virus présent malgré formatage complet

Question

Bonjour, 

j'étais sous vista et j'ai du formater mon pc entierement. En effet, malgré plusieurs scan et la mis en quarentaine des fichiers infectés, les virus revenaient sans cesse. Etrange ce n'était pas mon antivirus qui les détectait mais vista lui meme.

Un ami a moi a formaté mon pc et a installé windows seven, tout semblait parfait, mes tout d'un coup seven a commencé à me mettre les meme message d'erreur que faisait vista, avec les même noms de virus.

Comment est-ce possible sachant qu'on a tout formaté? y a t-il une solution?

Merci pour votre aide
C.

Configuration: Windows 7 / Firefox 4.0.1

g3n-h@ckm@n · Answer

salut

&#9654 Télécharge Reload_TDSSKiller

&#9654 Lance le 

choisis : télécharger la derniere version

&#9654 relance-le 

choisis : lancer le nettoyage

TDSSKiller va s'ouvrir , clique sur "Start Scan"

une fois qu'il a terminé , redemarre s'il te le demande pour finir de nettoyer

sinon , ferme tdssKiller et le rapport s'affichera sur le bureau

&#9654 Copie/Colle son contenu dans ta prochaine réponse.

cycy_ · Answer

merci pour ton aide, le problème c'est que je n'arrive même pas à ouvrir ton lien...

g3n-h@ckm@n · Answer

et pour me parler tu utilises un autre pc non ?

cycy_ · Answer

non le même, je ferme sans arret les messages de seven.
J'ai reussi a  lancé le scan, jtenvoi le rapport dès que c'est fini

g3n-h@ckm@n · Answer

ok :)

cycy_ · Answer

voila le rapport, il a rien trouvé, jcomprend rien.... car seven sexite et me dit que j'ai 33 infections, spyware etc..

2011/06/12 20:58:20.0279 3164	
2011/06/12 20:58:20.0279 3164	OS Version: 6.1.7600 ServicePack: 0.0
2011/06/12 20:58:20.0279 3164	Product type: Workstation
2011/06/12 20:58:20.0279 3164	ComputerName: CYRIELLE-PC
2011/06/12 20:58:20.0280 3164	UserName: Cyrielle
2011/06/12 20:58:20.0280 3164	Windows directory: C:\Windows
2011/06/12 20:58:20.0280 3164	System windows directory: C:\Windows
2011/06/12 20:58:20.0280 3164	Processor architecture: Intel x86
2011/06/12 20:58:20.0280 3164	Number of processors: 2
2011/06/12 20:58:20.0280 3164	Page size: 0x1000
2011/06/12 20:58:20.0280 3164	Boot type: Normal boot
2011/06/12 20:58:20.0280 3164	================================================================================
2011/06/12 20:58:20.0281 3164	SetPrivileges failed!
2011/06/12 20:58:28.0405 3164	!crdlk
2011/06/12 20:58:28.0476 3164	Initialize success
2011/06/12 20:59:31.0956 5852	================================================================================
2011/06/12 20:59:31.0956 5852	Scan started
2011/06/12 20:59:31.0956 5852	Mode: Manual; 
2011/06/12 20:59:31.0956 5852	================================================================================
2011/06/12 20:59:43.0734 5852	================================================================================
2011/06/12 20:59:43.0734 5852	Scan finished
2011/06/12 20:59:43.0734 5852	================================================================================
2011/06/12 20:59:43.0751 3780	Detected object count: 0
2011/06/12 20:59:43.0751 3780	Actual detected object count: 0

g3n-h@ckm@n · Answer

tu as cliqué sur start scan ?

desactive ton antivirus
desactive Windows defender si présent
desactive ton pare-feu

Ferme toutes tes appilications en cours

telecharge et enregistre ceci sur ton bureau :

Pre_Scan

s'il n'est pas sur ton bureau coupe-le de ton dossier telechargements et colle-le sur ton bureau

Avertissement: Il y aura une extinction courte du bureau --> pas de panique. 

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan.txt" sur le bureau.

