Virus suznxlfd.dll impossible a suprimer

spes1340 -  
Bonjour, cela fait un certain moment que mon processus explorer.exe dépasser les 100K de mémoire j'ai fait une analyse et je suis tomber sur 2 virus :
-suznxlfd.dll.bak que j'ai pu supprimer seulement manuellement et en invite de cmd
-suznxlfd.dll MON PROBLÈME
j'ai essayer en mode sans échec même en arrêtant le processus explorer et svchost qui je pense sont lié et pour bien faire google ne connait pas ce virus!!

donc si vous avez des idées je suis preneur!! merci

10 réponses

  1. Utilisateur anonyme
    Bonsoir

    Pour de plus amples informations, fait ceci stp

    Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :

    https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

    Ou

    https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

    Serveur N°2

    Ou

    http://www.premiumorange.com/zeb-help-process/zhpdiag.html
    en bas de la page ZHP avec un numéro de version.

    Une fois le téléchargement achevé, dé zippe le fichier obtenu et place ZHPDiag.exe sur ton Bureau.

    Double-clique sur l'icône pour lancer le programme. Sous Vista ou Seven clic droit « exécuter en tant que administrateur »

    Clique sur la loupe pour lancer l'analyse.

    Laisse l'outil travailler, il peut être assez long.

    Ferme ZHPDiag en fin d'analyse.

    Pour transmettre le rapport clique sur ce lien :

    http://www.cijoint.fr/index.php
    Clique sur Parcourir et cherche le répertoire où est installé ZHPDiag (en général C:\Program Files\ZHPDiag).

    Sélectionne le fichier ZHPDiag.txt.

    Clique sur "Cliquez ici pour déposer le fichier".

    Un lien de cette forme :

    http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt

    est ajouté dans la page.

    Copie ce lien dans ta réponse.

    Merci

    A+
    0
    1. spes1340 Auteur
      merci pour ton aide voila le lien http://www.cijoint.fr/cjlink.php?file=cj201101/cijZ9PCKvb.txt
      0
      1. Utilisateur anonyme
        Ce n'est pas le bon rapport.

        Sélectionne le fichier ZHPDiag.txt.
        0
    2. spes1340 Auteur
      je m'en douter seulement avec le bon raport la page internet ne marche pas -_-'..
      0
      1. Utilisateur anonyme
        Re

        Passons à la taille supérieure;

        Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
        Ou ici : https://forospyware.com
        >Renomme le pour l'enregistrer sur ton bureau en asdehi (tout simplement pour que l'infection ne le contre pas)
        -> Double clique combofix.exe.(ou clic droit sous vista « exécuter en tant que... » )
        -> Tape sur la touche 1 (Yes) pour démarrer le scan.
        -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

        NOTE : Le rapport se trouve également ici : C:\Combofix.txt

        Avant d'utiliser ComboFix :

        -> Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.

        -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

        Une fois fait, sur ton bureau double-clic sur Combofix.exe ; (ou clic droit sous vista « exécuter en tant que... »)

        - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

        - Installe le console de récupération comme demandé ;utile en cas de plantage

        - Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur

        - En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

        - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

        -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

        -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

        /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\ : risque de figer l'ordinateur (plantage complet)

        ::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes

        @+
        0
        2. spes1340 Auteur
          re dsl pour le temp

          ComboFix 11-01-28.03 - Administrateur 29/01/2011 22:52:18.1.1 - x86
          Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1791.1357 [GMT 1:00]
          Lancé depuis: c:\documents and settings\Administrateur\Bureau\asdehi.exe
          AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

          AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
          .

          (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
          .

          c:\documents and settings\All Users\Application Data\boost_interprocess\20110112174412.500000
          c:\documents and settings\All Users\Application Data\hpe8E.dll
          c:\windows\system\VB40032.DLL
          c:\windows\system32\Desktop_.ini
          c:\windows\system32\drivers\clvpvkeh.sys
          c:\windows\system32\drivers\rjcoiejv.sys
          c:\windows\system32\sqvrkoue.dll
          c:\windows\system32\suznxlfd.dll

          c:\windows\regedit.exe . . . est infecté!!

          c:\windows\explorer.exe . . . est infecté!!

          c:\windows\system32\winlogon.exe . . . est infecté!!

          c:\windows\system32\proquota.exe . . . manque!!

          .
          ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
          .

          -------\Legacy_CLVPVKEH
          -------\Legacy_DUPPKQYI
          -------\Legacy_SVCHOST32
          -------\Service_clvpvkeh
          -------\Service_duppkqyi
          -------\Service_svchost32

          ((((((((((((((((((((((((((((( Fichiers créés du 2010-12-28 au 2011-01-29 ))))))))))))))))))))))))))))))))))))
          .

          2011-01-29 21:23 . 2011-01-29 21:29 -------- d-----w- c:\program files\ZHPDiag
          2011-01-16 10:05 . 2011-01-16 10:05 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Avira
          2011-01-16 10:03 . 2011-01-16 10:03 -------- d-----w- c:\program files\Avira
          2011-01-16 10:03 . 2011-01-16 10:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
          2011-01-16 10:03 . 2010-08-17 12:39 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
          2011-01-16 10:03 . 2010-06-17 14:28 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
          2011-01-16 10:03 . 2010-06-17 14:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
          2011-01-13 21:56 . 2011-01-13 21:56 -------- d-----w- C:\Adobe
          2011-01-13 19:31 . 2011-01-13 19:31 -------- d-sh--w- c:\windows\ftpcache
          2011-01-11 21:09 . 2011-01-29 22:04 -------- d-----w- c:\documents and settings\All Users\Application Data\boost_interprocess

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2011-01-13 20:09 . 2008-09-27 10:24 1573888 ----a-w- c:\windows\explorer.exe
          2011-01-13 14:54 . 2008-09-27 10:27 593408 ----a-w- c:\windows\system32\winlogon.exe
          2010-12-05 13:53 . 2010-12-05 13:35 2494464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1036\ResourceCache.dll
          2010-12-05 13:35 . 2010-12-05 13:35 18496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1036\ResourceCache.dll
          2010-12-05 13:35 . 2010-12-05 13:35 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll
          2010-12-05 13:14 . 2010-10-31 11:13 526452 ----a-w- c:\windows\system32\PerfStringBackup.TMP
          2010-11-19 12:07 . 2010-11-19 12:07 0 ----a-w- c:\windows\system32\alkB.tmp
          2010-11-19 12:06 . 2010-11-19 12:06 0 ----a-w- c:\windows\system32\alkA.tmp
          2010-11-19 12:05 . 2010-11-19 12:05 0 ----a-w- c:\windows\system32\alk9.tmp
          2010-11-19 12:05 . 2010-11-19 12:05 0 ----a-w- c:\windows\system32\alk8.tmp
          2010-11-19 12:04 . 2010-11-19 12:04 0 ----a-w- c:\windows\system32\alk7.tmp
          .

