Demande d'analyse zhpdiag+sophos rootkit

bonjour

il y a des bricoles

mais peux tu poster le rapport combofix stp

C:\ComboFix.txt

ISM.EXE
TASKHOST.EXE
UBOEI369.EXE
updatesrv.exe
downloader.exe (cheval de troie)
conhost.exe
integratedsupport.exe

ComboFix 11-03-23.06 - meto 24/03/2011 16:57:59.1.2 - x64
Microsoft Windows 7 Édition Intégrale 6.1.7600.0.1252.33.1033.18.3071.1611 [GMT 1:00]
Lancé depuis: c:\users\meto\Desktop\tuerlestous.exe
AV: BitDefender Antivirus *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: BitDefender Pare-feu *Disabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
FW: PC Tools Firewall Plus *Disabled* {175D0B73-9F8F-2CA9-8BF1-62277A276DC9}
SP: BitDefender Antispyware *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-02-24 au 2011-03-24 ))))))))))))))))))))))))))))))))))))
.
.
2011-03-24 16:22 . 2011-03-24 16:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-03-24 16:22 . 2011-03-24 16:22 -------- d-----w- c:\users\nikita\AppData\Local\temp
2011-03-24 16:22 . 2011-03-24 16:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-24 16:22 . 2011-03-24 16:22 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2011-03-24 13:28 . 2011-03-24 13:28 512 -c--a-w- C:\PhysicalDisk0_MBR.bin
2011-03-24 13:18 . 2011-03-24 13:53 -------- d-----w- c:\program files (x86)\ZHPDiag
2011-03-24 13:16 . 2010-05-26 09:45 18816 ------w- c:\windows\SysWow64\SAVRKBootTasks.sys
2011-03-24 11:45 . 2010-05-26 09:39 6144 ------w- c:\windows\system32\20B5.tmp
2011-03-24 11:44 . 2010-05-26 09:39 6144 ------w- c:\windows\system32\FF0.tmp
2011-03-22 13:41 . 2011-03-22 13:41 -------- d-----w- c:\users\nikita\AppData\Roaming\pdf995
2011-03-22 13:35 . 2011-03-22 13:54 59 ----a-w- c:\windows\wpd99.drv
2011-03-22 13:35 . 2011-03-22 13:54 -------- d-----w- c:\programdata\pdf995
2011-03-22 13:35 . 2010-10-29 07:24 320512 ----a-w- c:\windows\system32\pdfmona64.dll
2011-03-22 13:35 . 2006-10-19 20:44 47616 ----a-w- c:\windows\system32\pdf995mon64.dll
2011-03-22 13:35 . 2011-03-22 13:35 47616 ----a-w- c:\windows\SysWow64\pdf995mon64.dll
2011-03-22 13:35 . 2005-06-30 14:29 11264 ----a-w- c:\windows\system32\pdf995mon64ui.dll
2011-03-22 13:34 . 2011-03-22 13:37 -------- d-----w- c:\program files (x86)\pdf995
2011-03-17 20:05 . 2011-03-17 20:25 -------- dc--a-w- C:\3590F75ABA9E485486C100C1A9D4FF06Z..Z.ZZZ....ZZ.Z
2011-03-17 19:42 . 2011-03-17 20:05 -------- dc--a-w- C:\3590F75ABA9E485486C100C1A9D4FF06ZZ.ZZZ...ZZZZ.ZZ
2011-03-17 15:20 . 2011-03-17 15:20 -------- d-----w- c:\users\nikita\AppData\Roaming\BitDefender
2011-03-17 15:19 . 2011-03-17 15:19 -------- dc----w- c:\program files\BitDefender
2011-03-17 15:13 . 2011-03-17 15:13 -------- d-----w- c:\programdata\8110000-4b19-46bd-c6a6-e3c1f2e7c88b
2011-03-17 15:08 . 2011-03-17 20:26 -------- d-----w- c:\programdata\BitDefender
2011-03-17 15:08 . 2010-07-09 13:08 388168 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2011-03-03 19:11 . 2011-03-03 19:11 812344 ----a-w- c:\users\nikita\HJTInstall.exe
2011-03-02 22:04 . 2010-03-29 10:06 233488 ----a-w- c:\windows\system32\drivers\PCTCore64.sys
2011-03-02 22:04 . 2010-11-17 09:20 331368 ----a-w- c:\windows\system32\drivers\pctgntdi64.sys
2011-03-02 22:04 . 2010-11-17 09:20 136168 ----a-w- c:\windows\system32\drivers\pctwfpfilter64.sys
2011-03-02 22:04 . 2011-03-02 22:04 -------- d-----w- c:\program files (x86)\Common Files\PC Tools
2011-03-02 22:04 . 2010-11-24 08:18 119688 ----a-w- c:\windows\system32\drivers\pctNdis-PacketFilter64.sys
2011-03-02 22:04 . 2010-07-08 08:49 79000 ----a-w- c:\windows\system32\drivers\pctNdis64.sys
2011-03-02 22:04 . 2010-02-05 08:26 42968 ----a-w- c:\windows\system32\drivers\pctNdis-DNS64.sys
2011-03-02 22:04 . 2010-11-25 09:42 179464 ----a-w- c:\windows\system32\drivers\pctplfw64.sys
2011-03-02 22:04 . 2011-03-02 22:09 -------- d-----w- c:\program files (x86)\PC Tools Firewall Plus
2011-03-02 22:01 . 2011-03-17 15:19 -------- dc----w- c:\program files\Common Files\BitDefender
2011-03-02 12:37 . 2011-03-02 18:28 -------- d-----w- c:\windows\system32\SPReview
2011-03-02 11:40 . 2011-03-02 18:29 -------- dc----w- C:\b5fe81749007bd10dc9cba89abf8
2011-03-01 12:02 . 2011-03-01 12:02 -------- dc----w- C:\12f326321a742921aae0e6
2011-02-28 22:45 . 2011-02-28 22:45 -------- d-----w- c:\programdata\NortonInstaller
2011-02-24 15:30 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
2011-02-24 15:30 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
2011-02-24 15:30 . 2011-01-07 07:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2011-02-24 15:30 . 2011-01-07 08:07 662528 ----a-w- c:\windows\system32\XpsPrint.dll
2011-02-24 15:30 . 2011-01-07 08:07 475648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-24 15:30 . 2011-01-07 07:31 288256 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2011-02-23 13:28 . 2011-03-02 11:40 -------- d-----w- c:\windows\system32\EventProviders
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-17 15:23 . 2011-02-03 11:44 3910852 ----a-w- c:\programdata\bdinstall.bin
2011-02-23 15:04 . 2011-01-28 20:33 238968 ----a-w- c:\windows\system32\aswBoot.exe
2011-02-02 20:40 . 2010-09-01 13:20 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-01-27 22:35 . 2011-01-27 22:39 610816 -c--a-w- C:\RogueKiller.exe
2011-01-26 06:53 . 2011-02-09 09:16 982912 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-26 06:53 . 2011-02-09 09:16 265088 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-01-26 06:31 . 2011-02-09 09:16 144384 ----a-w- c:\windows\system32\cdd.dll
2011-01-13 10:20 . 2011-02-01 18:59 7844688 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A8107B2B-0B09-46DB-937A-E289190AE066}\mpengine.dll
2011-01-07 08:06 . 2011-02-09 09:16 46080 ----a-w- c:\windows\system32\atmlib.dll
2011-01-07 07:27 . 2011-02-09 09:16 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2011-01-07 05:49 . 2011-02-09 09:16 366080 ----a-w- c:\windows\system32\atmfd.dll
2011-01-07 05:33 . 2011-02-09 09:16 294400 ----a-w- c:\windows\SysWow64\atmfd.dll
2011-01-05 06:20 . 2011-02-09 09:16 612352 ----a-w- c:\windows\system32\vbscript.dll
2011-01-05 05:37 . 2011-02-09 09:16 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
2011-01-05 04:00 . 2011-02-09 09:16 3127808 ----a-w- c:\windows\system32\win32k.sys
2010-11-13 21:10 . 2010-11-13 21:10 401720 ----a-w- c:\program files (x86)\HiJackThis.exe
2010-07-08 09:37 . 2010-07-08 09:37 101544 -c--a-w- c:\program files\Common Files\LinkInstaller.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"00PCTFW"="c:\program files (x86)\PC Tools Firewall Plus\FirewallGUI.exe" [2010-11-29 2676696]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe" [2011-01-11 71216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
R1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [x]
R1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [x]
R1 aswSP;aswSP; [x]
R1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [x]
R2 aswFsBlk;aswFsBlk; [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
R3 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
R3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2010-08-30 15872]
R3 esgiguard;esgiguard; [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\20B5.tmp [x]
R3 netr7364;Hercules USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr7364.sys [x]
R3 pctNdis;PC Tools Firewall Intermediate Filter Service;c:\windows\system32\DRIVERS\pctNdis64.sys [x]
R3 SrvHsfPCI;SrvHsfPCI;c:\windows\system32\DRIVERS\VSTBS26.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2010-11-30 467248]
R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 Boostez votre PC Task Manager;Boostez votre PC Task Manager;c:\progra~2\VCOM\Fix-It\mxtask.exe [2007-08-16 159744]
R4 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-31 136176]
R4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2011-01-24 420864]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [x]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-08-20 99408]
S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 Updatesrv;BitDefender Desktop Update Service;c:\program files\BitDefender\BitDefender 2011\updatesrv.exe [2011-02-11 53224]
S3 AKDWC20ET;Hercules Dualpix HD Webcam;c:\windows\system32\Drivers\HDVidvx.sys [x]
S3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [x]
S3 hxctlflt;hxctlflt;c:\windows\system32\DRIVERS\hxctlflt.sys [x]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter64.sys [x]
S3 pctNdisMP;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis64.sys [x]
S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*Deregistered* - pctESPInject
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contenu du dossier 'Tâches planifiées'
.
2011-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-31 23:43]
.
2011-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-31 23:43]
.
.DAgent"="c:\program files\BitDefender\BitDefender 2011\bdagent.exe" [2011-02-11 2008640]
.
------- Examen supplémentaire -------
.
ustart page = about:blank
mStart Page = about:blank
mLocal Page = hxxp://www.google.com/
FF - ProfilePath - c:\users\nikita\AppData\Roaming\Mozilla\Firefox\Profiles\d4ub93nl.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: HTTPS-Everywhere: https-everywhere@eff.org - %profile%\extensions\https-everywhere@eff.org
FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
FF - Ext: BitDefender Antiphishing Toolbar: FFToolbar@bitdefender.com - c:\program files\BitDefender\BitDefender 2011\bdaphffext
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHELINS SUPPRIMES - - - -
.
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\20B5.tmp"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Swearware\backup\winsock2\Parameters]
@DACL=(02 0000)
@SACL=
"NameSpace_Callout"=expand:"%SystemRoot%\\System32\\fwpuclnt.dll"
"WinSock_Registry_Version"="2.0"
"AutodialDLL"="rasadhlp.dll"
"Current_NameSpace_Catalog"="NameSpace_Catalog5"
"Current_Protocol_Catalog"="Protocol_Catalog9"
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet004\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2011-03-24 17:31:51
ComboFix-quarantined-files.txt 2011-03-24 16:31
.
Avant-CF: 17 569 611 776 octets libres
Après-CF: 17 708 802 048 octets libres
.
- - End Of File - - B38F21ED2A9643B7EFEFF68C51CE062F

