windows\system32\cmd.exe ---- 2428 Ko ---- Normal ---- C:\Windows\system32\cmd.exe /K List'em.bat ----
C:\Windows\system32\wbem\wmiprvse.exe ---- 9496 Ko ---- Normal ---- C:\Windows\system32\wbem\wmiprvse.exe ----
C:\Windows\system32\DllHost.exe ---- 4192 Ko ---- Normal ---- C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} ----
C:\Program Files\List_Kill'em\pv.exe ---- 5796 Ko ---- Normal ---- pv -o"%f ---- %m Ko ---- %p ---- %l ---- %s" ----

¤¤¤¤¤¤¤¤¤¤ Keys "Run" ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
TOSCDSPD = TOSCDSPD.EXE
AdobeUpdater = C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Windows Defender = %ProgramFiles%\Windows Defender\MSASCui.exe -hide
NDSTray.exe = NDSTray.exe
ITSecMng = %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
StartCCC = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
TPwrMain = %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
HSON = %ProgramFiles%\TOSHIBA\TBS\HSON.exe
SmoothView = %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
00TCrdMain = %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
AppleSyncNotifier = C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSSE = "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide -runkey
QuickTime Task = "C:\Program Files\QuickTime\QTTask.exe" -atboottime
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\avp6_post_uninstall

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

¤¤¤¤¤¤¤¤¤¤ Other System Keys ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
BindDirectlyToPropertySetStorage = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Shell = explorer.exe
Userinit = C:\Windows\system32\userinit.exe,

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igfxcui]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

¤¤¤¤¤¤¤¤¤¤ ActivX | COM ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{4F1E5B1A-2A80-42CA-8532-2D05CB959537}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8AD9C840-044E-11D1-B3E9-00805F499D93}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}]
[HKEY_LOCAL_MACHINE\software\microsoft\code store database\distribution units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{26923b43-4d38-484f-9b9e-de460746276c}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{8AA6CB35-67D7-45A2-B1F4-C87EC19E4522}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3af36230-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3C3901C5-3455-3E0A-A214-0B093A5070A6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{49CA1D94-9819-2AE3-C78A-745F62821123}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4BC3A34E-5F81-E0E7-09D7-545C9A3A59B6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C9E9A340-D1F1-11D0-821E-444553540600}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{F3856149-0030-B6F9-7156-70D77A0C398F}]

¤¤¤¤¤¤¤¤¤¤ BHO ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{53707962-6F74-2D53-2644-206D7942484F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

¤¤¤¤¤¤¤¤¤¤ DNS ¤¤¤¤¤¤¤¤¤¤

HKLM\SYSTEM\CCS\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: NameServer=213.150.176.196,193.95.66.11
HKLM\SYSTEM\CCS\Services\Tcpip\..\{908CC2BD-2503-4DE9-B644-301782171774}: NameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: NameServer=213.150.176.196,193.95.66.11
HKLM\SYSTEM\CS1\Services\Tcpip\..\{908CC2BD-2503-4DE9-B644-301782171774}: NameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{49706FFC-A29C-4D54-9F44-5C988A2E4B4F}: NameServer=213.150.176.196,193.95.66.11
HKLM\SYSTEM\CS3\Services\Tcpip\..\{908CC2BD-2503-4DE9-B644-301782171774}: NameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\System32\blank.htm
Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr
Local Page = C:\Windows\system32\blank.htm

¤¤¤¤¤ Proxy Internet Explorer

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
ProxyEnable = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤ Proxy Firefox ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ TaskCache ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\Apple]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\GoogleUpdateTaskMachineCore]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\GoogleUpdateTaskMachineUA]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\Microsoft]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\User_Feed_Synchronization-{5B940481-4E2D-4DFD-B19D-AD0EBF35E6B7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\WPD]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{1DACEF84-E7F1-426E-8AAB-2E331A2E01DF}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{27E34633-CD05-4F09-8824-0871D9510C42}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{2FF885D2-F516-4C51-8580-ED73BD4874A0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{47FEA832-436F-4F04-A6A4-9545ABD324C5}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{5AC9E0EE-593F-4E84-9181-9DEFC533BB62}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{69A45A1F-662F-4012-B32C-EFFB6FDF6FD7}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{893EBBB2-280B-4E80-A1D0-D06741643BA9}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{8E3FB882-A5DD-4D04-B724-510F1291B7F8}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{A6E49E88-6FF1-4294-8F88-FB15ADF75AA4}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\schedule\taskcache\tree\{EFBBDF96-B4F1-46B1-97B6-29E57040F0DC}]