          ------- Sigcheck -------

          [-] 2008-09-27 10:24 . 0F350F1870E65C510FFFF60D7EE14BA8 . 1504256 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

          [-] 2011-01-13 . BBD1CCBA50AE14672AF7F282AF994CB4 . 593408 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

          [-] 2008-09-27 . AAC42FD16A1976DE9A0773E740597644 . 693248 . . [5.82] . . c:\windows\system32\comctl32.dll
          [7] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
          [7] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

          [-] 2008-09-27 . EF31A8266AF7996746392E4F45502536 . 517632 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

          [-] 2011-01-13 . DE5616F629E2B91EECD08FF4572B1EB3 . 1573888 . . [6.00.2900.5634] . . c:\windows\explorer.exe

          [-] 2008-09-27 . B3D95BCB6D0B033BEBFB81FADDA8B8AC . 37376 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

          [-] 2008-09-27 . A3CA2B158B645447964ADC84FA7E6EE6 . 2207872 . . [5.1.2600.5586] . . c:\windows\system32\ntkrnlpa.exe

          [-] 2008-09-27 . 65A2D2BD594EB3E670CECFFEED75FB69 . 2331008 . . [5.1.2600.5586] . . c:\windows\system32\ntoskrnl.exe
          .
          ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          .
          *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
          REGEDIT4

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
          "{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]

          [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
          2009-04-02 11:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

          [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
          2010-06-13 17:10 2734688 ----a-w- c:\program files\Softonic_France\tbSoft.dll

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
          "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
          "{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]

          [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
          [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

          [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
          "{4DAAC69C-CBA7-45E2-9BC8-1044483D3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
          "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

          [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

          [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
          [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
          "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
          "nwiz"="nwiz.exe" [2009-01-30 1657376]
          "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
          "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 86016]
          "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-06 159744]
          "AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-05-27 753664]
          "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]

          [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
          "JkDefrag"="advpack.dll" [2009-03-08 128512]
          "SweetRegistry"="advpack.dll" [2009-03-08 128512]

          [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
          "HideRunAsVerb"= 0 (0x0)
          "NoNetConnectDisconnect"= 1 (0x1)
          "NoResolveTrack"= 1 (0x1)

          [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
          "NoResolveTrack"= 1 (0x1)
          "NoSMBalloonTip"= 1 (0x1)
          "NoSMConfigurePrograms"= 1 (0x1)
          "NoSMHelp"= 1 (0x1)
          "NoStrCmpLogical"= 0 (0x0)
          "NoWelcomeScreen"= 1 (0x1)

          [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
          "ForceClassicControlPanel"= 1 (0x1)
          "NoResolveTrack"= 1 (0x1)
          "NoSMBalloonTip"= 1 (0x1)
          "NoSMConfigurePrograms"= 1 (0x1)
          "NoSMHelp"= 1 (0x1)
          "NoStrCmpLogical"= 0 (0x0)
          "NoWelcomeScreen"= 1 (0x1)

          [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
          2009-09-05 10:23 87352 ----a-w- c:\windows\system32\LMIinit.dll

          [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
          @="Driver"

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
          2005-05-03 01:43 69632 ----a-w- c:\windows\Alcmtr.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
          2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
          2007-08-24 05:00 33648 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
          2008-09-10 15:40 289576 ----a-w- c:\program files\iTunes\iTunesHelper.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
          2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
          2008-09-06 13:09 413696 ----a-w- c:\program files\QT Lite\QTTask.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
          2007-05-27 23:32 16132608 ----a-w- c:\windows\RTHDCPL.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
          2009-09-24 13:41 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperCopier2.exe]
          2005-03-13 23:37 1057280 ----a-w- c:\program files\SuperCopier2\SuperCopier2.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
          2008-06-29 22:01 52168 ----a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinMover]
          2005-12-02 20:33 10240 ----a-w- c:\program files\WinMover\WinMover.exe

          [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
          "ose"=3 (0x3)
          "OMSI download service"=2 (0x2)
          "odserv"=3 (0x3)
          "NVSvc"=2 (0x2)
          "nSvcIp"=2 (0x2)
          "Microsoft Office Groove Audit Service"=3 (0x3)
          "maconfservice"=3 (0x3)
          "iPod Service"=3 (0x3)
          "IDriverT"=3 (0x3)
          "ForceWare Intelligent Application Manager (IAM)"=2 (0x2)
          "eRecoveryService"=2 (0x2)
          "darkness"=2 (0x2)
          "Bonjour Service"=2 (0x2)
          "ASKUpgrade"=2 (0x2)
          "ASKService"=2 (0x2)
          "Apple Mobile Device"=2 (0x2)
          "acs"=2 (0x2)
          "AMService"=2 (0x2)
          "svchost32"=2 (0x2)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
          "EnableFirewall"= 0 (0x0)
          "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
          "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
          "%windir%\\system32\\sessmgr.exe"=
          "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
          "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
          "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

          [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
          "53:UDP"= 53:UDP:Promo
          "11218:TCP"= 11218:TCP:@xpsp2res.dll,-22009
          "33482:TCP"= 33482:TCP:@xpsp2res.dll,-22009
          "27347:TCP"= 27347:TCP:@xpsp2res.dll,-22009
          "29145:TCP"= 29145:TCP:@xpsp2res.dll,-22009
          "20431:TCP"= 20431:TCP:@xpsp2res.dll,-22009
          "43715:TCP"= 43715:TCP:@xpsp2res.dll,-22009
          "24536:TCP"= 24536:TCP:@xpsp2res.dll,-22009
          "45252:TCP"= 45252:TCP:@xpsp2res.dll,-22009

          R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18/01/2010 16:57 691696]
          R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/01/2011 11:03 135336]
          R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [08/01/2010 20:25 27632]
          S0 hctqvcwr;hctqvcwr;c:\windows\system32\drivers\yafoxi.sys --> c:\windows\system32\drivers\yafoxi.sys [?]
          S0 mgwgmai;mgwgmai;c:\windows\system32\drivers\gzlfuiwhovqrnvg.sys --> c:\windows\system32\drivers\gzlfuiwhovqrnvg.sys [?]
          S0 njkhmxfmxoui;njkhmxfmxoui;c:\windows\system32\drivers\fflbpzamytlbfm.sys --> c:\windows\system32\drivers\fflbpzamytlbfm.sys [?]
          S0 sjtoilslrvxu;sjtoilslrvxu;c:\windows\system32\drivers\ihqxritu.sys --> c:\windows\system32\drivers\ihqxritu.sys [?]
          S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
          S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
          S3 CFcatchme;CFcatchme;\??\c:\asdehi\CFcatchme.sys --> c:\asdehi\CFcatchme.sys [?]
          S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [08/01/2010 20:25 86824]
          S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [08/01/2010 20:25 15016]
          S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [08/01/2010 20:25 114600]
          S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [08/01/2010 20:25 108328]
          S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [08/01/2010 20:25 26024]
          S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [08/01/2010 20:25 104616]
          S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [08/01/2010 20:25 109736]
          S3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [08/12/2009 21:24 48128]
          S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
          S4 AMService;AMService;c:\windows\TEMP\olkc\setup.exe run --> c:\windows\TEMP\olkc\setup.exe run [?]
          S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [11/01/2010 18:40 464264]
          S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11/01/2010 18:40 234888]
          S4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/09/2009 07:07 234864]
          S4 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [08/01/2010 20:24 90112]

          --- Autres Services/Pilotes en mémoire ---

          *NewlyCreated* - HELPSVC

          [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
          2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
          .
          Contenu du dossier 'Tâches planifiées'