--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\ieshow.exe" [2011-01-11 76360]
"B

ok

1)

Copie tout le texte présent en gras ci-dessous ( tu le selectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )

[HKLM\Software\Canneverbe Limited\OpenCandy]
[HKLM\Software\Conduit]
O43 - CFD: 17/03/2011 - 16:13:42 - [3353] ----D- C:\ProgramData\8110000-4b19-46bd-c6a6-e3c1f2e7c88b
C:\ProgramData\8110000-4b19-46bd-c6a6-e3c1f2e7c88b
O2 - BHO: (no name) [64Bits] - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} Clé orpheline
[HKCU\Software\AppDataLow\Software\uTorrentBar_FR]
O43 - CFD: 25/12/2010 - 00:27:14 - [159840] ----D- C:\Program Files (x86)\uTorrentBar_FR

Puis Lance ZHPFix depuis le raccourci du bureau .

* Une fois l'outil ZHPFix ouvert , clique sur le bouton [ H ] ( "coller les lignes Helper" ) .

* Dans l'encadré principal tu verras donc les lignes que tu as copié précédemment apparaitrent .

Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

Clique sur " Ok " , puis " Tous " et enfin " Nettoyer ".

Copie/Colle le rapport à l'écran dans ton prochain message

le rapport se trouve dans le dossier de zhpdiag dans program files sous le nom de ZHPFixReport

_________

2)

Téléchargez MalwareByte's Anti-Malware (que tu pourras garder ensuite)

https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

. Enregistres le sur le bureau
. Double cliques sur le fichier téléchargé pour lancer le processus d'installation.
. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen rapide
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller

Si tu as besoin d'aide regarde ces tutoriels :
Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

BONJOUR
Rapport de ZHPFix 1.12.3263 par Nicolas Coolman, Update du 22/03/2011
Fichier d'export Registre :
Run by meto at 25/03/2011 08:09:23
Windows 7 Ultimate Edition, 64-bit (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Contact : nicolascoolman@yahoo.fr

========== Clé(s) du Registre ==========
HKLM\Software\Canneverbe Limited\OpenCandy => Clé absente
HKLM\Software\Conduit => Clé absente
O2 - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} Clé orpheline => Clé non supprimée
HKCU\Software\AppDataLow\Software\uTorrentBar_FR => Clé supprimée avec succès

========== Dossier(s) ==========
C:\ProgramData\8110000-4b19-46bd-c6a6-e3c1f2e7c88b => Supprimé et mis en quarantaine
C:\Program Files (x86)\uTorrentBar_FR => Fichier supprimé au reboot

========== Fichier(s) ==========
c:\programdata\8110000-4b19-46bd-c6a6-e3c1f2e7c88b => Fichier absent

========== Récapitulatif ==========
4 : Clé(s) du Registre
2 : Dossier(s)
1 : Fichier(s)

End of the scan
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Version de la base de données: 6164

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

25/03/2011 10:01:38
mbam-log-2011-03-25 (10-01-38).txt

Type d'examen: Examen complet (A:\|C:\|D:\|F:\|G:\|)
Elément(s) analysé(s): 391142
Temps écoulé: 43 minute(s), 29 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
f:\mes.telechargement\windows xp pro keygen\windows xp pro keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
f:\windows xp pro keygen\windows xp pro keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

J' ai refais un scan avec ZHPDIAG car j'ai un doute sur quelques lignes et j'ai toujours mon pc qui est très lent a démarrer tu peux me dire ce que tu en pense.Rapport de ZHPDiag v1.27.1832 par Nicolas Coolman, Update du 24/03/2011
Run by meto at 25/03/2011 08:38:22
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Contact : nicolascoolman@yahoo.fr

---\\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385

---\\ System Information
Windows 7 Ultimate Edition, 64-bit (Build 7600)
Processor: Intel64 Family 6 Model 15 Stepping 6, GenuineIntel
Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3071 MB (66% free)
System Restore: Activé (Enable)
System drive C: has 4 GB (1%) free of 298 GB

---\\ Logged in mode
Computer Name: METO-PC
User Name: meto
All Users Names: ouahiba, meto, HomeGroupUser$, Guest, Administrator,
Unselected Option: O45,O61,O62,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=C:\Users\meto\AppData\Roaming
%LocalAppData%=C:\Users\meto\AppData\Local
%StartMenu%=C:\Users\meto\AppData\Roaming\Microsoft\Windows\Start Menu

---\\ DOS/Devices
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 4 Go of 298 Go)
D:\ CD-ROM drive (Not Inserted)
F:\ Hard drive, Flash drive, Thumb drive (Free 5 Go of 75 Go)
G:\ Floppy drive, Flash card reader, USB Key (Free 3 Go of 4 Go)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoFolderOptions: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableTaskMgr: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] DisableRegistryTools: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] NoDispScrSavPage: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK

---\\ Recherche particulière de fichiers génériques
[MD5.9AAAEC8DAC27AA17B053E6352AD233AE] - (.Microsoft Corporation - Explorateur Windows.) (.31/10/2009 07:34:59.) -- C:\Windows\Explorer.exe [2870272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.78B9ADA2BC8946AF7B17678E0D07A773] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.21/12/2010 06:38:22.) -- C:\Windows\System32\wininet.dll [981504]

---\\ Processus lancés
[MD5.185DC440D18181D9FBB074C326A2D1D0] - (.PC Tools - PC Tools Firewall Plus service.) -- C:\Program Files (x86)\PC Tools Firewall Plus\FWService.exe [287024]
[MD5.FFC7CF5E4DAEDC38A818E9890EF337D2] - (.PC Tools - PC Tools Firewall GUI.) -- C:\Program Files (x86)\PC Tools Firewall Plus\FirewallGUI.exe [2676696]
[MD5.3BD9A5E2020F84253C21B554AE8E01AB] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [641536]

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@ma-config.com/HardwareDetection] - (.Cybelsoft - Plugin NPAPI Ma-Config.com.) -- C:\Program Files\ma-config.com\nphardwaredetection.dll
P2 - FPN: [HKLM] [@microsoft.com/GENUINE] - (.Microsoft Corporation - Windows Activation Technologies Plugin for Mozilla.) -- C:\Windows\system32\Wat\npWatWeb.dll
M0 - MFSP: prefs.js [meto - d4ub93nl.default] https://start.mozilla.org/fr/
M2 - MFEP: prefs.js [meto - d4ub93nl.default\https-everywhere@eff.org] [] HTTPS-Everywhere v0.9.4 (.Mike Perry & Peter Eckersley.)
M2 - MFEP: prefs.js [meto - d4ub93nl.default\{73a6fe31-595d-460b-a920-fcc0f8843232}] [noscript] NoScript v2.0.9.9 (.Giorgio Maone.)
M2 - MFEP: prefs.js [meto - d4ub93nl.default\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}] [adblockplus] Adblock Plus v1.3.3 (.Wladimir Palant.)
M2 - MFEP: prefs.js [meto - d4ub93nl.default\{e001c731-5e37-4538-a5cb-8168736a2360}] [bitdefender] BitDefender QuickScan v0.9.9.77 (.Echipa R&D BitDefender.)
M2 - MFEP: prefs.js [meto - d4ub93nl.default\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}] [] Adobe DLM (powered by getPlus(R)) v1.6.2.99 (.NOS Microsystems Ltd..)