¤¤¤¤¤¤¤¤¤¤ IFEO ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\AcroRd32.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DllNXOptions]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\IEInstal.exe]

¤¤¤¤¤¤¤¤¤¤ File Protection ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection]
KnownDllList = nlhtml.dll

¤¤¤¤¤¤¤¤¤¤ Safemode ¤¤¤¤¤¤¤¤¤¤

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal : OK !!
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network : OK !!

¤¤¤¤¤¤¤¤¤¤ Atapi.sys ¤¤¤¤¤¤¤¤¤¤

[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\System32\drivers\atapi.sys
[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[MD5.4f4fcb8b6ea06784fb6d475b7ec7300f] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[MD5.2d9c903dc76a66813d350a562de40ed9] - C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[MD5.2d9c903dc76a66813d350a562de40ed9] - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[MD5.1f05b78ab91c9075565a9d8a4b880bc4] - C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys

¤¤¤¤¤ Reference

Win 2000_SP2 : ff953a8f08ca3f822127654375786bbe
Win 2000_SP4 : 8c718aa8c77041b3285d55a0ce980867
Win XP_32b : a64013e98426e1877cb653685c5c0009
Win XP_SP1_32b : 95b858761a00e1d4f81f79a0da019aca
Win XP_SP2_32b : CDFE4411A69C224BD1D11B2DA92DAC51
Win XP_SP3_32b : 9F3A2F5AA6875C72BF062C712CFA2674
Vista_32b : e03e8c99d15d0381e02743c36afc7c6f
Vista_SP1_32b : 2d9c903dc76a66813d350a562de40ed9
Vista_SP2_32b : 1F05B78AB91C9075565A9D8A4B880BC4
Vista_SP2_64b : 1898FAE8E07D97F2F6C2D5326C633FAC
Windows 7_32b : 338c86357871c167a96ab976519bf59e
Windows 7_64b : 02062C0B390B7729EDC9E69C680A6F3C

¤¤¤¤¤¤¤¤¤¤ Explorer ¤¤¤¤¤¤¤¤¤¤

[MD5.d07d4c3038f3578ffce1c0237f2a1253] - C:\Windows\explorer.exe
[MD5.37440d09deae0b672a04dccf7abf06be] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[MD5.e7156b0b74762d9de0e66bdcde06e5fb] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[MD5.ffa764631cb70a30065c12ef8e174f9f] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
[MD5.4f554999d7d5f05daaebba7b5ba1089d] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[MD5.50ba5850147410cde89c523ad3bc606e] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[MD5.d07d4c3038f3578ffce1c0237f2a1253] - C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

¤¤¤¤¤¤¤¤¤¤ Winlogon ¤¤¤¤¤¤¤¤¤¤

[MD5.898e7c06a350d4a1a64a9ea264d55452] - C:\Windows\System32\winlogon.exe
[MD5.c2610b6bdbefc053bbdab4f1b965cb24] - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
[MD5.898e7c06a350d4a1a64a9ea264d55452] - C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

¤¤¤¤¤¤¤¤¤¤ Drive ¤¤¤¤¤¤¤¤¤¤

D'fragmenteur de disque Windows
Copyright (c) 2006 Microsoft Corp.

Rapport d'analyse pour le volume C: Vista

Taille du volume = 149 Go
Espace libre = 65.19 Go
tendue d'espace libre la plus grande = 47.16 Go
Pourcentage de fragmentation des fichiers = 3 %

Remarqueÿ: sur les volumes NTFS, les fragments de fichiers de plus de 64ÿMo ne sont pas inclus dans les statistiques de fragmentation.