          2009-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
          - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

          2010-12-10 c:\windows\Tasks\User_Feed_Synchronization-{6E2CC1E9-B16A-4C08-9F5D-4B5FCD8AB3C3}.job
          - c:\windows\system32\msfeedssync.exe [2008-04-14 03:31]
          .
          .
          ------- Examen supplémentaire -------
          .
          uInternet Connection Wizard,ShellNext = iexplore
          uInternet Settings,ProxyOverride = <local>
          uInternet Settings,ProxyServer = http=127.0.0.1:6092
          ucustomizesearch = hxxp://www.google.com/ie
          usearchassistant = hxxp://www.google.com/ie
          IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
          IE: Save Flash - c:\program files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
          IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
          LSP: %SYSTEMROOT%\system32\nvLsp.dll
          FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\cnk4hkj7.default\
          FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
          FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
          FF - Ext: UnPlug: unplug@compunach - %profile%\extensions\unplug@compunach
          .
          - - - - ORPHELINS SUPPRIMES - - - -

          BHO-{2D60F006-0E9F-4EBA-AB0B-1141C5019BD7} - (no file)
          HKU-Default-Run-userini - c:\windows\explorer.exe:userini.exe
          HKLM-Explorer_Run-userini - c:\windows\explorer.exe:userini.exe
          HKU-Default-Explorer_Run-userini - c:\windows\explorer.exe:userini.exe
          MSConfigStartUp-AMService - c:\windows\system32\setup.exe
          MSConfigStartUp-eRecoveryService - c:\acer\Empowering Technology\eRecovery\eRAgent.exe
          MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe
          MSConfigStartUp-pdukjjiu - c:\documents and settings\Administrateur\Local Settings\Application Data\nkjchrqcj\ojjmscyuqiw.exe
          MSConfigStartUp-SmartIndex - c:\windows\Temp\_ex-08.exe
          MSConfigStartUp-userini - c:\windows\explorer.exe:userini.exe
          MSConfigStartUp-WOOKIT - c:\progra~1\Wanadoo\Shell.exe

          **************************************************************************

          catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
          Rootkit scan 2011-01-29 23:16
          Windows 5.1.2600 Service Pack 3 NTFS

          Recherche de processus cachés ...

          Recherche d'éléments en démarrage automatique cachés ...

          Recherche de fichiers cachés ...

          Scan terminé avec succès
          Fichiers cachés: 0

          **************************************************************************
          .
          --------------------- CLES DE REGISTRE BLOQUEES ---------------------

          [HKEY_USERS\S-1-5-21-448539723-162531612-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
          @Denied: (2) (Administrator)
          "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
          d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,51,bb,63,a1,12,48,9c,4b,9b,1e,04,\
          "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
          d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,51,bb,63,a1,12,48,9c,4b,9b,1e,04,\
          .
          --------------------- DLLs chargées dans les processus actifs ---------------------

          - - - - - - - > 'winlogon.exe'(1116)
          c:\windows\system32\SETUPAPI.dll
          c:\windows\system32\LMIinit.dll
          c:\windows\system32\COMRes.dll
          c:\windows\system32\cscui.dll

          - - - - - - - > 'lsass.exe'(1288)
          c:\windows\system32\scecli.dll
          c:\windows\system32\SETUPAPI.dll

          - - - - - - - > 'explorer.exe'(3828)
          c:\windows\system32\SHDOCVW.dll
          c:\windows\system32\nvLsp.dll
          c:\windows\system32\COMRes.dll
          c:\windows\System32\cscui.dll
          c:\windows\system32\msi.dll
          c:\windows\system32\ieframe.dll
          c:\windows\system32\SETUPAPI.dll
          c:\windows\system32\NETSHELL.dll
          c:\windows\system32\credui.dll
          c:\windows\system32\MSVCP60.dll
          c:\windows\system32\eappprxy.dll
          c:\windows\system32\webcheck.dll
          c:\windows\system32\WPDShServiceObj.dll
          c:\windows\system32\PortableDeviceTypes.dll
          c:\windows\system32\PortableDeviceApi.dll
          .
          ------------------------ Autres processus actifs ------------------------
          .
          c:\program files\Avira\AntiVir Desktop\avguard.exe
          c:\program files\Avira\AntiVir Desktop\avshadow.exe
          c:\windows\system32\wscntfy.exe
          c:\windows\system32\RUNDLL32.EXE
          c:\program files\Apoint2K\ApMsgFwd.exe
          c:\program files\Apoint2K\Apntex.exe
          .
          **************************************************************************
          .
          Heure de fin: 2011-01-29 23:25:22 - La machine a redémarré
          ComboFix-quarantined-files.txt 2011-01-29 22:25

          Avant-CF: 11 191 001 088 octets libres
          Après-CF: 11 115 106 304 octets libres

          - - End Of File - - FCB9DE3945E21DE3D138C084C9ED4E22
          0
          1. Utilisateur anonyme
            Re

            ATTENTION /!\ Le script qui suit a été écrit spécialement pour cet ordinateur
            |===>il est fort déconseillé de le transposer sur un autre ordinateur !<===|
            -----------------------------------------------------------------------------------------------

            Toujours avec toutes les protections désactivées, fais ceci :

            * Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
            * Copie/colle dans le bloc-notes ce qui est entre les lignes ci dessous (sans les lignes) :

            ----------------------------------------------------------

            Driver::
            Hctqvcwr
            Mgwgmai
            Njkhmxfmxoui
            sjtoilslrvxu

            Dds::

            uInternet Settings,ProxyServer = http=127.0.0.1:6092

            File::
            c:\windows\system32\alkB.tmp
            c:\windows\system32\alkA.tmp
            c:\windows\system32\alk9.tmp
            c:\windows\system32\alk8.tmp
            c:\windows\system32\alk7.tmp
            c:\windows\system32\drivers\yafoxi.sys
            c:\windows\system32\drivers\gzlfuiwhovqrnvg.sys
            c:\windows\system32\drivers\fflbpzamytlbfm.sys
            c:\windows\system32\drivers\ihqxritu.sys


            -----------------------------------------------------------------

            * Enregistre ce fichier sur ton Bureau (et pas ailleurs !) Sous le nom CFScript.txt
            * Quitte le Bloc Notes

            * Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien : https://support.microsoft.com/en-us/windows?ui=en-US&rs=en-001&ad=US
            * Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé.
            * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
            * Si le fichier ne s'ouvre pas, il se trouve ici ? C:\ComboFix.txt

            @+
            0
            1. spes1340 Auteur
              d'abord merci le virus n'est plus :D et voila le rapport

              ComboFix 11-01-28.03 - Administrateur 30/01/2011 10:46:00.2.1 - x86
              Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1791.1371 [GMT 1:00]
              Lancé depuis: c:\documents and settings\Administrateur\Bureau\asdehi.exe
              Commutateurs utilisés :: c:\documents and settings\Administrateur\Bureau\CFScript.txt
              AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

              FILE ::
              "c:\windows\system32\alk7.tmp"
              "c:\windows\system32\alk8.tmp"
              "c:\windows\system32\alk9.tmp"
              "c:\windows\system32\alkA.tmp"
              "c:\windows\system32\alkB.tmp"
              "c:\windows\system32\drivers\fflbpzamytlbfm.sys"
              "c:\windows\system32\drivers\gzlfuiwhovqrnvg.sys"
              "c:\windows\system32\drivers\ihqxritu.sys"
              "c:\windows\system32\drivers\yafoxi.sys"
              .