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.microsoft.com/fr-fr/
R0 - HKUS\S-1-5-21-2081683080-435440617-1289148278-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.bing.com/?toHttps=1&redig=17DBE7D168544FA98200E890A8051984
R1 - HKUS\S-1-5-21-2081683080-435440617-1289148278-1001\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\System32\ieframe.dll
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

---\\ ---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper [64Bits] - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) [64Bits] - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} Clé orpheline

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: BitDefender Toolbar [64Bits] - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} . (.BitDefender S.R.L. - BitDefender Antiphishing Toolbar.) -- C:\Program Files\BitDefender\BitDefender 2011\IEToolbar.dll

---\\ ---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] . (.BitDefender S.R.L. - IEShow Application.) -- C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe
O4 - HKLM\..\Run: [BDAgent] . (.BitDefender S.R.L. - BitDefender Agent.) -- C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
O4 - HKLM\..\Wow6432Node\Run: [00PCTFW] . (.PC Tools - PC Tools Firewall GUI.) -- C:\Program Files (x86)\PC Tools Firewall Plus\FirewallGUI.exe
O4 - HKLM\..\Wow6432Node\Run: [BitDefender Antiphishing Helper] . (.BitDefender S.R.L. - IEShow Application.) -- C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

---\\ ---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Boostez votre PC.lnk . (.Avanquest Software USA, Inc..) -- C:\Program Files (x86)\VCOM\Fix-It\Fix-It.exe
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk . (.FileHippo.com.) -- C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\meto\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk . (.BitTorrent, Inc..) -- C:\Program Files (x86)\uTorrent\uTorrent.exe

---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32\napinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {615A1925-0E5B-4767-A65E-3165AEAC32A3} (BitDefender QuickScan Control) - https://www.bitdefender.com/toolbox/
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} () - http://download.eset.com/special/eos/OnlineScanner.cab

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0FC42D80-8CC5-4A30-940E-8D7B1EB42131}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{0FC42D80-8CC5-4A30-940E-8D7B1EB42131}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Contrôleur de site Web.) -- C:\Windows\system32\webcheck.dll

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (Boostez votre PC Task Manager) . (.Avanquest Software USA, Inc. - MXTask Background Service.) - C:\PROGRA~2\VCOM\Fix-It\mxtask.exe
O23 - Service: (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: (maconfservice) . (.CybelSoft - Service de détection matériel.) - C:\Program Files\ma-config.com\x64\maconfservice.exe
O23 - Service: (MEMSWEEP2) . (.Sophos Plc - Memsweep kernel driver.) - C:\Windows\system32\20B5.tmp
O23 - Service: (NVSvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 260.9.) - C:\Windows\system32\nvvsvc.exe
O23 - Service: (PCToolsFirewallPlus) . (.PC Tools - PC Tools Firewall Plus service.) - C:\Program Files (x86)\PC Tools Firewall Plus\FWService.exe
O23 - Service: (Update Server) . (.BitDefender - Bitdefender Web Server.) - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: (Updatesrv) . (.BitDefender S.R.L. - BitDefender Update Service.) - C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
O23 - Service: (VSSERV) . (.BitDefender S.R.L. - BitDefender Security Service.) - C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) - (.not file.)

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[MD5.00000000000000000000000000000000] [APT] [Game_Booster_Startup] (.Pas de propriétaire.) -- C:\Program Files (x86)\IObit\Game Booster\gbtray.exe (.not file.)
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.2E5212A0BFB98FE0167C92C76C87AFE3] [APT] [Java Update Scheduler] (.Sun Microsystems, Inc..) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
[MD5.00000000000000000000000000000000] [APT] [MyDefrag v4.3.1 Daily] (.Pas de propriétaire.) -- C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticDaily.MyD" (.not file.)
[MD5.00000000000000000000000000000000] [APT] [MyDefrag v4.3.1 Monthly] (.Pas de propriétaire.) -- C:\Program Files\MyDefrag v4.3.1\Scripts\AutomaticMonthly.MyD" (.not file.)
[MD5.00000000000000000000000000000000] [APT] [TuneUpUtilities_Task_BkGndMaintenance] (.Pas de propriétaire.) -- C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe (.not file.)
[MD5.709F3F3D79FD5F1BD9BAF6C43824699D] [APT] [{016B4B7A-278C-4511-89BC-F32B5F8E3CC0}] (.Creative Technology Ltd.) -- C:\Users\meto\Desktop\sound\EmuPMX_PCDrv_US_2_30_00_BETA.exe
[MD5.973567B98CDFC147DF4E60471D9DF072] [APT] [{021678AF-E58E-4114-9BB9-FD51387D9174}] (.Pas de propriétaire.) -- C:\PROGRA~2\UTORRE~1\UNWISE.exe
[MD5.709F3F3D79FD5F1BD9BAF6C43824699D] [APT] [{2F948F1E-408E-4D5A-BAA1-D54924DF0EEF}] (.Creative Technology Ltd.) -- C:\Users\meto\Desktop\sound\EmuPMX_PCDrv_US_2_30_00_BETA.exe
[MD5.2F881390B9BBD912D790A4875CB33A34] [APT] [{3E5201B6-5F32-4644-A709-8313AEEC5466}] (.Mozilla Corporation.) -- c:\program files (x86)\mozilla firefox\firefox.exe
[MD5.387121B985938FB3B41256D6FAEC8EB1] [APT] [{411BFF41-1712-44F4-AAF4-B24006CEE961}] (.Macrovision Corporation.) -- C:\Users\meto\Downloads\hercules.HD\HHD_v3.2.2.1.exe
[MD5.2F881390B9BBD912D790A4875CB33A34] [APT] [{4E57AC6E-2295-47C6-9F00-D1AE258705E5}] (.Mozilla Corporation.) -- c:\program files (x86)\mozilla firefox\firefox.exe
[MD5.2F881390B9BBD912D790A4875CB33A34] [APT] [{6F87C22A-B92C-4BB9-A8CF-104A8D96FB5B}] (.Mozilla Corporation.) -- c:\program files (x86)\mozilla firefox\firefox.exe
[MD5.2F881390B9BBD912D790A4875CB33A34] [APT] [{76E1250E-D6E6-4829-98CC-38750D4A5A46}] (.Mozilla Corporation.) -- c:\program files (x86)\mozilla firefox\firefox.exe
[MD5.00000000000000000000000000000000] [APT] [{97DCD5CF-BE63-4968-9EFB-97C097C7BE44}] (.Pas de propriétaire.) -- D:\RUNA4W32.exe (.not file.)
[MD5.A531E07BBF9BC1CF4EA8BA2F760E3FEE] [APT] [{9B696E4E-82DF-42E0-8A4A-A4BC64E0E683}] (.Skype Technologies S.A..) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
[MD5.00000000000000000000000000000000] [APT] [{AA8CDC39-E238-446D-A715-F4714666D686}] (.Pas de propriétaire.) -- C:\Program Files (x86)\SpywareGuard\unins000.exe (.not file.)
[MD5.709F3F3D79FD5F1BD9BAF6C43824699D] [APT] [{BD972301-1091-49AD-9E55-4901EE5F797E}] (.Creative Technology Ltd.) -- C:\Users\meto\Desktop\sound\EmuPMX_PCDrv_US_2_30_00_BETA.exe
[MD5.00000000000000000000000000000000] [APT] [{C9CDB721-93B5-49C9-A69D-377802FA8A03}] (.Pas de propriétaire.) -- C:\Program Files (x86)\Panda Security\ActiveScan 2.0\as2uninst.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{DA4440B4-0A18-41D9-9E65-8DE78C7FE470}] (.Pas de propriétaire.) -- C:\Users\meto\AppData\Local\Temp\Temp1_EmuPMX_PCDrv_US_2_30_00_BETA.zip\EmuPMX_PCDrv_US_2_30_00_BETA.exe (.not file.)
[MD5.25B7D7D26CE7486A9CCD67C735088B2B] [APT] [{F6D48B97-2386-49F0-987D-27BF268B53E5}] (.Pas de propriétaire.) -- C:\Users\meto\Desktop\ComboFix.exe

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (a2injectiondriver) . (. - .) - C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys
O41 - Driver: (a2util) . (. - .) - C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (bdfwfpf) . (.BitDefender - BitDefender Firewall WFP Filter Driver.) - C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\System32\drivers\csc.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys
O41 - Driver: C:\Windows\system32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys
O41 - Driver: C:\Windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys
O41 - Driver: (pctgntdi) . (.PC Tools - PC Tools Generic TDI Driver.) - C:\Windows\system32\drivers\pctgntdi64.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERS\rdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys
O41 - Driver: (SAVRKBootTasks) . (. - .) - C:\Windows\system32\SAVRKBootTasks.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\Windows\System32\DRIVERS\serial.sys
O41 - Driver: C:\Windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys
O41 - Driver: (vflt) . (.Shrew Soft Inc - Shrew Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\vfilter.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\Windows\System32\DRIVERS\vwififlt.sys
O41 - Driver: C:\Windows\system32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys

---\\ Logiciels installés (O42)
O42 - Logiciel: 7-Zip 9.20 (x64 edition) - (.Igor Pavlov.) [HKLM] -- {23170F69-40C1-2702-0920-000001000000}
O42 - Logiciel: Adobe Download Manager - (.NOS Microsystems Ltd..) [HKLM][64Bits] -- {E2883E8F-472F-4fb0-9522-AC9BF37916A7}
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin
O42 - Logiciel: BitDefender Antivirus Pro 2011 - (.BitDefender.) [HKLM] -- BitDefender
O42 - Logiciel: BitDefender Antivirus Pro 2011 - (.BitDefender.) [HKLM] -- {73FAD870-C7A8-4344-BA8F-DF8675276E91}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: CDBurnerXP - (.CDBurnerXP.) [HKLM] -- {7E265513-8CDA-4631-B696-F40D983F3B07}_is1
O42 - Logiciel: FileHippo.com Update Checker - (.Pas de propriétaire.) [HKLM][64Bits] -- FileHippo.com
O42 - Logiciel: HP USB Disk Storage Format Tool - (.Pas de propriétaire.) [HKLM][64Bits] -- {0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}
O42 - Logiciel: Ma-Config.com (64 bits) - (.Cybelsoft.) [HKLM] -- {80CF423D-D542-40C4-86DF-951CC31B125C}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM] -- {B6E3757B-5E77-3915-866A-CCFC4B8D194C}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable (x64) - (.Microsoft Corporation.) [HKLM] -- {071c9b48-7c32-4621-a0ac-3f809523288f}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM][64Bits] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {EE936C7A-EA40-31D5-9B65-8E3E089C3828}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 - (.Microsoft Corporation.) [HKLM] -- {350AA351-21FA-3270-8B7A-835434E766AD}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {8220EEFE-38CD-377E-8595-13398D740ACE}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM][64Bits] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Mozilla Firefox (3.6.15) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox (3.6.15)
O42 - Logiciel: MyDefrag v4.3.1 - (.J.C. Kessels.) [HKLM] -- MyDefrag v4.3.1_is1
O42 - Logiciel: NVIDIA Logiciel système PhysX 9.10.0514 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX
O42 - Logiciel: NVIDIA Pilote graphique 260.99 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver
O42 - Logiciel: PC Tools Firewall Plus 7.0 - (.PC Tools.) [HKLM][64Bits] -- PC Tools Firewall Plus
O42 - Logiciel: Pdf995 - (.Pas de propriétaire.) [HKLM][64Bits] -- Pdf995
O42 - Logiciel: Revo Uninstaller 1.91 - (.VS Revo Group.) [HKLM][64Bits] -- Revo Uninstaller
O42 - Logiciel: Sophos Anti-Rootkit 1.5.4 - (.Sophos Plc.) [HKLM][64Bits] -- Sophos-AntiRootkit