Il n'est pas n'cessaire de d'fragmenter ce volume.

¤¤¤¤¤¤¤¤¤¤ Mountpoints2 ¤¤¤¤¤¤¤¤¤¤

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36e3a885-96d6-11dd-8cee-001e684cac79}\shell\autorun
ShellExecute = bounenni.exe
@ = Installer ou exécuter un programme
SetWorkingDirectoryFromTarget =
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36e3a885-96d6-11dd-8cee-001e684cac79}\shell\autorun\command
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36e3a885-96d6-11dd-8cee-001e684cac79}\shell\autorun\command
@ = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bounenni.exe

¤¤¤¤¤¤¤¤¤¤ First Scan ¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

[@ = ]
[HKEY_CURRENT_USER\software\AC3filter]
[HKEY_CURRENT_USER\software\Ad-Remover]
[HKEY_CURRENT_USER\software\Adobe]
[HKEY_CURRENT_USER\software\Andrew Zhezherun]
[HKEY_CURRENT_USER\software\AppDataLow]
[HKEY_CURRENT_USER\software\Apple Computer, Inc.]
[HKEY_CURRENT_USER\software\Apple Inc.]
[HKEY_CURRENT_USER\software\ATI]
[HKEY_CURRENT_USER\software\ATI Technologies Inc.]
[HKEY_CURRENT_USER\software\Audacity]
[HKEY_CURRENT_USER\software\Big Fish Games]
[HKEY_CURRENT_USER\software\CDDB]
[HKEY_CURRENT_USER\software\CEC_CM_SW]
[HKEY_CURRENT_USER\software\Clients]
[HKEY_CURRENT_USER\software\ComodoGroup]
[HKEY_CURRENT_USER\software\COOPP]
[HKEY_CURRENT_USER\software\Cyberlink]
[HKEY_CURRENT_USER\software\DivXNetworks]
[HKEY_CURRENT_USER\software\ESET]
[HKEY_CURRENT_USER\software\F-Secure]
[HKEY_CURRENT_USER\software\Gabest]
[HKEY_CURRENT_USER\software\GameHouse]
[HKEY_CURRENT_USER\software\GNU]
[HKEY_CURRENT_USER\software\Google]
[HKEY_CURRENT_USER\software\Haali]
[HKEY_CURRENT_USER\software\HaaliMkx]
[HKEY_CURRENT_USER\software\IDAVLab]
[HKEY_CURRENT_USER\software\IM Providers]
[HKEY_CURRENT_USER\software\JavaSoft]
[HKEY_CURRENT_USER\software\JEDI-VCL]
[HKEY_CURRENT_USER\software\JollyBear]
[HKEY_CURRENT_USER\software\KasperskyLab]
[HKEY_CURRENT_USER\software\keyhole.com]
[HKEY_CURRENT_USER\software\Laventure]
[HKEY_CURRENT_USER\software\Local AppWizard-Generated Applications]
[HKEY_CURRENT_USER\software\Macromedia]
[HKEY_CURRENT_USER\software\Malwarebytes' Anti-Malware]
[HKEY_CURRENT_USER\software\Microsoft]
[HKEY_CURRENT_USER\software\Mozilla]
[HKEY_CURRENT_USER\software\Nektra]
[HKEY_CURRENT_USER\software\Netscape]
[HKEY_CURRENT_USER\software\Northcode Inc]
[HKEY_CURRENT_USER\software\Oberon Media]
[HKEY_CURRENT_USER\software\ODBC]
[HKEY_CURRENT_USER\software\OpenOffice.org]
[HKEY_CURRENT_USER\software\Opera Software]
[HKEY_CURRENT_USER\software\PDFCreator]
[HKEY_CURRENT_USER\software\PhotoFiltre]
[HKEY_CURRENT_USER\software\Piriform]
[HKEY_CURRENT_USER\software\pixelStorm]
[HKEY_CURRENT_USER\software\Plantasia]
[HKEY_CURRENT_USER\software\Policies]
[HKEY_CURRENT_USER\software\QuickTime Alternative]
[HKEY_CURRENT_USER\software\Raptisoft]
[HKEY_CURRENT_USER\software\RealNetworks]
[HKEY_CURRENT_USER\software\Safer Networking Limited]
[HKEY_CURRENT_USER\software\SFX TEAM]
[HKEY_CURRENT_USER\software\Skype]
[HKEY_CURRENT_USER\software\Sunbelt Software]
[HKEY_CURRENT_USER\software\Synaptics]
[HKEY_CURRENT_USER\software\TOSHIBA]
[HKEY_CURRENT_USER\software\ToyBox]
[HKEY_CURRENT_USER\software\Trolltech]
[HKEY_CURRENT_USER\software\VirginMega]
[HKEY_CURRENT_USER\software\WinRAR]
[HKEY_CURRENT_USER\software\WinRAR SFX]
[HKEY_CURRENT_USER\software\YahooPartnerToolbar]
[HKEY_CURRENT_USER\software\zylom]
[HKEY_CURRENT_USER\software\Classes]