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

si l'outil semble ne pas avoir fonctionné renomme-le winlogon , ou change son extension en .com ou .scr

 Il se peut que l'outil soit un peu long sur la reattribution des fichiers tout depend combien tu en as , laisse-le travailler 

Poste Pre_Scan.txt qui apparaitra sur le bureau en fin de scan

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

cycy_ · Answer

ok je fais ça et reviens vers toi, merci

cycy_ · Answer

et voici : http://www.cijoint.fr/cjlink.php?file=cj201106/cijIQ8tP3J.txt

g3n-h@ckm@n · Answer

fais glisser une icone n'importe laqueele sur Pre_scan , pre_script va apparaitre

selectionne ce texte sans les lignes :
___________________________________________________
processes::
ewe.exe 
Reload_Tdsskiller(3).exe

file::
C:\Users\Cyrielle\AppData\Local\ewe.exe 

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]   
"SunJavaUpdateSched"=-
"Adobe Reader Speed Launcher"=-

                                          
___________________________________________________

copie-le (ctrl+c) puis lance Pre_Script qui est sur ton bureau

colle dans le document texte qui s'ouvre , puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte 

poste Pre_Script.txt qui apparaitra à coté de l'executable en fin de travail

cycy_ · Answer

voila :  http://www.cijoint.fr/cjlink.php?file=cj201106/cij7tw7NFJ.txt

g3n-h@ckm@n · Answer

tu l'as fait deux fois ?

cycy_ · Answer

euuu non pk?