              (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
              .

              c:\documents and settings\Administrateur\Application Data\mchagw.dat
              c:\documents and settings\All Users\Documents\Server\admin.txt
              c:\documents and settings\All Users\Documents\Server\server.dat
              c:\documents and settings\NetworkService\Application Data\mdjaw.dat
              C:\feed.txt
              c:\windows\system32\alk7.tmp
              c:\windows\system32\alk8.tmp
              c:\windows\system32\alk9.tmp
              c:\windows\system32\alkA.tmp
              c:\windows\system32\alkB.tmp
              c:\windows\system32\drivers\str.sys
              c:\windows\Sysvxd.exe

              c:\windows\regedit.exe . . . est infecté!!

              c:\windows\system32\winlogon.exe . . . est infecté!!

              c:\windows\explorer.exe . . . est infecté!!

              c:\windows\system32\proquota.exe . . . manque!!

              .
              ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
              .

              -------\Service_hctqvcwr
              -------\Service_mgwgmai
              -------\Service_njkhmxfmxoui
              -------\Service_sjtoilslrvxu

              ((((((((((((((((((((((((((((( Fichiers créés du 2010-12-28 au 2011-01-30 ))))))))))))))))))))))))))))))))))))
              .

              2011-01-29 21:23 . 2011-01-29 21:29 -------- d-----w- c:\program files\ZHPDiag
              2011-01-16 10:05 . 2011-01-16 10:05 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Avira
              2011-01-16 10:03 . 2011-01-16 10:03 -------- d-----w- c:\program files\Avira
              2011-01-16 10:03 . 2011-01-16 10:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
              2011-01-16 10:03 . 2010-08-17 12:39 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
              2011-01-16 10:03 . 2010-06-17 14:28 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
              2011-01-16 10:03 . 2010-06-17 14:28 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
              2011-01-13 21:56 . 2011-01-13 21:56 -------- d-----w- C:\Adobe
              2011-01-13 19:31 . 2011-01-13 19:31 -------- d-sh--w- c:\windows\ftpcache
              2011-01-11 21:09 . 2011-01-29 22:04 -------- d-----w- c:\documents and settings\All Users\Application Data\boost_interprocess

              .
              (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              2011-01-13 20:09 . 2008-09-27 10:24 1573888 ----a-w- c:\windows\explorer.exe
              2011-01-13 14:54 . 2008-09-27 10:27 593408 ----a-w- c:\windows\system32\winlogon.exe
              2010-12-05 13:53 . 2010-12-05 13:35 2494464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\10.0\1036\ResourceCache.dll
              2010-12-05 13:35 . 2010-12-05 13:35 18496 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1036\ResourceCache.dll
              2010-12-05 13:35 . 2010-12-05 13:35 18368 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll
              2010-12-05 13:14 . 2010-10-31 11:13 526452 ----a-w- c:\windows\system32\PerfStringBackup.TMP
              .

              ------- Sigcheck -------

              [-] 2008-09-27 10:24 . 0F350F1870E65C510FFFF60D7EE14BA8 . 1504256 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

              [-] 2011-01-13 . BBD1CCBA50AE14672AF7F282AF994CB4 . 593408 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

              [-] 2008-09-27 . AAC42FD16A1976DE9A0773E740597644 . 693248 . . [5.82] . . c:\windows\system32\comctl32.dll
              [7] 2008-04-14 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
              [7] 2008-04-14 . F92E6BEA9349D49341383F8403B4DFE5 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

              [-] 2008-09-27 . EF31A8266AF7996746392E4F45502536 . 517632 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

              [-] 2011-01-13 . DE5616F629E2B91EECD08FF4572B1EB3 . 1573888 . . [6.00.2900.5634] . . c:\windows\explorer.exe

              [-] 2008-09-27 . B3D95BCB6D0B033BEBFB81FADDA8B8AC . 37376 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

              [-] 2008-09-27 . A3CA2B158B645447964ADC84FA7E6EE6 . 2207872 . . [5.1.2600.5586] . . c:\windows\system32\ntkrnlpa.exe

              [-] 2008-09-27 . 65A2D2BD594EB3E670CECFFEED75FB69 . 2331008 . . [5.1.2600.5586] . . c:\windows\system32\ntoskrnl.exe
              .
              ((((((((((((((((((((((((((((( SnapShot@2011-01-29_22.17.09 )))))))))))))))))))))))))))))))))))))))))
              .
              - 2009-09-10 20:09 . 2009-09-10 20:09 86331 c:\windows\pchealth\helpctr\OfflineCache\index.dat
              + 2009-09-10 20:09 . 2011-01-29 22:20 86331 c:\windows\pchealth\helpctr\OfflineCache\index.dat
              + 2009-09-10 20:09 . 2011-01-29 22:20 2430 c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
              - 2009-09-10 20:09 . 2011-01-29 22:15 2430 c:\windows\pchealth\helpctr\PackageStore\SkuStore.bin
              + 2010-01-18 15:57 . 2010-01-18 14:57 691696 c:\windows\system32\drivers\sptd.sys
              - 2010-01-18 15:57 . 2010-01-18 15:57 691696 c:\windows\system32\drivers\sptd.sys
              .
              ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
              .
              .
              *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
              REGEDIT4

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
              "{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]

              [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

              [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
              2009-04-02 11:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

              [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4daac69c-cba7-45e2-9bc8-1044483d3352}]
              2010-06-13 17:10 2734688 ----a-w- c:\program files\Softonic_France\tbSoft.dll

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
              "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
              "{4daac69c-cba7-45e2-9bc8-1044483d3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]

              [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
              [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

              [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

              [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
              "{4DAAC69C-CBA7-45E2-9BC8-1044483D3352}"= "c:\program files\Softonic_France\tbSoft.dll" [2010-06-13 2734688]
              "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

              [HKEY_CLASSES_ROOT\clsid\{4daac69c-cba7-45e2-9bc8-1044483d3352}]

              [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
              [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13594624]
              "nwiz"="nwiz.exe" [2009-01-30 1657376]
              "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
              "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-30 86016]
              "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-06-06 159744]
              "AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-05-27 753664]
              "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]

              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
              "JkDefrag"="advpack.dll" [2009-03-08 128512]
              "SweetRegistry"="advpack.dll" [2009-03-08 128512]

              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
              "HideRunAsVerb"= 0 (0x0)
              "NoNetConnectDisconnect"= 1 (0x1)
              "NoResolveTrack"= 1 (0x1)

              [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
              "NoResolveTrack"= 1 (0x1)
              "NoSMBalloonTip"= 1 (0x1)
              "NoSMConfigurePrograms"= 1 (0x1)
              "NoSMHelp"= 1 (0x1)
              "NoStrCmpLogical"= 0 (0x0)
              "NoWelcomeScreen"= 1 (0x1)