---\\ HKCU & HKLM Software Keys
[HKCU\Software\7-Zip]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\ISWVolatile]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\BVRP Software]
[HKCU\Software\BitDefender]
[HKCU\Software\BitTorrent]
[HKCU\Software\Brother]
[HKCU\Software\Canneverbe Limited]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\CodeGear]
[HKCU\Software\DigitalVolcano]
[HKCU\Software\FileHippo.com]
[HKCU\Software\GlarySoft]
[HKCU\Software\Hercules]
[HKCU\Software\IDAVLab]
[HKCU\Software\JavaSoft]
[HKCU\Software\LowRegistry]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\Mozilla]
[HKCU\Software\MyDefrag]
[HKCU\Software\OpenOffice.org]
[HKCU\Software\OpenXML-ODF Translator]
[HKCU\Software\PCTools]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\RegisteredApplications]
[HKCU\Software\Sysinternals]
[HKCU\Software\VSRevoGroup]
[HKCU\Software\Wget]
[HKCU\Software\Wow6432Node]
[HKCU\Software\cybelsoft]
[HKLM\Software\7-Zip]
[HKLM\Software\7-Zip]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\AMI]
[HKLM\Software\AVC3]
[HKLM\Software\AVC3]
[HKLM\Software\Adobe]
[HKLM\Software\Adobe]
[HKLM\Software\BrowserChoice]
[HKLM\Software\CXT]
[HKLM\Software\Canneverbe Limited]
[HKLM\Software\Canneverbe Limited]
[HKLM\Software\Classes]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Clients]
[HKLM\Software\Conduit]
[HKLM\Software\Google]
[HKLM\Software\Hercules Technologies]
[HKLM\Software\Hercules]
[HKLM\Software\Hercules]
[HKLM\Software\InfoWatch]
[HKLM\Software\Intel]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\Khronos]
[HKLM\Software\Khronos]
[HKLM\Software\Licenses]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MidasHeurScanner]
[HKLM\Software\MidasHeurScanner]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\Mozilla]
[HKLM\Software\NOS]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\ODBC]
[HKLM\Software\ODBC]
[HKLM\Software\PCTools]
[HKLM\Software\PCTools]
[HKLM\Software\PDF995]
[HKLM\Software\PDF995]
[HKLM\Software\Piriform]
[HKLM\Software\Policies]
[HKLM\Software\Policies]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Sonic]
[HKLM\Software\Swearware]
[HKLM\Software\SymNRT]
[HKLM\Software\VideoLAN]
[HKLM\Software\Wow6432Node]
[HKLM\Software\cybelsoft]
[HKLM\Software\cybelsoft]
[HKLM\Software\mozilla.org]
[HKLM\Software\swearware]