g3n-h@ckm@n · Answer

refais tdsskiller mais cette fois-ci , clique sur Start Scan

cycy_ · Answer

ça bloque à 10% il me dit : another instance of utility is runny

g3n-h@ckm@n · Answer

redemarre le pc et ressaie

cycy_ · Answer

voila : 2011/06/12 21:44:59.0655 3272	TDSS rootkit removing tool 2.5.4.0 Jun  7 2011 17:31:48
2011/06/12 21:44:59.0842 3272	================================================================================
2011/06/12 21:44:59.0842 3272	SystemInfo:
2011/06/12 21:44:59.0842 3272	
2011/06/12 21:44:59.0842 3272	OS Version: 6.1.7600 ServicePack: 0.0
2011/06/12 21:44:59.0842 3272	Product type: Workstation
2011/06/12 21:44:59.0857 3272	ComputerName: CYRIELLE-PC
2011/06/12 21:44:59.0857 3272	UserName: Cyrielle
2011/06/12 21:44:59.0857 3272	Windows directory: C:\Windows
2011/06/12 21:44:59.0857 3272	System windows directory: C:\Windows
2011/06/12 21:44:59.0857 3272	Processor architecture: Intel x86
2011/06/12 21:44:59.0857 3272	Number of processors: 2
2011/06/12 21:44:59.0857 3272	Page size: 0x1000
2011/06/12 21:44:59.0857 3272	Boot type: Normal boot
2011/06/12 21:44:59.0857 3272	================================================================================
2011/06/12 21:45:14.0713 3272	Initialize success
2011/06/12 21:45:31.0386 3272	================================================================================
2011/06/12 21:45:31.0386 3272	Scan started
2011/06/12 21:45:31.0386 3272	Mode: Manual; 
2011/06/12 21:45:31.0386 3272	================================================================================
2011/06/12 21:45:34.0256 3272	1394ohci        (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/06/12 21:45:34.0397 3272	ACPI            (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2011/06/12 21:45:34.0444 3272	AcpiPmi         (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/06/12 21:45:34.0522 3272	adp94xx         (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/06/12 21:45:34.0600 3272	adpahci         (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/06/12 21:45:34.0678 3272	adpu320         (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/06/12 21:45:34.0787 3272	AFD             (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
2011/06/12 21:45:34.0818 3272	agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2011/06/12 21:45:34.0849 3272	aic78xx         (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/06/12 21:45:34.0912 3272	aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2011/06/12 21:45:34.0958 3272	amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2011/06/12 21:45:34.0974 3272	amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2011/06/12 21:45:35.0021 3272	AmdK8           (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/06/12 21:45:35.0068 3272	AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/06/12 21:45:35.0099 3272	amdsata         (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
2011/06/12 21:45:35.0130 3272	amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/06/12 21:45:35.0161 3272	amdxata         (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
2011/06/12 21:45:35.0192 3272	AppID           (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2011/06/12 21:45:35.0270 3272	arc             (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/06/12 21:45:35.0317 3272	arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/06/12 21:45:35.0395 3272	aswFsBlk        (7f08d9c504b015d81a8abd75c80028c5) C:\Windows\system32\drivers\aswFsBlk.sys
2011/06/12 21:45:35.0489 3272	aswMonFlt       (9bdc8e9ce17b773f69d2c6696c768c4f) C:\Windows\system32\drivers\aswMonFlt.sys
2011/06/12 21:45:35.0536 3272	aswRdr          (ac48bdd4cd5d44af33087c06d6e9511c) C:\Windows\system32\drivers\aswRdr.sys
2011/06/12 21:45:35.0582 3272	aswSnx          (b64134316fcd1f20e0f10ef3e65bd522) C:\Windows\system32\drivers\aswSnx.sys
2011/06/12 21:45:35.0754 3272	aswSP           (d6788e3211afa9951ed7a4d617f68a4f) C:\Windows\system32\drivers\aswSP.sys
2011/06/12 21:45:35.0801 3272	aswTdi          (4d100c45517809439c7b6dd98997fa00) C:\Windows\system32\drivers\aswTdi.sys
2011/06/12 21:45:35.0848 3272	AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/06/12 21:45:35.0879 3272	atapi           (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2011/06/12 21:45:35.0957 3272	athr            (b01751cc563aecac09bbe36aaa21fbef) C:\Windows\system32\DRIVERS\athr.sys
2011/06/12 21:45:36.0238 3272	atikmdag        (04f09923a393e4e0e8453a8f78361e73) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/06/12 21:45:36.0550 3272	b06bdrv         (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/06/12 21:45:36.0612 3272	b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/06/12 21:45:36.0721 3272	Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/06/12 21:45:36.0830 3272	blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/06/12 21:45:36.0893 3272	bowser          (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys
2011/06/12 21:45:36.0924 3272	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/06/12 21:45:36.0955 3272	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/06/12 21:45:37.0002 3272	Brserid         (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/06/12 21:45:37.0018 3272	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/06/12 21:45:37.0049 3272	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/06/12 21:45:37.0080 3272	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/06/12 21:45:37.0127 3272	BthEnum         (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\DRIVERS\BthEnum.sys
2011/06/12 21:45:37.0174 3272	BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/06/12 21:45:37.0236 3272	BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
2011/06/12 21:45:37.0314 3272	BTHPORT         (4a34888e13224678dd062466afec4240) C:\Windows\system32\Drivers\BTHport.sys
2011/06/12 21:45:37.0361 3272	BTHUSB          (fa04c63916fa221dbb91fce153d07a55) C:\Windows\system32\Drivers\BTHUSB.sys
2011/06/12 21:45:37.0423 3272	cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/06/12 21:45:37.0501 3272	cdrom           (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2011/06/12 21:45:37.0532 3272	circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/06/12 21:45:37.0595 3272	CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/06/12 21:45:37.0704 3272	CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/06/12 21:45:37.0720 3272	cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2011/06/12 21:45:37.0751 3272	CNG             (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/06/12 21:45:37.0798 3272	Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/06/12 21:45:37.0844 3272	CompositeBus    (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/06/12 21:45:37.0876 3272	crcdisk         (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/06/12 21:45:38.0000 3272	CSC             (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys
2011/06/12 21:45:38.0078 3272	DfsC            (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
2011/06/12 21:45:38.0125 3272	discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/06/12 21:45:38.0172 3272	Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/06/12 21:45:38.0281 3272	drmkaud         (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/06/12 21:45:38.0359 3272	DXGKrnl         (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys
2011/06/12 21:45:38.0484 3272	ebdrv           (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/06/12 21:45:38.0671 3272	elxstor         (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/06/12 21:45:38.0812 3272	ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2011/06/12 21:45:38.0921 3272	exfat           (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/06/12 21:45:38.0936 3272	fastfat         (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/06/12 21:45:38.0983 3272	fdc             (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/06/12 21:45:39.0030 3272	FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/06/12 21:45:39.0061 3272	Filetrace       (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/06/12 21:45:39.0077 3272	flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/06/12 21:45:39.0139 3272	FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/06/12 21:45:39.0186 3272	FsDepends       (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/06/12 21:45:39.0202 3272	Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/06/12 21:45:39.0295 3272	fvevol          (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
2011/06/12 21:45:39.0358 3272	gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/06/12 21:45:39.0420 3272	hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/06/12 21:45:39.0467 3272	HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/06/12 21:45:39.0514 3272	HDAudBus        (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/06/12 21:45:39.0529 3272	HidBatt         (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/06/12 21:45:39.0560 3272	HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/06/12 21:45:39.0607 3272	HidIr           (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/06/12 21:45:39.0654 3272	HidUsb          (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2011/06/12 21:45:39.0701 3272	HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/06/12 21:45:39.0748 3272	HTTP            (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2011/06/12 21:45:39.0794 3272	hwpolicy        (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2011/06/12 21:45:39.0857 3272	i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/06/12 21:45:39.0919 3272	iaStorV         (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/06/12 21:45:39.0950 3272	iirsp           (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/06/12 21:45:39.0982 3272	intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2011/06/12 21:45:40.0028 3272	intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/06/12 21:45:40.0060 3272	IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/06/12 21:45:40.0106 3272	IPMIDRV         (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/06/12 21:45:40.0138 3272	IPNAT           (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/06/12 21:45:40.0184 3272	IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/06/12 21:45:40.0231 3272	isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2011/06/12 21:45:40.0262 3272	iScsiPrt        (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/06/12 21:45:40.0309 3272	kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/06/12 21:45:40.0340 3272	kbdhid          (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/06/12 21:45:40.0387 3272	KSecDD          (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2011/06/12 21:45:40.0450 3272	KSecPkg         (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
2011/06/12 21:45:40.0543 3272	lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/06/12 21:45:40.0621 3272	LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/06/12 21:45:40.0652 3272	LSI_SAS         (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/06/12 21:45:40.0668 3272	LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/06/12 21:45:40.0715 3272	LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/06/12 21:45:40.0762 3272	luafv           (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/06/12 21:45:40.0808 3272	megasas         (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/06/12 21:45:40.0840 3272	MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/06/12 21:45:40.0886 3272	Modem           (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/06/12 21:45:40.0918 3272	monitor         (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/06/12 21:45:40.0964 3272	mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2011/06/12 21:45:41.0027 3272	mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/06/12 21:45:41.0074 3272	mountmgr        (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2011/06/12 21:45:41.0105 3272	mpio            (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2011/06/12 21:45:41.0136 3272	mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/06/12 21:45:41.0183 3272	MRxDAV          (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2011/06/12 21:45:41.0230 3272	mrxsmb          (b4c76ef46322a9711c7b0f4e21ef6ea5) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/06/12 21:45:41.0276 3272	mrxsmb10        (e593d45024a3fdd11e93cc4a6ca91101) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/06/12 21:45:41.0308 3272	mrxsmb20        (a9f86c82c9cc3b679cc3957e1183a30f) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/06/12 21:45:41.0354 3272	msahci          (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2011/06/12 21:45:41.0386 3272	msdsm           (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2011/06/12 21:45:41.0432 3272	Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/06/12 21:45:41.0448 3272	mshidkmdf       (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/06/12 21:45:41.0479 3272	msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/06/12 21:45:41.0542 3272	MSKSSRV         (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/06/12 21:45:41.0557 3272	MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/06/12 21:45:41.0588 3272	MSPQM           (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/06/12 21:45:41.0635 3272	MsRPC           (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/06/12 21:45:41.0698 3272	mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/06/12 21:45:41.0713 3272	MSTEE           (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/06/12 21:45:41.0744 3272	MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/06/12 21:45:41.0791 3272	MTsensor        (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys
2011/06/12 21:45:41.0822 3272	Mup             (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/06/12 21:45:41.0900 3272	NativeWifiP     (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS
wifi.sys
2011/06/12 21:45:41.0932 3272	NDIS            (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers
dis.sys
2011/06/12 21:45:41.0994 3272	NdisCap         (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS
discap.sys
2011/06/12 21:45:42.0025 3272	NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS
distapi.sys
2011/06/12 21:45:42.0056 3272	Ndisuio         (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS
disuio.sys
2011/06/12 21:45:42.0088 3272	NdisWan         (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS
diswan.sys
2011/06/12 21:45:42.0134 3272	NDProxy         (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2011/06/12 21:45:42.0166 3272	NetBIOS         (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS
etbios.sys
2011/06/12 21:45:42.0197 3272	NetBT           (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS
etbt.sys
2011/06/12 21:45:42.0259 3272	nfrd960         (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS
frd960.sys
2011/06/12 21:45:42.0306 3272	Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/06/12 21:45:42.0337 3272	nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers
siproxy.sys
2011/06/12 21:45:42.0400 3272	Ntfs            (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
2011/06/12 21:45:42.0462 3272	Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/06/12 21:45:42.0509 3272	nvraid          (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS
vraid.sys
2011/06/12 21:45:42.0540 3272	nvstor          (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS
vstor.sys
2011/06/12 21:45:42.0571 3272	nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS
v_agp.sys
2011/06/12 21:45:42.0680 3272	ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/06/12 21:45:42.0774 3272	Parport         (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/06/12 21:45:42.0805 3272	partmgr         (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2011/06/12 21:45:42.0836 3272	Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/06/12 21:45:42.0883 3272	pci             (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2011/06/12 21:45:42.0914 3272	pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2011/06/12 21:45:42.0946 3272	pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/06/12 21:45:42.0977 3272	pcw             (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/06/12 21:45:43.0024 3272	PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/06/12 21:45:43.0180 3272	PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERSaspptp.sys
2011/06/12 21:45:43.0195 3272	Processor       (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/06/12 21:45:43.0258 3272	Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/06/12 21:45:43.0336 3272	ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/06/12 21:45:43.0382 3272	ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/06/12 21:45:43.0414 3272	QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/06/12 21:45:43.0445 3272	RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERSasacd.sys
2011/06/12 21:45:43.0476 3272	RasAgileVpn     (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/06/12 21:45:43.0507 3272	Rasl2tp         (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERSasl2tp.sys
2011/06/12 21:45:43.0554 3272	RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERSaspppoe.sys
2011/06/12 21:45:43.0616 3272	RasSstp         (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERSassstp.sys
2011/06/12 21:45:43.0648 3272	rdbss           (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERSdbss.sys
2011/06/12 21:45:43.0679 3272	rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERSdpbus.sys
2011/06/12 21:45:43.0710 3272	RDPCDD          (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/06/12 21:45:43.0757 3272	RDPDR           (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\driversdpdr.sys
2011/06/12 21:45:43.0788 3272	RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\driversdpencdd.sys
2011/06/12 21:45:43.0819 3272	RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\driversdprefmp.sys
2011/06/12 21:45:43.0850 3272	RDPWD           (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2011/06/12 21:45:43.0897 3272	rdyboost        (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\driversdyboost.sys
2011/06/12 21:45:43.0960 3272	RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERSfcomm.sys
2011/06/12 21:45:44.0053 3272	rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERSspndr.sys
2011/06/12 21:45:44.0100 3272	s3cap           (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/06/12 21:45:44.0147 3272	sbp2port        (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/06/12 21:45:44.0178 3272	scfilter        (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2011/06/12 21:45:44.0240 3272	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/06/12 21:45:44.0287 3272	Serenum         (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/06/12 21:45:44.0318 3272	Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/06/12 21:45:44.0350 3272	sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/06/12 21:45:44.0396 3272	sffdisk         (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/06/12 21:45:44.0428 3272	sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/06/12 21:45:44.0459 3272	sffp_sd         (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/06/12 21:45:44.0490 3272	sfloppy         (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/06/12 21:45:44.0537 3272	sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2011/06/12 21:45:44.0584 3272	SiSGbeLH        (6f0c643c7f49f2091b01d014eae72e1a) C:\Windows\system32\DRIVERS\SiSGB6.sys