              [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
              "ForceClassicControlPanel"= 1 (0x1)
              "NoResolveTrack"= 1 (0x1)
              "NoSMBalloonTip"= 1 (0x1)
              "NoSMConfigurePrograms"= 1 (0x1)
              "NoSMHelp"= 1 (0x1)
              "NoStrCmpLogical"= 0 (0x0)
              "NoWelcomeScreen"= 1 (0x1)

              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
              2009-09-05 10:23 87352 ----a-w- c:\windows\system32\LMIinit.dll

              [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
              @="Driver"

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
              2005-05-03 01:43 69632 ----a-w- c:\windows\Alcmtr.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
              2009-10-30 11:57 369200 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
              2007-08-24 05:00 33648 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
              2008-09-10 15:40 289576 ----a-w- c:\program files\iTunes\iTunesHelper.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
              2009-07-26 15:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
              2008-09-06 13:09 413696 ----a-w- c:\program files\QT Lite\QTTask.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
              2007-05-27 23:32 16132608 ----a-w- c:\windows\RTHDCPL.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
              2009-09-24 13:41 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuperCopier2.exe]
              2005-03-13 23:37 1057280 ----a-w- c:\program files\SuperCopier2\SuperCopier2.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
              2008-06-29 22:01 52168 ----a-w- c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinMover]
              2005-12-02 20:33 10240 ----a-w- c:\program files\WinMover\WinMover.exe

              [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
              "ose"=3 (0x3)
              "OMSI download service"=2 (0x2)
              "odserv"=3 (0x3)
              "NVSvc"=2 (0x2)
              "nSvcIp"=2 (0x2)
              "Microsoft Office Groove Audit Service"=3 (0x3)
              "maconfservice"=3 (0x3)
              "iPod Service"=3 (0x3)
              "IDriverT"=3 (0x3)
              "ForceWare Intelligent Application Manager (IAM)"=2 (0x2)
              "eRecoveryService"=2 (0x2)
              "darkness"=2 (0x2)
              "Bonjour Service"=2 (0x2)
              "ASKUpgrade"=2 (0x2)
              "ASKService"=2 (0x2)
              "Apple Mobile Device"=2 (0x2)
              "acs"=2 (0x2)
              "AMService"=2 (0x2)
              "svchost32"=2 (0x2)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
              "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
              "%windir%\\system32\\sessmgr.exe"=
              "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
              "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
              "53:UDP"= 53:UDP:Promo
              "11218:TCP"= 11218:TCP:@xpsp2res.dll,-22009
              "33482:TCP"= 33482:TCP:@xpsp2res.dll,-22009
              "27347:TCP"= 27347:TCP:@xpsp2res.dll,-22009
              "29145:TCP"= 29145:TCP:@xpsp2res.dll,-22009
              "20431:TCP"= 20431:TCP:@xpsp2res.dll,-22009
              "43715:TCP"= 43715:TCP:@xpsp2res.dll,-22009
              "24536:TCP"= 24536:TCP:@xpsp2res.dll,-22009
              "45252:TCP"= 45252:TCP:@xpsp2res.dll,-22009

              R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [18/01/2010 16:57 691696]
              R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [16/01/2011 11:03 135336]
              R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [08/01/2010 20:25 27632]
              S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18/03/2010 13:16 130384]
              S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
              S3 CFcatchme;CFcatchme;\??\c:\asdehi\CFcatchme.sys --> c:\asdehi\CFcatchme.sys [?]
              S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [08/01/2010 20:25 86824]
              S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [08/01/2010 20:25 15016]
              S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [08/01/2010 20:25 114600]
              S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [08/01/2010 20:25 108328]
              S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [08/01/2010 20:25 26024]
              S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [08/01/2010 20:25 104616]
              S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [08/01/2010 20:25 109736]
              S3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys [08/12/2009 21:24 48128]
              S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18/03/2010 13:16 753504]
              S4 AMService;AMService;c:\windows\TEMP\olkc\setup.exe run --> c:\windows\TEMP\olkc\setup.exe run [?]
              S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [11/01/2010 18:40 464264]
              S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11/01/2010 18:40 234888]
              S4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [01/09/2009 07:07 234864]
              S4 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [08/01/2010 20:24 90112]

              [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
              2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
              .
              Contenu du dossier 'Tâches planifiées'

              2009-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
              - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

              2010-12-10 c:\windows\Tasks\User_Feed_Synchronization-{6E2CC1E9-B16A-4C08-9F5D-4B5FCD8AB3C3}.job
              - c:\windows\system32\msfeedssync.exe [2008-04-14 03:31]
              .
              .
              ------- Examen supplémentaire -------
              .
              uInternet Connection Wizard,ShellNext = iexplore
              uInternet Settings,ProxyOverride = <local>
              ucustomizesearch = hxxp://www.google.com/ie
              usearchassistant = hxxp://www.google.com/ie
              IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
              IE: Save Flash - c:\program files\UnH Solutions\Flash Saving Plugin\FlashSButton.dll/210
              IE: Sothink SWF Catcher - c:\program files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
              LSP: %SYSTEMROOT%\system32\nvLsp.dll
              FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\cnk4hkj7.default\
              FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr
              FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
              FF - Ext: UnPlug: unplug@compunach - %profile%\extensions\unplug@compunach
              .

              **************************************************************************

              catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
              Rootkit scan 2011-01-30 10:59
              Windows 5.1.2600 Service Pack 3 NTFS

              Recherche de processus cachés ...

              Recherche d'éléments en démarrage automatique cachés ...

              Recherche de fichiers cachés ...

              Scan terminé avec succès
              Fichiers cachés: 0

              **************************************************************************

              Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
              Windows 5.1.2600 Disk: WDC_WD1200BEVS-22UST0 rev.01.01A01 -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-e

              device: opened successfully
              user: MBR read successfully

              Disk trace:
              called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x883E4EC5]<<
              _asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x87196872; SUB DWORD [EBP-0x4], 0x8719612e; PUSH EDI; CALL 0xffffffffffffdf33; }
              1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x89AD0AB8]
              3 CLASSPNP[0xB8108FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000087[0x89ABB9E8]
              5 ACPI[0xB7E73620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x89AB9D98]
              [0x89B82EC8] -> IRP_MJ_CREATE -> 0x883E4EC5
              kernel: MBR read successfully
              _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
              detected disk devices:
              \Device\Ide\IdeDeviceP2T0L0-e -> \??\IDE#DiskWDC_WD1200BEVS-22UST0___________________01.01A01#5&14c7c324&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
              detected hooks:
              \Driver\atapi DriverStartIo -> 0x883E4AEA
              user & kernel MBR OK
              sectors 234441646 (+255): user != kernel
              Warning: possible TDL3 rootkit infection !