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 19/02/2011 - 16:07:58 - [0] ----D- C:\Program Files\Alwil Software
O43 - CFD: 17/03/2011 - 16:19:52 - [145815654] ----D- C:\Program Files\BitDefender
O43 - CFD: 17/03/2011 - 18:08:26 - [7184728] ----D- C:\Program Files\CCleaner
O43 - CFD: 04/02/2011 - 15:13:42 - [11809078] ----D- C:\Program Files\CDBurnerXP
O43 - CFD: 24/03/2011 - 17:14:54 - [1570066965] ----D- C:\Program Files\Common Files
O43 - CFD: 02/03/2011 - 19:29:58 - [90328596] ----D- C:\Program Files\DVD Maker
O43 - CFD: 02/03/2011 - 19:32:50 - [5238301] ----D- C:\Program Files\Internet Explorer
O43 - CFD: 01/02/2011 - 01:11:12 - [8551958] ----D- C:\Program Files\ma-config.com
O43 - CFD: 25/03/2011 - 08:16:30 - [4933587] ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD: 16/11/2010 - 12:52:02 - [8785] ----D- C:\Program Files\MediaInfo
O43 - CFD: 14/07/2009 - 06:32:40 - [25757] ----D- C:\Program Files\MSBuild
O43 - CFD: 24/03/2011 - 22:16:08 - [5148887] ----D- C:\Program Files\MyDefrag v4.3.1
O43 - CFD: 21/11/2010 - 02:25:56 - [264092437] ----D- C:\Program Files\NVIDIA Corporation
O43 - CFD: 14/07/2009 - 06:32:40 - [36253865] ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 05/09/2010 - 15:15:12 - [1024] ----D- C:\Program Files\S.A.D
O43 - CFD: 14/09/2010 - 23:22:22 - [0] ----D- C:\Program Files\ShrewSoft
O43 - CFD: 19/02/2011 - 19:57:00 - [19426060] ----D- C:\Program Files\Spybot - Search & Destroy
O43 - CFD: 13/02/2011 - 13:45:18 - [14848] ----D- C:\Program Files\SUPERAntiSpyware
O43 - CFD: 14/07/2009 - 06:09:28 - [0] --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 02/03/2011 - 19:29:48 - [4136448] ----D- C:\Program Files\Windows Defender
O43 - CFD: 02/03/2011 - 19:29:48 - [9332856] ----D- C:\Program Files\Windows Journal
O43 - CFD: 02/03/2011 - 19:29:48 - [7191040] ----D- C:\Program Files\Windows Mail
O43 - CFD: 02/03/2011 - 19:32:50 - [7821229] ----D- C:\Program Files\Windows Media Player
O43 - CFD: 14/07/2009 - 06:32:40 - [12687028] ----D- C:\Program Files\Windows NT
O43 - CFD: 02/03/2011 - 19:29:48 - [5555992] ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 02/03/2011 - 19:29:58 - [235008] ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 02/03/2011 - 19:29:48 - [7975221] ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 19/10/2010 - 00:09:46 - [390] ----D- C:\Program Files\WinRAR
O43 - CFD: 17/03/2011 - 16:19:52 - [1506228351] ----D- C:\Program Files\Common Files\BitDefender
O43 - CFD: 03/02/2011 - 12:45:50 - [50839661] ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 14/07/2009 - 04:20:10 - [2702] ----D- C:\Program Files\Common Files\Services
O43 - CFD: 14/07/2009 - 04:20:10 - [611328] ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 26/08/2010 - 01:59:48 - [12283379] ----D- C:\Program Files\Common Files\System
O43 - CFD: 30/12/2010 - 16:40:12 - [124467961] ----D- C:\ProgramData\Adobe
O43 - CFD: 03/03/2011 - 12:30:44 - [538527432] ----D- C:\ProgramData\Alwil Software
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Application Data
O43 - CFD: 23/01/2011 - 23:48:22 - [154284] ----D- C:\ProgramData\Avanquest
O43 - CFD: 18/02/2011 - 17:42:42 - [185023] ----D- C:\ProgramData\Avira
O43 - CFD: 04/02/2011 - 22:31:18 - [154] ----D- C:\ProgramData\bdch
O43 - CFD: 17/03/2011 - 21:26:36 - [1905304] ----D- C:\ProgramData\BitDefender
O43 - CFD: 23/01/2011 - 21:00:04 - [2391] ----D- C:\ProgramData\BVRP Software
O43 - CFD: 15/10/2010 - 22:44:52 - [0] ----D- C:\ProgramData\Canneverbe Limited
O43 - CFD: 06/02/2011 - 19:35:14 - [4212] ----D- C:\ProgramData\CheckPoint
O43 - CFD: 19/02/2011 - 17:29:02 - [0] ----D- C:\ProgramData\Comodo
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Desktop
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Documents
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Favorites
O43 - CFD: 30/01/2011 - 19:18:26 - [7295] ----D- C:\ProgramData\IObit
O43 - CFD: 06/02/2011 - 13:53:14 - [648] ----D- C:\ProgramData\Kaspersky Lab
O43 - CFD: 28/01/2011 - 21:39:42 - [126714616] ----D- C:\ProgramData\Kaspersky Lab Setup Files
O43 - CFD: 06/02/2011 - 13:53:14 - [0] ----D- C:\ProgramData\Kaspersky Lab ZAO
O43 - CFD: 01/02/2011 - 01:11:08 - [1200323] ----D- C:\ProgramData\ma-config.com
O43 - CFD: 20/02/2011 - 20:36:36 - [6469441] ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 15/11/2010 - 23:16:52 - [102274295] -S--D- C:\ProgramData\Microsoft
O43 - CFD: 03/03/2011 - 16:29:38 - [1729] ----D- C:\ProgramData\Norton
O43 - CFD: 28/02/2011 - 23:45:40 - [710090] ----D- C:\ProgramData\NortonInstaller
O43 - CFD: 12/02/2011 - 18:03:30 - [319098] ----D- C:\ProgramData\NOS
O43 - CFD: 10/12/2010 - 00:23:52 - [1011410] ----D- C:\ProgramData\NVIDIA
O43 - CFD: 26/08/2010 - 02:45:34 - [538833] ----D- C:\ProgramData\NVIDIA Corporation
O43 - CFD: 18/02/2011 - 16:43:42 - [0] ----D- C:\ProgramData\PC Tools
O43 - CFD: 22/03/2011 - 14:54:56 - [542631] ----D- C:\ProgramData\pdf995
O43 - CFD: 10/01/2011 - 22:32:20 - [21174784] ----D- C:\ProgramData\Skype
O43 - CFD: 19/02/2011 - 19:58:00 - [83431] ----D- C:\ProgramData\Spybot - Search & Destroy
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 01/09/2010 - 14:21:06 - [224] ----D- C:\ProgramData\Sun
O43 - CFD: 25/01/2011 - 22:46:14 - [0] ----D- C:\ProgramData\SUPERAntiSpyware.com
O43 - CFD: 25/03/2011 - 08:14:24 - [0] ---AD- C:\ProgramData\TEMP
O43 - CFD: 26/08/2010 - 00:39:54 - [0] -SH-D- C:\ProgramData\Templates
O43 - CFD: 05/10/2010 - 00:11:00 - [1781418] ----D- C:\ProgramData\TuneUp Software
O43 - CFD: 23/01/2011 - 20:57:16 - [61952] ----D- C:\ProgramData\VCOM
O43 - CFD: 28/02/2011 - 12:56:38 - [2492] ----D- C:\ProgramData\Windows Genuine Advantage
O43 - CFD: 30/01/2011 - 14:54:58 - [0] ----D- C:\ProgramData\Zbshareware Lab
O43 - CFD: 30/12/2010 - 16:39:20 - [763689] ----D- C:\Users\meto\AppData\Roaming\Adobe
O43 - CFD: 23/01/2011 - 23:48:22 - [3248] ----D- C:\Users\meto\AppData\Roaming\Avanquest
O43 - CFD: 18/02/2011 - 17:44:14 - [0] ----D- C:\Users\meto\AppData\Roaming\Avira
O43 - CFD: 17/03/2011 - 16:20:30 - [67900] ----D- C:\Users\meto\AppData\Roaming\BitDefender
O43 - CFD: 31/08/2010 - 22:57:44 - [0] R---D- C:\Users\meto\AppData\Roaming\Brother
O43 - CFD: 15/10/2010 - 22:44:52 - [1541] ----D- C:\Users\meto\AppData\Roaming\Canneverbe Limited
O43 - CFD: 08/10/2010 - 22:07:38 - [199] ----D- C:\Users\meto\AppData\Roaming\dvdcss
O43 - CFD: 13/02/2011 - 23:00:26 - [181875] ----D- C:\Users\meto\AppData\Roaming\GlarySoft
O43 - CFD: 26/08/2010 - 00:42:24 - [0] ----D- C:\Users\meto\AppData\Roaming\Identities
O43 - CFD: 27/08/2010 - 02:06:12 - [0] ----D- C:\Users\meto\AppData\Roaming\ImgBurn
O43 - CFD: 24/09/2010 - 21:32:54 - [0] ----D- C:\Users\meto\AppData\Roaming\InstallShield
O43 - CFD: 08/02/2011 - 12:26:42 - [3427223] ----D- C:\Users\meto\AppData\Roaming\IObit
O43 - CFD: 26/08/2010 - 04:08:32 - [485] ----D- C:\Users\meto\AppData\Roaming\Macromedia
O43 - CFD: 20/02/2011 - 20:36:40 - [0] ----D- C:\Users\meto\AppData\Roaming\Malwarebytes
O43 - CFD: 14/07/2009 - 08:45:16 - [0] ----D- C:\Users\meto\AppData\Roaming\Media Center Programs
O43 - CFD: 30/12/2010 - 16:39:20 - [1442951] -S--D- C:\Users\meto\AppData\Roaming\Microsoft
O43 - CFD: 26/08/2010 - 04:06:04 - [11574806] ----D- C:\Users\meto\AppData\Roaming\Mozilla
O43 - CFD: 04/11/2010 - 23:55:40 - [2554916] ----D- C:\Users\meto\AppData\Roaming\OpenOffice.org
O43 - CFD: 02/03/2011 - 23:09:12 - [4] ----D- C:\Users\meto\AppData\Roaming\PCToolsFirewallPlus
O43 - CFD: 22/03/2011 - 14:41:10 - [28] ----D- C:\Users\meto\AppData\Roaming\pdf995
O43 - CFD: 24/03/2011 - 16:13:32 - [23478] ----D- C:\Users\meto\AppData\Roaming\QuickScan
O43 - CFD: 23/01/2011 - 23:35:16 - [3242573] ----D- C:\Users\meto\AppData\Roaming\Skype
O43 - CFD: 05/10/2010 - 00:11:08 - [0] ----D- C:\Users\meto\AppData\Roaming\TuneUp Software
O43 - CFD: 20/11/2010 - 03:18:10 - [39442] ----D- C:\Users\meto\AppData\Roaming\Uniblue
O43 - CFD: 06/02/2011 - 13:53:14 - [6436750] ----D- C:\Users\meto\AppData\Roaming\uTorrent
O43 - CFD: 23/01/2011 - 20:57:16 - [133120] ----D- C:\Users\meto\AppData\Roaming\VCOM
O43 - CFD: 04/03/2011 - 22:47:28 - [1082498] ----D- C:\Users\meto\AppData\Roaming\vlc
O43 - CFD: 16/10/2010 - 00:24:48 - [12] ----D- C:\Users\meto\AppData\Roaming\WinRAR
O43 - CFD: 28/01/2011 - 22:44:32 - [0] ----D- C:\Users\meto\AppData\Roaming\Zbshareware Lab
O43 - CFD: 13/02/2011 - 23:12:24 - [4680325] ----D- C:\Program Files (x86)\7-Zip
O43 - CFD: 30/12/2010 - 16:36:44 - [113758333] ----D- C:\Program Files (x86)\Adobe
O43 - CFD: 24/03/2011 - 17:14:54 - [134181880] ----D- C:\Program Files (x86)\Common Files
O43 - CFD: 14/10/2010 - 21:04:10 - [0] ----D- C:\Program Files (x86)\Corel
O43 - CFD: 09/01/2011 - 20:19:22 - [18515] ----D- C:\Program Files (x86)\Duplicate Cleaner
O43 - CFD: 12/02/2011 - 17:57:32 - [381086] ----D- C:\Program Files (x86)\FileHippo.com
O43 - CFD: 09/01/2011 - 13:56:10 - [2908752] ----D- C:\Program Files (x86)\Google
O43 - CFD: 23/01/2011 - 21:18:40 - [45656140] ----D- C:\Program Files (x86)\Hercules
O43 - CFD: 30/01/2011 - 22:53:28 - [106100540] --H-D- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 02/03/2011 - 19:29:58 - [4540949] ----D- C:\Program Files (x86)\Internet Explorer
O43 - CFD: 02/02/2011 - 14:06:14 - [3674242] ----D- C:\Program Files (x86)\IObit
O43 - CFD: 28/02/2011 - 12:42:42 - [88363052] ----D- C:\Program Files (x86)\Java
O43 - CFD: 04/11/2010 - 23:51:46 - [16295712] ----D- C:\Program Files (x86)\JRE
O43 - CFD: 17/03/2011 - 17:47:36 - [0] ----D- C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD: 21/11/2010 - 22:51:46 - [0] ----D- C:\Program Files (x86)\Microsoft Antimalware
O43 - CFD: 06/01/2011 - 13:42:54 - [35014696] ----D- C:\Program Files (x86)\Microsoft Office
O43 - CFD: 26/08/2010 - 03:07:52 - [15715] ----D- C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 06/03/2011 - 01:27:30 - [30464669] ----D- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 14/07/2009 - 06:32:40 - [25757] ----D- C:\Program Files (x86)\MSBuild
O43 - CFD: 20/02/2011 - 16:07:00 - [39692586] ----D- C:\Program Files (x86)\MSECache
O43 - CFD: 12/02/2011 - 18:03:08 - [421776] ----D- C:\Program Files (x86)\NOS
O43 - CFD: 07/01/2011 - 20:41:38 - [82645511] ----D- C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 04/11/2010 - 23:51:46 - [394828056] ----D- C:\Program Files (x86)\OpenOffice.org 3
O43 - CFD: 06/01/2011 - 13:44:28 - [19944795] ----D- C:\Program Files (x86)\OpenXML-ODF Translator
O43 - CFD: 02/03/2011 - 23:09:16 - [27631310] ----D- C:\Program Files (x86)\PC Tools Firewall Plus
O43 - CFD: 22/03/2011 - 14:37:26 - [18195886] ----D- C:\Program Files (x86)\pdf995
O43 - CFD: 14/07/2009 - 06:32:40 - [38597377] ----D- C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 19/02/2011 - 19:58:02 - [22799090] R---D- C:\Program Files (x86)\Skype
O43 - CFD: 28/01/2011 - 23:14:52 - [2875080] ----D- C:\Program Files (x86)\Sophos
O43 - CFD: 19/02/2011 - 19:58:02 - [18366641] ----D- C:\Program Files (x86)\Spybot - Search & Destroy
O43 - CFD: 19/02/2011 - 19:58:02 - [552960] ----D- C:\Program Files (x86)\SpywareGuard
O43 - CFD: 14/07/2009 - 05:57:08 - [0] --H-D- C:\Program Files (x86)\Uninstall Information
O43 - CFD: 30/01/2011 - 14:54:58 - [0] ----D- C:\Program Files (x86)\USB Disk Security
O43 - CFD: 25/12/2010 - 02:01:14 - [395640] ----D- C:\Program Files (x86)\uTorrent
O43 - CFD: 25/12/2010 - 00:27:14 - [159840] ----D- C:\Program Files (x86)\uTorrentBar_FR
O43 - CFD: 19/02/2011 - 19:54:38 - [59349880] ----D- C:\Program Files (x86)\VCOM
O43 - CFD: 08/09/2010 - 22:41:34 - [78884139] ----D- C:\Program Files (x86)\VideoLAN
O43 - CFD: 02/02/2011 - 14:03:30 - [0] ----D- C:\Program Files (x86)\vira
O43 - CFD: 10/11/2010 - 13:31:32 - [6770777] ----D- C:\Program Files (x86)\VS Revo Group
O43 - CFD: 26/08/2010 - 01:59:50 - [575488] ----D- C:\Program Files (x86)\Windows Defender
O43 - CFD: 02/03/2011 - 19:29:48 - [6704640] ----D- C:\Program Files (x86)\Windows Mail
O43 - CFD: 02/03/2011 - 19:29:58 - [5114641] ----D- C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 06:32:40 - [12257460] ----D- C:\Program Files (x86)\Windows NT
O43 - CFD: 02/03/2011 - 19:29:48 - [4457224] ----D- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 02/03/2011 - 19:29:58 - [189440] ----D- C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 02/03/2011 - 19:29:48 - [6923916] ----D- C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 25/03/2011 - 08:38:46 - [3997904] ----D- C:\Program Files (x86)\ZHPDiag
O43 - CFD: 17/03/2011 - 16:19:52 - [1506228351] ----D- C:\Program Files\Common Files\BitDefender
O43 - CFD: 03/02/2011 - 12:45:50 - [50839661] ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 14/07/2009 - 04:20:10 - [2702] ----D- C:\Program Files\Common Files\Services
O43 - CFD: 14/07/2009 - 04:20:10 - [611328] ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 26/08/2010 - 01:59:48 - [12283379] ----D- C:\Program Files\Common Files\System