[@ = ]
[HKEY_LOCAL_MACHINE\software\Adobe]
[HKEY_LOCAL_MACHINE\software\America Online]
[HKEY_LOCAL_MACHINE\software\Apple Computer, Inc.]
[HKEY_LOCAL_MACHINE\software\Apple Inc.]
[HKEY_LOCAL_MACHINE\software\ATI]
[HKEY_LOCAL_MACHINE\software\ATI Technologies]
[HKEY_LOCAL_MACHINE\software\Big Fish Games]
[HKEY_LOCAL_MACHINE\software\BVRP Software, Inc]
[HKEY_LOCAL_MACHINE\software\CCleaner]
[HKEY_LOCAL_MACHINE\software\CDDB]
[HKEY_LOCAL_MACHINE\software\Chicony Electronics Co.,Ltd.]
[HKEY_LOCAL_MACHINE\software\Classes]
[HKEY_LOCAL_MACHINE\software\Clients]
[HKEY_LOCAL_MACHINE\software\Conexant]
[HKEY_LOCAL_MACHINE\software\Conexant Systems Inc ]
[HKEY_LOCAL_MACHINE\software\CXT]
[HKEY_LOCAL_MACHINE\software\Cyberlink]
[HKEY_LOCAL_MACHINE\software\Data Fellows]
[HKEY_LOCAL_MACHINE\software\Debug]
[HKEY_LOCAL_MACHINE\software\DivXNetworks]
[HKEY_LOCAL_MACHINE\software\ESET]
[HKEY_LOCAL_MACHINE\software\GEAR Software]
[HKEY_LOCAL_MACHINE\software\GNU]
[HKEY_LOCAL_MACHINE\software\Google]
[HKEY_LOCAL_MACHINE\software\HaaliMkx]
[HKEY_LOCAL_MACHINE\software\Havas Medimedia]
[HKEY_LOCAL_MACHINE\software\Hewlett-Packard]
[HKEY_LOCAL_MACHINE\software\IDAVLab]
[HKEY_LOCAL_MACHINE\software\InstalledOptions]
[HKEY_LOCAL_MACHINE\software\InstallShield]
[HKEY_LOCAL_MACHINE\software\Intel]
[HKEY_LOCAL_MACHINE\software\InterVideo]
[HKEY_LOCAL_MACHINE\software\JavaSoft]
[HKEY_LOCAL_MACHINE\software\JreMetrics]
[HKEY_LOCAL_MACHINE\software\KLCodecPack]
[HKEY_LOCAL_MACHINE\software\Licenses]
[HKEY_LOCAL_MACHINE\software\Lucent]
[HKEY_LOCAL_MACHINE\software\Macromedia]
[HKEY_LOCAL_MACHINE\software\Malwarebytes' Anti-Malware]
[HKEY_LOCAL_MACHINE\software\Marvell]
[HKEY_LOCAL_MACHINE\software\Micro Application]
[HKEY_LOCAL_MACHINE\software\Microsoft]
[HKEY_LOCAL_MACHINE\software\MimarSinan]
[HKEY_LOCAL_MACHINE\software\Mozilla]
[HKEY_LOCAL_MACHINE\software\mozilla.org]
[HKEY_LOCAL_MACHINE\software\MozillaPlugins]
[HKEY_LOCAL_MACHINE\software\Netscape]
[HKEY_LOCAL_MACHINE\software\NOS]
[HKEY_LOCAL_MACHINE\software\Nullsoft]
[HKEY_LOCAL_MACHINE\software\ODBC]
[HKEY_LOCAL_MACHINE\software\OldTimer Tools]
[HKEY_LOCAL_MACHINE\software\On2 Technologies]
[HKEY_LOCAL_MACHINE\software\OpenOffice.org]
[HKEY_LOCAL_MACHINE\software\Opera Software]
[HKEY_LOCAL_MACHINE\software\OVP]
[HKEY_LOCAL_MACHINE\software\Panda Software]
[HKEY_LOCAL_MACHINE\software\PDFCreator]
[HKEY_LOCAL_MACHINE\software\Piriform]
[HKEY_LOCAL_MACHINE\software\Plantasia]
[HKEY_LOCAL_MACHINE\software\Policies]
[HKEY_LOCAL_MACHINE\software\RealNetworks]
[HKEY_LOCAL_MACHINE\software\ReflexiveArcade]
[HKEY_LOCAL_MACHINE\software\RegisteredApplications]
[HKEY_LOCAL_MACHINE\software\RtWLan]
[HKEY_LOCAL_MACHINE\software\S3R521]
[HKEY_LOCAL_MACHINE\software\Safer Networking Limited]
[HKEY_LOCAL_MACHINE\software\Sandlot Games]
[HKEY_LOCAL_MACHINE\software\Skype]
[HKEY_LOCAL_MACHINE\software\Sonic]
[HKEY_LOCAL_MACHINE\software\Sun Microsystems]
[HKEY_LOCAL_MACHINE\software\Sunbelt Software]
[HKEY_LOCAL_MACHINE\software\Synaptics]
[HKEY_LOCAL_MACHINE\software\Sys Modules]
[HKEY_LOCAL_MACHINE\software\TOSHIBA]
[HKEY_LOCAL_MACHINE\software\TrendMicro]
[HKEY_LOCAL_MACHINE\software\Ulead Systems]
[HKEY_LOCAL_MACHINE\software\VIDAL]
[HKEY_LOCAL_MACHINE\software\Vidal Expert]
[HKEY_LOCAL_MACHINE\software\VideoLAN]
[HKEY_LOCAL_MACHINE\software\Windows]
[HKEY_LOCAL_MACHINE\software\WinRAR]
[HKEY_LOCAL_MACHINE\software\WOW6432Node]
[HKEY_LOCAL_MACHINE\software\Zone Labs]