              **************************************************************************
              .
              --------------------- CLES DE REGISTRE BLOQUEES ---------------------

              [HKEY_USERS\S-1-5-21-448539723-162531612-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
              @Denied: (2) (Administrator)
              "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
              d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,51,bb,63,a1,12,48,9c,4b,9b,1e,04,\
              "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
              d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,51,bb,63,a1,12,48,9c,4b,9b,1e,04,\
              .
              --------------------- DLLs chargées dans les processus actifs ---------------------

              - - - - - - - > 'winlogon.exe'(1236)
              c:\windows\system32\SETUPAPI.dll
              c:\windows\system32\LMIinit.dll
              c:\windows\system32\COMRes.dll
              c:\windows\system32\cscui.dll

              - - - - - - - > 'lsass.exe'(1468)
              c:\windows\system32\scecli.dll
              c:\windows\system32\SETUPAPI.dll

              - - - - - - - > 'explorer.exe'(3008)
              c:\windows\system32\SHDOCVW.dll
              c:\windows\system32\nvLsp.dll
              c:\windows\system32\COMRes.dll
              c:\windows\System32\cscui.dll
              c:\windows\system32\msi.dll
              c:\windows\system32\ieframe.dll
              c:\windows\system32\SETUPAPI.dll
              c:\windows\system32\NETSHELL.dll
              c:\windows\system32\credui.dll
              c:\windows\system32\MSVCP60.dll
              c:\windows\system32\eappprxy.dll
              c:\windows\system32\webcheck.dll
              c:\windows\system32\WPDShServiceObj.dll
              c:\windows\system32\PortableDeviceTypes.dll
              c:\windows\system32\PortableDeviceApi.dll
              .
              ------------------------ Autres processus actifs ------------------------
              .
              c:\program files\Avira\AntiVir Desktop\avguard.exe
              c:\program files\Avira\AntiVir Desktop\avshadow.exe
              c:\windows\system32\wscntfy.exe
              c:\windows\system32\RUNDLL32.EXE
              c:\program files\Apoint2K\ApMsgFwd.exe
              c:\program files\Apoint2K\Apntex.exe
              .
              **************************************************************************
              .
              Heure de fin: 2011-01-30 11:05:29 - La machine a redémarré
              ComboFix-quarantined-files.txt 2011-01-30 10:05
              ComboFix2.txt 2011-01-29 22:25

              Avant-CF: 11 086 475 264 octets libres
              Après-CF: 11 084 038 144 octets libres

              WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
              [boot loader]
              timeout=2
              default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
              [operating systems]
              c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
              UnsupportedDebug="do not select this" /debug
              multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

              - - End Of File - - 522DD8642DB228357022E2E6BC8D1BE4
              0
              1. Utilisateur anonyme
                Bonjour

                Il reste des fichiers infectés....

                Fait ceci : Télécharge TDSSKiller ici :

                * Créez un nouveau dossier sur votre bureau puis décompressez l'archive dedans
                * Lancez le programme en cliquant sur TDSSKiller.exe, l'analyse se fait automatiquement, si l'infection est détectée, des éléments cachés (= hidden) seront alors affichés.

                Cochez les et cliquez sur "Delete/Repair Selected".

                * Un message peut ensuite apparaitre demandant de redémarrer le pc (reboot)pour finir le nettoyage. taper "Y" pour redémarrer le PC ("close all programs and choose Y to restart").

                Poste moi son rapport à l'issue; merci

                @+
                0
                1. spes1340 Auteur
                  raport tds :