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.9D93D16E3012EE01737981A0BDF9D20F] - 25/03/2011 - 08:34:30 ---A- . (...) -- C:\Windows\SysNative\PerfStringBackup.INI [1549700]
O44 - LFC:[MD5.C2AF69C00847F13608D8E8A994B46911] - 25/03/2011 - 08:34:30 ---A- . (...) -- C:\Windows\SysNative\perfc009.dat [106190]
O44 - LFC:[MD5.97A4DEE41FA7032654D651B2C3D72521] - 25/03/2011 - 08:34:30 ---A- . (...) -- C:\Windows\SysNative\perfc00C.dat [130068]
O44 - LFC:[MD5.2A8E4DED327C5F6D1275E7B83A2E2B18] - 25/03/2011 - 08:34:30 ---A- . (...) -- C:\Windows\SysNative\perfh009.dat [615810]
O44 - LFC:[MD5.BCC4CF378D4DC405FD61973D1C8F417E] - 25/03/2011 - 08:34:30 ---A- . (...) -- C:\Windows\SysNative\perfh00C.dat [702362]
O44 - LFC:[MD5.156E486CA0A8C7796C0C2B5EC5D4C462] - 25/03/2011 - 08:18:59 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [14416]
O44 - LFC:[MD5.156E486CA0A8C7796C0C2B5EC5D4C462] - 25/03/2011 - 08:18:59 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [14416]
O44 - LFC:[MD5.988FF19B29CF2EF8136FCB4ACD6528CD] - 25/03/2011 - 08:13:44 ---A- . (...) -- C:\Windows\setupact.log [2026]
O44 - LFC:[MD5.D22C5BBADAEE751022A5C3795A4C7981] - 25/03/2011 - 08:13:43 -S-A- . (...) -- C:\Windows\bootstat.dat [67584]
O44 - LFC:[MD5.4C7BB3B15B27DE2F48CDBB12A9F577A5] - 25/03/2011 - 08:13:27 ---A- . (...) -- C:\Windows\PFRO.log [958]
O44 - LFC:[MD5.C340AB3A629B1008659E1AFB2F8B699F] - 25/03/2011 - 08:11:07 ---A- . (...) -- C:\bdlog.txt [65250]
O44 - LFC:[MD5.14000000000000000000000098EE1800] - 25/03/2011 - 08:11:03 ---A- . (...) -- C:\Windows\WindowsUpdate.log [1267848]
O44 - LFC:[MD5.2D23EB1FD7363563762335DF42DD1C10] - 25/03/2011 - 08:09:28 ---A- . (...) -- C:\ZHPExportRegistry-25-03-2011-08-09-27.txt [2398]
O44 - LFC:[MD5.AA86D87E16C1F3C962B39E7EA92939E2] - 24/03/2011 - 17:31:56 ---A- . (...) -- C:\ComboFix.txt [14855]
O44 - LFC:[MD5.3CF3D4A45CC2AF973DBC30EC8D33252B] - 24/03/2011 - 17:23:05 ---A- . (...) -- C:\Windows\system.ini [215]
O44 - LFC:[MD5.B1A9CF0B6F80611D31987C247EC630B4] - 24/03/2011 - 16:53:02 ---A- . (.SteelWerX - Freeware implementation of XCACLS.) -- C:\Windows\SWXCACLS.exe [212480]
O44 - LFC:[MD5.61E418718CDBC1638DC5BD6073BE0DEF] - 24/03/2011 - 16:09:44 ---A- . (...) -- C:\Windows\SysNative\cloud_stats.log [957]
O44 - LFC:[MD5.C81DD98737DA7955490F908DEA0E516F] - 24/03/2011 - 14:28:05 ---A- . (...) -- C:\PhysicalDisk0_MBR.bin [512]
O44 - LFC:[MD5.1873718037AF30223002A195232400DA] - 22/03/2011 - 14:54:56 ---A- . (...) -- C:\Windows\wpd99.drv [59]
O44 - LFC:[MD5.EA1825AA57CAEDAC8E80400CE1D5C1AD] - 22/03/2011 - 14:35:11 ---A- . (.TODO: <Company name> - TODO: <File description>.) -- C:\Windows\SysNative\pdfmona64.dll [320512]
O44 - LFC:[MD5.F33DC4433E8C55FE66CED8CE037F1097] - 22/03/2011 - 14:35:10 ---A- . (...) -- C:\Windows\System32\pdf995mon64.dll [47616]
O44 - LFC:[MD5.6152EF07252D6770BF294743F8C10976] - 18/03/2011 - 00:10:50 ---A- . (...) -- C:\Windows\SysNative\user_gensett.xml [415]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 18/03/2011 - 00:10:16 ---A- . (...) -- C:\Windows\setuperr.log [0]
O44 - LFC:[MD5.F33DC4433E8C55FE66CED8CE037F1097] - 19/10/2006 - 21:44:58 ---A- . (...) -- C:\Windows\SysNative\pdf995mon64.dll [47616]
O44 - LFC:[MD5.ACDBB03510DF14389304D793295962AD] - 30/06/2005 - 15:29:00 ---A- . (...) -- C:\Windows\SysNative\pdf995mon64ui.dll [11264]

---\\ Trojan Driver Search Data (HKLM) (O52)
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\CamserviceHD [Key] . (.Guillemot Corporation S.A. - Hercules Xtra Controller Main Application.) -- C:\Program Files (x86)\Hercules\Dualpix HD\XtrCtrl.exe
O53 - SMSR:HKLM\...\startupreg\SunJavaUpdateSched [Key] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

---\\ Microsoft Control Security Providers (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll

---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3
O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=
O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableRegistryTools"=0

---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "ClearRecentDocsOnExit"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDrives"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=255
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveAutoRun"=67108863
O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutorunSetting"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDrives"=0