¤¤¤¤¤¤¤¤¤¤ Files/folders ¤¤¤¤¤¤¤¤¤¤

Present !! : C:\Windows\System32\dumphive.exe
Present !! : C:\Windows\System32\Process.exe
Present !! : C:\Windows\System32\SrchSTS.exe
Present !! : C:\Windows\System32\tmp.reg
Present !! : C:\Windows\System32\VCCLSID.exe
Present !! : C:\Windows\System32\WS2Fix.exe
Present !! : C:\Users\TOSHIBA\AppData\Local\d3d9caps.dat
Present !! : C:\Users\TOSHIBA\AppData\Local\GDIPFONTCACHEV1.DAT

¤¤¤¤¤¤¤¤¤¤ Keys :

Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableRegistryTools
Present !! : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Present !! : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Present !! : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b922d405-6d13-4a2b-ae89-08a030da4402}
Present !! : HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Present !! : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_mpnwmon
Present !! : HKLM\SYSTEM\CurrentControlSet\Services\mpnwmon
Present !! : HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_mpnwmon
Present !! : HKLM\SYSTEM\ControlSet001\Services\mpnwmon
Present !! : HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_mpnwmon
Present !! : HKLM\SYSTEM\ControlSet003\Services\mpnwmon

FEATURE_BROWSER_EMULATION | svchost :
====================================

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

catchme 0.3.1398.3 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-14 21:49:42
Windows 6.0.6002 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !

¤¤¤¤¤¤¤¤¤¤ Programs ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval = 1 (0x1)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

End of scan : 21:51:25,40

Relance List_Kill'em(soit en clic droit pour vista/7),avec le raccourci sur ton bureau.
mais cette fois-ci :

choisis l'option clean

ton PC va redemarrer,

laisse travailler l'outil.

en fin de scan la fenetre se ferme , et tu as un rapport du nom de Kill'em.txt sur ton bureau ,

colle le contenu dans ta reponse

¤¤¤¤¤¤¤¤¤¤ Kill'em by g3n-h@ckm@n 2.1.1.0 ¤¤¤¤¤¤¤¤¤¤

User : TOSHIBA (Administrateurs)
Update on 13/10/2010 by g3n-h@ckm@n ::::: 19.00
Start at: 21:03:54 | 15/10/2010

Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6002 32-bit) # Service Pack 2
Internet Explorer 8.0.6001.18975
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 149,41 Go (66,97 Go free) [Vista] | NTFS
E:\ -> Disque fixe local | 147,21 Go (131,41 Go free) [Data] | NTFS
F:\ -> Disque CD-ROM

¤¤¤¤¤¤¤¤¤¤ Files/folders :

Quarantined & Deleted !! : C:\Windows\System32\dumphive.exe
Quarantined & Deleted !! : C:\Windows\System32\Process.exe
Quarantined & Deleted !! : C:\Windows\System32\SrchSTS.exe
Quarantined & Deleted !! : C:\Windows\System32\tmp.reg
Quarantined & Deleted !! : C:\Windows\System32\VCCLSID.exe
Quarantined & Deleted !! : C:\Windows\System32\WS2Fix.exe
Quarantined & Deleted !! : C:\Users\TOSHIBA\AppData\Local\d3d9caps.dat
Quarantined & Deleted !! : C:\Users\TOSHIBA\AppData\Local\GDIPFONTCACHEV1.DAT

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

127.0.0.1 localhost

¤¤¤¤¤¤¤¤¤¤ Registry ¤¤¤¤¤¤¤¤¤¤

Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System : DisableRegistryTools
Deleted : HKCR\CLSID\{248dd896-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\CLSID\{248dd897-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}
Deleted : HKCR\Interface\{248dd892-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\Interface\{248dd893-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCR\TypeLib\{248dd890-bb45-11cf-9abc-0080c7e7b78d}
Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b922d405-6d13-4a2b-ae89-08a030da4402}
Deleted : HKLM\SYSTEM\CurrentControlSet\Services\mpnwmon
Deleted : HKLM\SYSTEM\ControlSet003\Services\mpnwmon

¤¤¤¤¤¤¤¤¤¤ Internet Explorer ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.msn.com/fr-fr/?ocid=iehp
Local Page = C:\WINDOWS\system32\blank.htm
Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page = https://www.google.com/?gws_rd=ssl
Local Page = C:\WINDOWS\system32\blank.htm
Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

¤¤¤¤¤¤¤¤¤¤ Security Center ¤¤¤¤¤¤¤¤¤¤

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval = 1 ()
FirstRunDisabled = 1 ()
AntiVirusDisableNotify = 0 (0x0)
FirewallDisableNotify = 0 (0x0)
UpdatesDisableNotify = 0 (0x0)
AntiVirusOverride = 0 (0x0)
FirewallOverride = 0 (0x0)

¤¤¤¤¤¤¤¤¤¤ Services ¤¤¤¤¤¤¤¤¤¤

Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

FEATURE_BROWSER_EMULATION | svchost :
====================================

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

Comment se comporte le pc?