                  2011/01/30 12:05:44.0093 TDSS rootkit removing tool 2.4.15.0 Jan 22 2011 19:37:53
                  2011/01/30 12:05:44.0093 ================================================================================
                  2011/01/30 12:05:44.0109 SystemInfo:
                  2011/01/30 12:05:44.0109
                  2011/01/30 12:05:44.0109 OS Version: 5.1.2600 ServicePack: 3.0
                  2011/01/30 12:05:44.0109 Product type: Workstation
                  2011/01/30 12:05:44.0109 ComputerName: SWEET-0E7B52461
                  2011/01/30 12:05:44.0109 UserName: Administrateur
                  2011/01/30 12:05:44.0109 Windows directory: C:\WINDOWS
                  2011/01/30 12:05:44.0109 System windows directory: C:\WINDOWS
                  2011/01/30 12:05:44.0109 Processor architecture: Intel x86
                  2011/01/30 12:05:44.0109 Number of processors: 1
                  2011/01/30 12:05:44.0109 Page size: 0x1000
                  2011/01/30 12:05:44.0109 Boot type: Normal boot
                  2011/01/30 12:05:44.0109 ================================================================================
                  2011/01/30 12:05:45.0593 Initialize success
                  2011/01/30 12:06:27.0265 ================================================================================
                  2011/01/30 12:06:27.0265 Scan started
                  2011/01/30 12:06:27.0265 Mode: Manual;
                  2011/01/30 12:06:27.0265 ================================================================================
                  2011/01/30 12:06:33.0500 ACPI (e5e6dbfc41ea8aad005cb9a57a96b43b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
                  2011/01/30 12:06:35.0046 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
                  2011/01/30 12:06:40.0031 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
                  2011/01/30 12:06:42.0531 AFD (744b88b93d2a58a1eb84c11d48ca85c8) C:\WINDOWS\System32\drivers\afd.sys
                  2011/01/30 12:06:49.0359 AmdK8 (0a4d13b388c814560bd69c3a496ecfa8) C:\WINDOWS\system32\DRIVERS\AmdK8.sys
                  2011/01/30 12:06:51.0671 ApfiltrService (db8ea68e5864adf61b73516788659e71) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
                  2011/01/30 12:06:52.0812 AR5211 (9108f38c07f4953ea4ee89243e787cad) C:\WINDOWS\system32\DRIVERS\ar5211.sys
                  2011/01/30 12:06:54.0015 AR5416 (864160f5f4fbdd97b6a686854bfebd86) C:\WINDOWS\system32\DRIVERS\athw.sys
                  2011/01/30 12:06:55.0203 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
                  2011/01/30 12:06:59.0578 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
                  2011/01/30 12:07:00.0671 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
                  2011/01/30 12:07:03.0578 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
                  2011/01/30 12:07:05.0765 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
                  2011/01/30 12:07:06.0953 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
                  2011/01/30 12:07:08.0890 avgntflt (1eb7d72a82f94f7e9496d363fce00b68) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
                  2011/01/30 12:07:10.0484 avipbb (f8c56231ed5ecf7d1b46b0330880ccef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
                  2011/01/30 12:07:12.0140 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
                  2011/01/30 12:07:13.0328 Cam5607 (e3d5fb49d2342bcfb90916e9bda0a1cf) C:\WINDOWS\system32\Drivers\BisonC07.sys
                  2011/01/30 12:07:14.0421 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
                  2011/01/30 12:07:15.0515 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
                  2011/01/30 12:07:17.0718 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
                  2011/01/30 12:07:18.0843 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
                  2011/01/30 12:07:20.0781 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys
                  2011/01/30 12:07:23.0234 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
                  2011/01/30 12:07:25.0437 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
                  2011/01/30 12:07:30.0265 Disk (47b6aaec570f2c11d8bad80a064d8ed1) C:\WINDOWS\system32\DRIVERS\disk.sys
                  2011/01/30 12:07:31.0359 dmboot (b13408a5d89dcc39992ca0ddce3c86ba) C:\WINDOWS\system32\drivers\dmboot.sys
                  2011/01/30 12:07:32.0500 dmio (5a7c47c9b3f9fb92a66410a7509f0c71) C:\WINDOWS\system32\drivers\dmio.sys
                  2011/01/30 12:07:33.0718 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
                  2011/01/30 12:07:34.0859 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
                  2011/01/30 12:07:36.0140 driverhardwarev2 (c0bf8cd94c88b34fb324f4bd6dae544d) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys
                  2011/01/30 12:07:37.0328 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
                  2011/01/30 12:07:38.0484 ElbyCDIO (28cb0b64134ad62c2acf77db8501a619) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys
                  2011/01/30 12:07:39.0781 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
                  2011/01/30 12:07:41.0093 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
                  2011/01/30 12:07:42.0187 Fips (31f923eb2170fc172c81abda0045d18c) C:\WINDOWS\system32\drivers\Fips.sys
                  2011/01/30 12:07:43.0359 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
                  2011/01/30 12:07:44.0453 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
                  2011/01/30 12:07:45.0562 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
                  2011/01/30 12:07:46.0781 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
                  2011/01/30 12:07:48.0000 GEARAspiWDM (ab8a6a87d9d7255c3884d5b9541a6e80) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
                  2011/01/30 12:07:49.0109 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
                  2011/01/30 12:07:50.0390 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
                  2011/01/30 12:07:52.0625 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
                  2011/01/30 12:07:56.0421 HSFHWAZL (6a5c4732d6803f84e2987edd8e4359ce) C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
                  2011/01/30 12:07:57.0968 HSF_DPV (21c31273c6cc4826e74be8ae3b09d4a8) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
                  2011/01/30 12:07:59.0453 HTTP (f6aacf5bce2893e0c1754afeb672e5c9) C:\WINDOWS\system32\Drivers\HTTP.sys
                  2011/01/30 12:08:03.0859 i8042prt (a09bdc4ed10e3b2e0ec27bb94af32516) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
                  2011/01/30 12:08:05.0500 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
                  2011/01/30 12:08:06.0937 int15 (c6e5276c00ebdeb096bb5ef4b797d1b6) C:\Acer\Empowering Technology\eRecovery\int15.sys
                  2011/01/30 12:08:08.0578 IntcAzAudAddService (b45a576ad280dd4f605f58b24cdaafe1) C:\WINDOWS\system32\drivers\RtkHDAud.sys
                  2011/01/30 12:08:10.0984 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
                  2011/01/30 12:08:12.0125 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
                  2011/01/30 12:08:13.0265 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
                  2011/01/30 12:08:14.0562 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
                  2011/01/30 12:08:15.0750 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
                  2011/01/30 12:08:17.0015 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
                  2011/01/30 12:08:18.0093 isapnp (355836975a67b6554bca60328cd6cb74) C:\WINDOWS\system32\DRIVERS\isapnp.sys
                  2011/01/30 12:08:19.0265 Kbdclass (16813155807c6881f4bfbf6657424659) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
                  2011/01/30 12:08:20.0437 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
                  2011/01/30 12:08:21.0687 KSecDD (1705745d900dabf2d89f90ebaddc7517) C:\WINDOWS\system32\drivers\KSecDD.sys
                  2011/01/30 12:08:27.0031 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys
                  2011/01/30 12:08:33.0625 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
                  2011/01/30 12:08:34.0781 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
                  2011/01/30 12:08:35.0953 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
                  2011/01/30 12:08:37.0078 Modem (510ade9327fe84c10254e1902697e25f) C:\WINDOWS\system32\drivers\Modem.sys
                  2011/01/30 12:08:39.0296 Mouclass (027c01bd7ef3349aaebc883d8a799efb) C:\WINDOWS\system32\DRIVERS\mouclass.sys
                  2011/01/30 12:08:40.0453 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
                  2011/01/30 12:08:42.0671 MRxDAV (0a25b866933d126d1e831fd025a278c2) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
                  2011/01/30 12:08:43.0828 MRxSmb (32ecb7d3c03532b4460e09e960a3b72e) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
                  2011/01/30 12:08:44.0968 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
                  2011/01/30 12:08:46.0093 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
                  2011/01/30 12:08:47.0234 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
                  2011/01/30 12:08:48.0312 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
                  2011/01/30 12:08:49.0421 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
                  2011/01/30 12:08:50.0515 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
                  2011/01/30 12:08:51.0640 Mup (6546fe6639499fa4bef180bdf08266a1) C:\WINDOWS\system32\drivers\Mup.sys
                  2011/01/30 12:08:52.0750 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
                  2011/01/30 12:08:53.0890 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
                  2011/01/30 12:08:55.0109 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
                  2011/01/30 12:08:56.0218 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
                  2011/01/30 12:08:57.0343 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
                  2011/01/30 12:08:58.0468 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
                  2011/01/30 12:08:59.0593 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys
                  2011/01/30 12:09:00.0703 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
                  2011/01/30 12:09:01.0796 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