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\system32\drivers\adp94xx.sys [491088]
O58 - SDL:[MD5.597F78224EE9224EA1A13D6350CED962] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\system32\drivers\adpahci.sys [339536]
O58 - SDL:[MD5.E109549C90F62FB570B9540C4B148E54] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver (X64).) -- C:\Windows\system32\drivers\adpu320.sys [182864]
O58 - SDL:[MD5.5812713A477A3AD7363C7438CA2EE038] - 14/07/2009 - 02:52:21 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\system32\drivers\aliide.sys [15440]
O58 - SDL:[MD5.7A4B413614C055935567CF88A9734D38] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\system32\drivers\amdsata.sys [106576]
O58 - SDL:[MD5.F67F933E79241ED32FF46A4F29B5120B] - 14/07/2009 - 02:52:20 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows -.) -- C:\Windows\system32\drivers\amdsbs.sys [194128]
O58 - SDL:[MD5.B4AD0CACBAB298671DD6F6EF7E20679D] - 14/07/2009 - 02:52:21 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\system32\drivers\amdxata.sys [28752]
O58 - SDL:[MD5.C484F8CEB1717C540242531DB7845C4E] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\system32\drivers\arc.sys [87632]
O58 - SDL:[MD5.019AF6924AEFE7839F61C830227FE79C] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\system32\drivers\arcsas.sys [97856]
O58 - SDL:[MD5.34FC546A5C13DAE1AA07DEFD579EFFE7] - 29/11/2010 - 13:14:30 ---A- . (.BitDefender - Active Virus Control filter driver.) -- C:\Windows\system32\drivers\avc3.sys [591968]
O58 - SDL:[MD5.8A1FAFE409B3D24D55BE62BFC8ECEC8E] - 29/11/2010 - 13:14:36 ---A- . (.BitDefender - Active Virus Control Kernel Filtering driver.) -- C:\Windows\system32\drivers\avckf.sys [1186272]
O58 - SDL:[MD5.B5ACE6968304A3900EEB1EBFD9622DF2] - 10/06/2009 - 21:34:23 ---A- . (.Broadcom Corporation - Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver..) -- C:\Windows\system32\drivers\b57nd60a.sys [270848]
O58 - SDL:[MD5.57A812537B752E2B0409576120183E4F] - 13/05/2010 - 15:52:08 ---A- . (.BitDefender S.R.L. Bucharest, ROMANIA - BitDefender Active Virus Control Filter Driver.) -- C:\Windows\system32\drivers\bdfm.sys [162896]
O58 - SDL:[MD5.FD25D9E7054A422BD9A4C6540B2B8290] - 09/07/2010 - 14:08:16 ---A- . (.BitDefender - BitDefender AntiVirus FS filter driver.) -- C:\Windows\system32\drivers\bdfsfltr.sys [388168]
O58 - SDL:[MD5.191150400EB109085C4111D739F92528] - 13/05/2010 - 15:52:46 ---A- . (.BitDefender S.R.L. Bucharest, ROMANIA - BitDefender AntiVirus Hypervisor driver.) -- C:\Windows\system32\drivers\bdhv.sys [101968]
O58 - SDL:[MD5.F09EEE9EDC320B5E1501F749FDE686C8] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver.) -- C:\Windows\system32\drivers\BrFiltLo.sys [18432]
O58 - SDL:[MD5.B114D3098E9BDB8BEA8B053685831BE6] - 10/06/2009 - 21:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver.) -- C:\Windows\system32\drivers\BrFiltUp.sys [8704]
O58 - SDL:[MD5.43BEA8D483BF1870F018E2D02E06A5BD] - 14/07/2009 - 02:19:07 ---A- . (.Brother Industries Ltd. - Pilote Brother Série I/F (WDM).) -- C:\Windows\system32\drivers\BrSerId.sys [286720]
O58 - SDL:[MD5.A6ECA2151B08A09CACECA35C07F05B42] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\system32\drivers\BrSerWdm.sys [47104]
O58 - SDL:[MD5.B79968002C277E869CF38BD22CD61524] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\system32\drivers\BrUsbMdm.sys [14976]
O58 - SDL:[MD5.A87528880231C54E75EA7A44943B38BF] - 10/06/2009 - 21:41:10 ---A- . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\system32\drivers\BrUsbSer.sys [14720]
O58 - SDL:[MD5.3E5B191307609F7514148C6832BB0842] - 10/06/2009 - 21:34:28 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\system32\drivers\bxvbda.sys [468480]
O58 - SDL:[MD5.E19D3F095812725D88F9001985B94EDD] - 14/07/2009 - 02:52:31 ---A- . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\system32\drivers\cmdide.sys [17488]
O58 - SDL:[MD5.AB1201F8DE199E764DA9A32ABF71049C] - 14/12/2009 - 12:44:24 ---A- . (.Infowatch - Cryptographic Algorithm Lib Driver..) -- C:\Windows\system32\drivers\CSCrySec.sys [85048]
O58 - SDL:[MD5.A6EED705BB510FA6B0F9F097165A3395] - 14/12/2009 - 12:44:24 ---A- . (.Infowatch - Virtual Volume Container Driver (wnet).) -- C:\Windows\system32\drivers\CSVirtualDiskDrv.sys [66104]
O58 - SDL:[MD5.EDC6E9C057C9D7F83EEA22B4CEF5DCAD] - 10/06/2009 - 21:35:09 ---A- . (.Intel Corporation - Intel(R) PRO/1000 Adapter NDIS 6 deserialized driver.) -- C:\Windows\system32\drivers\E1G6032E.sys [145792]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\system32\drivers\elxstor.sys [530496]
O58 - SDL:[MD5.DC5D737F51BE844D8C82C695EB17372F] - 10/06/2009 - 21:34:33 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\system32\drivers\evbda.sys [3286016]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\system32\drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.8ED7D078B21B7E2DB15A69BFCBEE8691] - 11/10/2007 - 05:45:54 ---A- . (.Guillemont Corporation - Stream Class Mini Driver.) -- C:\Windows\system32\drivers\HDvidvx.sys [186496]
O58 - SDL:[MD5.0886D440058F203EBA0E1825E4355914] - 14/07/2009 - 02:47:48 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\Windows\system32\drivers\HpSAMD.sys [77888]
O58 - SDL:[MD5.4B7423FCC37664954460AC3E71752B62] - 09/02/2009 - 00:43:10 ---A- . (.Guillemot Corporation - Filter Driver for the Hercules Webcams (MJPG).) -- C:\Windows\system32\drivers\hxctlflt.sys [111104]
O58 - SDL:[MD5.D83EFB6FD45DF9D55E9A1AFC63640D50] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\system32\drivers\iaStorV.sys [410688]
O58 - SDL:[MD5.5C18831C61933628F5BB0EA2675B9D21] - 14/07/2009 - 02:48:04 ---A- . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\system32\drivers\iirsp.sys [44112]
O58 - SDL:[MD5.1A93E54EB0ECE102495A51266DCDB6A6] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_fc.sys [114752]
O58 - SDL:[MD5.1047184A9FDC8BDBFF857175875EE810] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas.sys [106560]
O58 - SDL:[MD5.30F5C0DE1EE8B5BC9306C1F0E4A75F93] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_sas2.sys [65600]
O58 - SDL:[MD5.0504EACAFF0D3C8AED161C4B0D369D4A] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SCSI Driver (StorPort).) -- C:\Windows\system32\drivers\lsi_scsi.sys [115776]
O58 - SDL:[MD5.DE5D0DD632EE6977979799DE64CE0951] - 29/11/2010 - 17:42:06 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\system32\drivers\mbam.sys [24152]
O58 - SDL:[MD5.A55805F747C6EDB6A9080D7C633BD0F4] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for.) -- C:\Windows\system32\drivers\megasas.sys [35392]
O58 - SDL:[MD5.BAF74CE0072480C3B6B7C13B2A94D6B3] - 14/07/2009 - 02:48:04 ---A- . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\system32\drivers\MegaSR.sys [284736]
O58 - SDL:[MD5.7B3A86CDA73B3E89FD69666C4329C3B7] - 29/07/2009 - 16:21:58 ---A- . (.Ralink Technology, Corp. - Ralink 802.11 USB Wireless Adapter Driver.) -- C:\Windows\system32\drivers\netr7364.sys [717312]
O58 - SDL:[MD5.77889813BE4D166CDAB78DDBA990DA92] - 14/07/2009 - 02:48:26 ---A- . (.IBM Corporation - IBM ServeRAID Controller Driver.) -- C:\Windows\system32\drivers\nfrd960.sys [51264]
O58 - SDL:[MD5.BBE872A814B00798C2D568D46C42A71B] - 22/10/2010 - 07:23:15 ---A- . (.NVIDIA Corporation - NVIDIA Windows Kernel Mode Driver, Version 260.99.) -- C:\Windows\system32\drivers\nvlddmkm.sys [12432616]
O58 - SDL:[MD5.3E38712941E9BB4DDBEE00AFFE3FED3D] - 14/07/2009 - 02:48:27 ---A- . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\Windows\system32\drivers\nvraid.sys [149056]
O58 - SDL:[MD5.477DC4D6DEB99BE37084C9AC6D013DA1] - 14/07/2009 - 02:45:45 ---A- . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\Windows\system32\drivers\nvstor.sys [167488]
O58 - SDL:[MD5.60F19AF0A9A26851AD9BC2D981AFBAC6] - 29/03/2010 - 11

redemarre le pc puis

Fais un nouveau rapport ZHPdiag stp

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

BONJOUR
https://pjjoint.malekal.com/files.php?id=e351cb6fc9111512
scalpelle

rien de visible

pour les lenteurs du demarrage

Peut être désinstaller ce qui est inutile
Sophos AntiRootkit
SpywareGuard
PC Tools®Firewall Plus pas sûr qu'il soit utile sous seven

..............

De plus

Rends toi sur ce site :

https://www.virustotal.com/gui/

Clique sur parcourir et cherche ce fichier :

C:\Windows\system32\wuaueng.dll
C:\Windows\system32\svchost.exe

Clique sur Send File.

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.


Copie le lien de Virus Total dans ta réponse.(l'url de la page des résultats)

Si tu ne trouves pas le fichier alors

Affiche tous les fichiers et dossiers :

Pour cela :
Clique sur démarrer/panneau de configuration/option des dossiers/affichage

Cocher afficher les dossiers cachés

Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

Décocher masquer les extensions dont le type est connu

Puis fais «appliquer» pour valider les changements.

Et OK

pour C:\Windows\system32\svchost.exe
http://www.virustotal.com/file-scan/reanalysis.html?id=121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2-1301087062
apparemment il est douteux.

Quand a C:\Windows\system32\wuaueng.dll je ne le trouve pas même en affichant les dossiers cachés etc.
et spywareguard n'est pas installer.

on y touche pas...

utilise le raccourci sur ton bureau MBRCheck et poste le rapport stp

Bonjour
je te mets le rapport mbr.
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: ASRock
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: To Be Filled By O.E.M.
System Product Name: To Be Filled By O.E.M.
Logical Drives Mask: 0x0000002d