2011/06/12 21:45:44.0708 3272	SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/06/12 21:45:44.0786 3272	SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/06/12 21:45:44.0802 3272	Smb             (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/06/12 21:45:44.0864 3272	spldr           (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/06/12 21:45:44.0927 3272	srv             (4a9b0f215de2519e2363f91df25c1e97) C:\Windows\system32\DRIVERS\srv.sys
2011/06/12 21:45:44.0958 3272	srv2            (14c44875518ae1c982e54ea8c5f7fe28) C:\Windows\system32\DRIVERS\srv2.sys
2011/06/12 21:45:45.0005 3272	srvnet          (07a14223b0a50e76ade003fdf95d4fec) C:\Windows\system32\DRIVERS\srvnet.sys
2011/06/12 21:45:45.0067 3272	stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/06/12 21:45:45.0130 3272	storflt         (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/06/12 21:45:45.0161 3272	storvsc         (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys
2011/06/12 21:45:45.0208 3272	swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2011/06/12 21:45:45.0301 3272	Tcpip           (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers	cpip.sys
2011/06/12 21:45:45.0410 3272	TCPIP6          (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS	cpip.sys
2011/06/12 21:45:45.0473 3272	tcpipreg        (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers	cpipreg.sys
2011/06/12 21:45:45.0520 3272	TDPIPE          (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers	dpipe.sys
2011/06/12 21:45:45.0535 3272	TDTCP           (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers	dtcp.sys
2011/06/12 21:45:45.0582 3272	tdx             (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS	dx.sys
2011/06/12 21:45:45.0613 3272	TermDD          (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS	ermdd.sys
2011/06/12 21:45:45.0676 3272	tssecsrv        (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS	ssecsrv.sys
2011/06/12 21:45:45.0754 3272	tunnel          (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS	unnel.sys
2011/06/12 21:45:45.0785 3272	uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/06/12 21:45:45.0832 3272	udfs            (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2011/06/12 21:45:45.0910 3272	uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/06/12 21:45:45.0956 3272	umbus           (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2011/06/12 21:45:45.0988 3272	UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/06/12 21:45:46.0034 3272	usbccgp         (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/06/12 21:45:46.0081 3272	usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2011/06/12 21:45:46.0112 3272	usbehci         (1c333bfd60f2fed2c7ad5daf533cb742) C:\Windows\system32\DRIVERS\usbehci.sys
2011/06/12 21:45:46.0144 3272	usbhub          (ee6ef93ccfa94fae8c6ab298273d8ae2) C:\Windows\system32\DRIVERS\usbhub.sys
2011/06/12 21:45:46.0175 3272	usbohci         (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/06/12 21:45:46.0206 3272	usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/06/12 21:45:46.0237 3272	USBSTOR         (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/06/12 21:45:46.0268 3272	usbuhci         (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/06/12 21:45:46.0315 3272	usbvideo        (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys
2011/06/12 21:45:46.0378 3272	vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/06/12 21:45:46.0409 3272	vga             (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/06/12 21:45:46.0440 3272	VgaSave         (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/06/12 21:45:46.0487 3272	vhdmp           (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/06/12 21:45:46.0518 3272	viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2011/06/12 21:45:46.0549 3272	ViaC7           (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/06/12 21:45:46.0565 3272	viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2011/06/12 21:45:46.0612 3272	vmbus           (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys
2011/06/12 21:45:46.0643 3272	VMBusHID        (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/06/12 21:45:46.0799 3272	volmgr          (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/06/12 21:45:46.0830 3272	volmgrx         (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/06/12 21:45:46.0861 3272	volsnap         (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2011/06/12 21:45:46.0924 3272	vsmraid         (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/06/12 21:45:46.0955 3272	vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/06/12 21:45:46.0986 3272	vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/06/12 21:45:47.0033 3272	vwifimp         (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
2011/06/12 21:45:47.0064 3272	WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/06/12 21:45:47.0111 3272	WANARP          (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/12 21:45:47.0126 3272	Wanarpv6        (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/06/12 21:45:47.0189 3272	Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/06/12 21:45:47.0236 3272	Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/06/12 21:45:47.0314 3272	WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/06/12 21:45:47.0345 3272	WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/06/12 21:45:47.0470 3272	WinUsb          (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUSB.sys
2011/06/12 21:45:47.0563 3272	WmiAcpi         (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/06/12 21:45:47.0626 3272	ws2ifsl         (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/06/12 21:45:47.0688 3272	WudfPf          (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2011/06/12 21:45:47.0719 3272	WUDFRd          (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/06/12 21:45:47.0797 3272	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2011/06/12 21:45:47.0813 3272	================================================================================
2011/06/12 21:45:47.0813 3272	Scan finished
2011/06/12 21:45:47.0813 3272	================================================================================
2011/06/12 21:45:47.0828 1512	Detected object count: 0
2011/06/12 21:45:47.0828 1512	Actual detected object count: 0