                  2011/01/30 12:09:03.0031 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
                  2011/01/30 12:09:04.0125 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
                  2011/01/30 12:09:05.0296 Ntfs (a0857c97770034fd2af17dc4014b5abd) C:\WINDOWS\system32\drivers\Ntfs.sys
                  2011/01/30 12:09:06.0578 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
                  2011/01/30 12:09:07.0921 nv (d42fb8615e810901779294f5627364fe) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
                  2011/01/30 12:09:09.0453 NVENETFD (45ba510db13a0496db1cd16826519e03) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
                  2011/01/30 12:09:10.0578 nvnetbus (57cbdb934fb1afb7e03b413d151a6152) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
                  2011/01/30 12:09:11.0718 nvsmu (03dbb885deae94f06c06ec06acdb8b47) C:\WINDOWS\system32\DRIVERS\nvsmu.sys
                  2011/01/30 12:09:12.0828 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
                  2011/01/30 12:09:13.0953 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
                  2011/01/30 12:09:15.0250 ohci1394 (29afb382b68bfd768651a68b12a550a5) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
                  2011/01/30 12:09:16.0421 Parport (8fd0bdbea875d06ccf6c945ca9abaf75) C:\WINDOWS\system32\drivers\Parport.sys
                  2011/01/30 12:09:17.0546 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
                  2011/01/30 12:09:18.0656 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys
                  2011/01/30 12:09:19.0656 PCANDIS5 (2f9806b52cb3748b1e49222744b28e3c) C:\WINDOWS\system32\PCANDIS5.SYS
                  2011/01/30 12:09:20.0921 PCI (043410877bda580c528f45165f7125bc) C:\WINDOWS\system32\DRIVERS\pci.sys
                  2011/01/30 12:09:23.0109 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys
                  2011/01/30 12:09:24.0250 Pcmcia (f0406cbc60bdb0394a0e17ffb04cdd3d) C:\WINDOWS\system32\drivers\Pcmcia.sys
                  2011/01/30 12:09:31.0875 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
                  2011/01/30 12:09:33.0031 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
                  2011/01/30 12:09:34.0171 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
                  2011/01/30 12:09:35.0265 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
                  2011/01/30 12:09:41.0750 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
                  2011/01/30 12:09:42.0875 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
                  2011/01/30 12:09:44.0031 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
                  2011/01/30 12:09:45.0093 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
                  2011/01/30 12:09:46.0203 Rdbss (9629383f70db691cb6aa5bbd828cd9a9) C:\WINDOWS\system32\DRIVERS\rdbss.sys
                  2011/01/30 12:09:47.0375 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
                  2011/01/30 12:09:48.0500 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
                  2011/01/30 12:09:49.0656 RDPWD (e8e3107243b16a549b88d145ec051b06) C:\WINDOWS\system32\drivers\RDPWD.sys
                  2011/01/30 12:09:50.0796 redbook (d8eb2a7904db6c916eb5361878ddcbae) C:\WINDOWS\system32\DRIVERS\redbook.sys
                  2011/01/30 12:09:51.0921 rimmptsk (355aac141b214bef1dbc1483afd9bd50) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
                  2011/01/30 12:09:53.0046 rimsptsk (a4216c71dd4f60b26418ccfd99cd0815) C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
                  2011/01/30 12:09:54.0140 rismxdp (d231b577024aa324af13a42f3a807d10) C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
                  2011/01/30 12:09:55.0296 rspndr (743d7d59767073a617b1dcc6c546f234) C:\WINDOWS\system32\DRIVERS\rspndr.sys
                  2011/01/30 12:09:56.0390 s0017bus (594ff5620661d1386475406e78cb6f2f) C:\WINDOWS\system32\DRIVERS\s0017bus.sys
                  2011/01/30 12:09:57.0546 s0017mdfl (7258f550419d543bc5c8e80c578a5d54) C:\WINDOWS\system32\DRIVERS\s0017mdfl.sys
                  2011/01/30 12:09:58.0656 s0017mdm (1de4f6607feb17a15dbd4f1b139e6d2f) C:\WINDOWS\system32\DRIVERS\s0017mdm.sys
                  2011/01/30 12:09:59.0796 s0017mgmt (9814e6bacc06d2526cd52981c7eeedf0) C:\WINDOWS\system32\DRIVERS\s0017mgmt.sys
                  2011/01/30 12:10:00.0906 s0017nd5 (2c62cd58225973f26682cd4f783ddede) C:\WINDOWS\system32\DRIVERS\s0017nd5.sys
                  2011/01/30 12:10:02.0015 s0017obex (f87c3422e84b2fb1b43e0a26247ad5a5) C:\WINDOWS\system32\DRIVERS\s0017obex.sys
                  2011/01/30 12:10:03.0125 s0017unic (df5e7360a0afa5956bf75da683d0679f) C:\WINDOWS\system32\DRIVERS\s0017unic.sys
                  2011/01/30 12:10:04.0250 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
                  2011/01/30 12:10:05.0359 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
                  2011/01/30 12:10:06.0515 seehcri (e5b56569a9f79b70314fede6c953641e) C:\WINDOWS\system32\DRIVERS\seehcri.sys
                  2011/01/30 12:10:07.0625 Serial (93d313c31f7ad9ea2b75f26075413c7c) C:\WINDOWS\system32\drivers\Serial.sys
                  2011/01/30 12:10:08.0750 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
                  2011/01/30 12:10:12.0000 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
                  2011/01/30 12:10:13.0312 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys
                  2011/01/30 12:10:13.0312 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505
                  2011/01/30 12:10:13.0343 sptd - detected Locked file (1)
                  2011/01/30 12:10:14.0421 sr (39626e6dc1fb39434ec40c42722b660a) C:\WINDOWS\system32\DRIVERS\sr.sys
                  2011/01/30 12:10:15.0578 Srv (5252605079810904e31c332e241cd59b) C:\WINDOWS\system32\DRIVERS\srv.sys
                  2011/01/30 12:10:16.0671 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
                  2011/01/30 12:10:17.0812 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
                  2011/01/30 12:10:18.0906 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
                  2011/01/30 12:10:20.0015 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
                  2011/01/30 12:10:25.0500 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
                  2011/01/30 12:10:26.0640 Tcpip (367de8e5f638c091f49273144274f629) C:\WINDOWS\system32\DRIVERS\tcpip.sys
                  2011/01/30 12:10:27.0781 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
                  2011/01/30 12:10:28.0875 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
                  2011/01/30 12:10:29.0953 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
                  2011/01/30 12:10:32.0156 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
                  2011/01/30 12:10:34.0343 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
                  2011/01/30 12:10:35.0515 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
                  2011/01/30 12:10:36.0640 usbehci (152ee0baa614388273a0b9ae9c9fd5a0) C:\WINDOWS\system32\DRIVERS\usbehci.sys
                  2011/01/30 12:10:37.0750 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
                  2011/01/30 12:10:38.0828 usbohci (c5e11cd822adf0019a5a862d9c4e2222) C:\WINDOWS\system32\DRIVERS\usbohci.sys
                  2011/01/30 12:10:39.0937 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
                  2011/01/30 12:10:41.0031 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
                  2011/01/30 12:10:42.0140 VClone (cefaa7d630b653be5f831da1f49780c5) C:\WINDOWS\system32\DRIVERS\VClone.sys
                  2011/01/30 12:10:43.0218 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
                  2011/01/30 12:10:45.0359 VolSnap (46de1126684369bace4849e4fc8c43ca) C:\WINDOWS\system32\drivers\VolSnap.sys
                  2011/01/30 12:10:45.0625 VSPerfDrv100 (5a2ddc5411a092bedb1a07755e087784) C:\Program Files\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys
                  2011/01/30 12:10:46.0703 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
                  2011/01/30 12:10:47.0875 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
                  2011/01/30 12:10:50.0078 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
                  2011/01/30 12:10:51.0203 winachsf (307d248f97835b6879bdd361086924fe) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
                  2011/01/30 12:10:52.0453 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
                  2011/01/30 12:10:53.0562 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
                  2011/01/30 12:10:54.0718 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
                  2011/01/30 12:10:55.0828 WSIMD (e23437e5b715b999e280d00d9eea64da) C:\WINDOWS\system32\DRIVERS\wsimd.sys
                  2011/01/30 12:10:56.0953 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
                  2011/01/30 12:10:58.0125 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
                  2011/01/30 12:10:59.0234 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
                  2011/01/30 12:10:59.0531 ================================================================================
                  2011/01/30 12:10:59.0531 Scan finished
                  2011/01/30 12:10:59.0531 ================================================================================
                  2011/01/30 12:10:59.0531 Detected object count: 1
                  2011/01/30 12:11:11.0421 HKLM\SYSTEM\ControlSet001\services\sptd - will be deleted after reboot
                  2011/01/30 12:11:11.0468 HKLM\SYSTEM\ControlSet002\services\sptd - will be deleted after reboot
                  2011/01/30 12:11:11.0468 C:\WINDOWS\system32\Drivers\sptd.sys - will be deleted after reboot
                  2011/01/30 12:11:11.0468 Locked file(sptd) - User select action: Delete
                  2011/01/30 12:11:26.0968 Deinitialize success
                  0
                  1. Utilisateur anonyme
                    Re

                    Procède à la mise à jour de Windows via Windows update.

                    Ensuite fait ceci

                    @+
                    0

                    Discussions similaires

                    Softonic,est-ce un virus ?
                    techmel1

                    6 réponses
                    Chrome://newtab
                    Nova

                    14 réponses
                    Désinstaller Softonic
                    Diguimette

                    5 réponses
                    Supprimer New Tab
                    tysaozon

                    8 réponses
                    Virus dans filezilla
                    balnelius10

                    9 réponses