Kernel Drivers (total 202):
0x0384E000 \SystemRoot\system32\ntoskrnl.exe
0x03805000 \SystemRoot\system32\hal.dll
0x00B99000 \SystemRoot\system32\kdcom.dll
0x00CC9000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D0D000 \SystemRoot\system32\PSHED.dll
0x00D21000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00E70000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F14000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F23000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00F7A000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00F83000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00F8D000 \SystemRoot\system32\DRIVERS\pci.sys
0x00FC0000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00FCD000 \SystemRoot\System32\drivers\partmgr.sys
0x00FE2000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00FEB000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00E00000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00D7F000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E15000 \SystemRoot\system32\DRIVERS\intelide.sys
0x00E1D000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00E2D000 \SystemRoot\System32\drivers\mountmgr.sys
0x00E47000 \SystemRoot\system32\DRIVERS\atapi.sys
0x0107F000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x010A9000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x010B4000 \SystemRoot\system32\drivers\fltmgr.sys
0x01100000 \SystemRoot\system32\drivers\fileinfo.sys
0x01114000 \SystemRoot\system32\DRIVERS\bdfsfltr.sys
0x01179000 \SystemRoot\system32\drivers\TfFsMon.sys
0x0118D000 \SystemRoot\system32\drivers\TfSysMon.sys
0x01219000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0119E000 \SystemRoot\System32\Drivers\msrpc.sys
0x013BC000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01000000 \SystemRoot\System32\Drivers\cng.sys
0x013D6000 \SystemRoot\System32\drivers\pcw.sys
0x013E7000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x014F9000 \SystemRoot\system32\drivers\ndis.sys
0x01400000 \SystemRoot\system32\drivers\NETIO.SYS
0x01460000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01601000 \SystemRoot\System32\drivers\tcpip.sys
0x0148B000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x014D5000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x018A3000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x018EF000 \SystemRoot\System32\Drivers\spldr.sys
0x018F7000 \SystemRoot\System32\Drivers\SmartDefragDriver.sys
0x018FE000 \SystemRoot\System32\drivers\rdyboost.sys
0x01938000 \SystemRoot\System32\Drivers\mup.sys
0x0194A000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01953000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0198D000 \SystemRoot\system32\DRIVERS\disk.sys
0x019A3000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x01800000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x0182A000 \SystemRoot\System32\Drivers\Null.SYS
0x01833000 \SystemRoot\System32\Drivers\Beep.SYS
0x0183A000 \SystemRoot\System32\drivers\vga.sys
0x01848000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x0186D000 \SystemRoot\System32\drivers\watchdog.sys
0x0187D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x01886000 \SystemRoot\system32\drivers\rdpencdd.sys
0x0188F000 \SystemRoot\system32\drivers\rdprefmp.sys
0x01898000 \SystemRoot\System32\Drivers\Msfs.SYS
0x019D3000 \SystemRoot\System32\Drivers\Npfs.SYS
0x03C6E000 \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys
0x03C95000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03CB3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03CC0000 \??\C:\Windows\System32\drivers\pctgntdi64.sys
0x03D16000 \Device\Harddisk0\Partition2\Windows\system32\drivers\PctWfpFilter64.sys
0x03D3B000 \SystemRoot\system32\drivers\afd.sys
0x03C00000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03C45000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x03DC5000 \SystemRoot\system32\DRIVERS\pacer.sys
0x03C4E000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x03DEB000 \SystemRoot\system32\DRIVERS\netbios.sys
0x00E50000 \SystemRoot\system32\DRIVERS\serial.sys
0x019E4000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x014E5000 \SystemRoot\system32\DRIVERS\termdd.sys
0x02C2B000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02C7C000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02C88000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x02C93000 \SystemRoot\System32\drivers\discache.sys
0x02CA2000 \SystemRoot\system32\drivers\csc.sys
0x02D25000 \SystemRoot\System32\Drivers\dfsc.sys
0x02D43000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x02D54000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x02D7A000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x04809000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x053E3000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x03A54000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x03B48000 \SystemRoot\System32\drivers\dxgmms1.sys
0x03B8E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x03BB2000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x03BE4000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x02D90000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x03A00000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x03A11000 \SystemRoot\system32\DRIVERS\fdc.sys
0x03A1E000 \SystemRoot\system32\DRIVERS\parport.sys
0x02C00000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x03A3B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x03BF1000 \SystemRoot\system32\DRIVERS\serenum.sys
0x053E5000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x02DE6000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x00DDB000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x02C1E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04047000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04076000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04091000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x040B2000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x040CC000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x040D7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x040E6000 \SystemRoot\system32\DRIVERS\pctNdis64.sys
0x040FC000 \SystemRoot\system32\DRIVERS\swenum.sys
0x040FE000 \SystemRoot\system32\DRIVERS\ks.sys
0x04141000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04153000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x041AD000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x041B8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x0424E000 \SystemRoot\system32\drivers\HdAudio.sys
0x042AA000 \SystemRoot\system32\drivers\portcls.sys
0x042E7000 \SystemRoot\system32\drivers\drmk.sys
0x04309000 \SystemRoot\system32\drivers\ksthunk.sys
0x000B0000 \SystemRoot\System32\win32k.sys
0x0430F000 \SystemRoot\System32\drivers\Dxapi.sys
0x04329000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x04337000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x04350000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x04359000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x0435B000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x04368000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x04385000 \SystemRoot\System32\Drivers\HDVidvx.sys
0x043B3000 \SystemRoot\System32\Drivers\STREAM.SYS
0x043C4000 \SystemRoot\System32\Drivers\USBCAMD2.SYS
0x043CD000 \SystemRoot\system32\DRIVERS\hxctlflt.sys
0x04200000 \SystemRoot\system32\drivers\usbaudio.sys
0x0421B000 \SystemRoot\system32\DRIVERS\monitor.sys
0x04229000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x00420000 \SystemRoot\System32\TSDDD.dll
0x00780000 \SystemRoot\System32\cdd.dll
0x041CD000 \SystemRoot\system32\drivers\luafv.sys
0x04000000 \SystemRoot\system32\drivers\WudfPf.sys
0x04021000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x0467A000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x046CD000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x046E0000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x046F8000 \SystemRoot\system32\drivers\HTTP.sys
0x047C0000 \SystemRoot\system32\DRIVERS\bowser.sys
0x047DE000 \SystemRoot\System32\drivers\mpsdrv.sys
0x04600000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x066A3000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x066F1000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x06714000 \SystemRoot\system32\drivers\peauth.sys
0x067BA000 \SystemRoot\System32\Drivers\secdrv.SYS
0x067C5000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x06600000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06612000 \SystemRoot\system32\drivers\spsys.sys
0x06683000 \??\C:\Windows\system32\drivers\pctNdis-PacketFilter64.sys
0x06A36000 \SystemRoot\System32\DRIVERS\srv2.sys
0x06A9D000 \SystemRoot\System32\DRIVERS\srv.sys
0x06B33000 \??\C:\Windows\System32\drivers\pctplfw64.sys
0x06B63000 \SystemRoot\System32\Drivers\fastfat.SYS
0x06B99000 \??\C:\Program Files (x86)\Common Files\PC Tools\KDS\pctESPInject.sys
0x06BA5000 \SystemRoot\system32\DRIVERS\bdfm.sys
0x06BCF000 \SystemRoot\system32\DRIVERS\BDHV.SYS
0x77670000 \Windows\System32\ntdll.dll
0x48220000 \Windows\System32\smss.exe
0xFF990000 \Windows\System32\apisetschema.dll
0xFFD70000 \Windows\System32\autochk.exe
0xFF8E0000 \Windows\System32\clbcatq.dll
0xFF8C0000 \Windows\System32\imagehlp.dll
0xFF850000 \Windows\System32\gdi32.dll
0xFF840000 \Windows\System32\lpk.dll
0x77840000 \Windows\System32\normaliz.dll
0x77570000 \Windows\System32\user32.dll
0xFF7F0000 \Windows\System32\ws2_32.dll
0x77450000 \Windows\System32\kernel32.dll
0xFF7E0000 \Windows\System32\nsi.dll
0xFF760000 \Windows\System32\difxapi.dll
0xFF730000 \Windows\System32\imm32.dll
0xFF690000 \Windows\System32\msvcrt.dll
0xFF5F0000 \Windows\System32\comdlg32.dll
0xFF510000 \Windows\System32\oleaut32.dll
0xFF2B0000 \Windows\System32\iertutil.dll
0xFF230000 \Windows\System32\shlwapi.dll
0xFF210000 \Windows\System32\sechost.dll
0x77830000 \Windows\System32\psapi.dll
0xFF000000 \Windows\System32\ole32.dll
0xFEED0000 \Windows\System32\wininet.dll
0xFED50000 \Windows\System32\urlmon.dll
0xFEC40000 \Windows\System32\msctf.dll
0xFEB10000 \Windows\System32\rpcrt4.dll
0xFEAC0000 \Windows\System32\Wldap32.dll
0xFE8E0000 \Windows\System32\setupapi.dll
0xFDB50000 \Windows\System32\shell32.dll
0xFDA70000 \Windows\System32\advapi32.dll
0xFD9A0000 \Windows\System32\usp10.dll
0xFD830000 \Windows\System32\crypt32.dll
0xFD7F0000 \Windows\System32\cfgmgr32.dll
0xFD750000 \Windows\System32\comctl32.dll
0xFD6E0000 \Windows\System32\KernelBase.dll
0xFD6A0000 \Windows\System32\wintrust.dll
0xFD680000 \Windows\System32\devobj.dll
0xFD670000 \Windows\System32\msasn1.dll
0x755D0000 \Windows\SysWOW64\normaliz.dll

Processes (total 42):
0 System Idle Process
4 System
332 C:\Windows\System32\smss.exe
432 C:\Windows\System32\csrss.exe
508 C:\Windows\System32\wininit.exe
520 C:\Windows\System32\csrss.exe
556 C:\Windows\System32\services.exe
572 C:\Windows\System32\lsass.exe
580 C:\Windows\System32\lsm.exe
672 C:\Windows\System32\winlogon.exe
728 C:\Windows\System32\svchost.exe
804 C:\Windows\System32\svchost.exe
864 C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
956 C:\Windows\System32\svchost.exe
348 C:\Windows\System32\svchost.exe
400 C:\Windows\System32\svchost.exe
1048 C:\Windows\System32\audiodg.exe
1116 C:\Windows\System32\svchost.exe
1296 C:\Windows\System32\svchost.exe
1440 C:\Windows\System32\spoolsv.exe
1472 C:\Windows\System32\svchost.exe
1636 C:\Windows\System32\svchost.exe
1700 C:\Program Files (x86)\PC Tools Firewall Plus\FWService.exe
1772 C:\Windows\System32\sppsvc.exe
1852 C:\Windows\System32\svchost.exe
1916 C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
2444 C:\Windows\System32\svchost.exe
2492 C:\Windows\System32\svchost.exe
2232 C:\Windows\System32\taskhost.exe
3064 C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
2720 C:\Windows\System32\dwm.exe
2788 C:\Windows\explorer.exe
3560 C:\Program Files (x86)\PC Tools Firewall Plus\FirewallGUI.exe
3756 C:\Program Files\Windows Media Player\wmpnetwk.exe
3976 C:\Windows\System32\svchost.exe
3516 C:\Windows\servicing\TrustedInstaller.exe
3364 C:\Windows\System32\wuauclt.exe
940 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
1952 C:\Windows\System32\taskhost.exe
1216 C:\Program Files (x86)\ZHPDiag\mbrcheck.exe
3348 C:\Windows\System32\conhost.exe
2392 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000'06500000 (NTFS)
\\.\F: --> \\.\PhysicalDrive1 at offset 0x00000000'00007e00 (NTFS)

PhysicalDrive0 Model Number: ST3320620AS, Rev: 3.AAJ
PhysicalDrive1 Model Number: ST380815AS, Rev: D

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
74 GB \\.\PhysicalDrive1 RE: Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
Tu me conseil quoi comme par-feu car avant j'avais comodo mets beaucoup de problème avec.

c'est bon

pour le pare feu, je dirai aucun, celui de seven etant performant, sauf si tu es un malade de l'informatique et que tu sais réglé ces parefeux

desinstalle le tien et regarde si ca rame encore au demarrage