cycy_ · Answer

c ce que tu voulais?

g3n-h@ckm@n · Answer

par contre pour pre_scan tu n'avais rien desactivé à ce que je vois

Pare-feu windows : Actif
Windows Defender : Actif

cycy_ · Answer

en effet je n'avais pas désactivé défender mais le pare-feu est bien désactivé. J'ai fait un autre préscan en désactivant tout. Le pare feu apparait encore comme actif alors qu'avant et après le scan il est "inactif" dans le panneau de configuration, donc je ne comprend pas ...
Voici le dernier rapport:

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan 1.0.2.09 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ XP | Vista | Seven - 32/64 bits ¤¤¤¤¤

Mis à jour le 12/06/2011 | 19.20 par g3n-h@ckm@n
Utilisateur : Cyrielle (Administrateurs)
Ordinateur : CYRIELLE-PC

Système d'exploitation : Windows 7 Ultimate (32 bits) Ultimate 
Type d'installation : Client
Enregistré sous : Cyrielle
Processeur : Intel(R) Core(TM)2 Duo CPU     T6400  @ 2.00GHz
Identification : x86 Family 6 Model 23 Stepping 10
Internet Explorer : 8.0.7600.16385
Mozilla Firefox : 4.0.1 (fr)
Pare-feu windows : Actif
Windows Defender : Inactif

Scan : 12:16:21 | 13/06/2011

¤¤¤¤¤¤¤¤¤¤ Sessions

[HKLM | ProfileList] | S-1-5-21-2135916146-3893334040-3250946710-1000 : ProfileImagePath -> C:\Users\Cyrielle
[HKLM | ProfileList] | S-1-5-21-2135916146-3893334040-3250946710-1000 : RefCount -> 1
[HKLM | ProfileList] | S-1-5-21-2135916146-3893334040-3250946710-1000 : State -> 256

¤¤¤¤¤¤¤¤¤¤ Verification des Fichiers


¤¤¤¤¤¤¤¤¤¤¤ Processus en cours

Demarrage : Normal  

1612 | C:\Windows\system32\Dwm.exe - Cyrielle - High - "C:\Windows\system32\Dwm.exe" - 936
1772 | C:\Program Files\AVAST Software\Avast\AvastUI.exe - Cyrielle - Normal - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui - 1620
1788 | C:\Program Files\Common Files\Java\Java Update\jusched.exe - Cyrielle - Normal - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"  - 1620
1868 | C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe - Cyrielle - Normal - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"  - 1620
1876 | C:\Program Files\Skype\Phone\Skype.exe - Cyrielle - Normal - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized - 1620
2332 | C:\Windows\system32	askhost.exe - Cyrielle - Normal - "taskhost.exe" - 492
1760 | C:\Users\Cyrielle\Desktop\Pre_scan.exe - Cyrielle - High - "C:\Users\Cyrielle\Desktop\Pre_scan.exe"  - 2764
3356 | C:\Users\Cyrielle\Desktop\Pre_scan.exe - Cyrielle - Normal - "C:\Users\Cyrielle\Desktop\Pre_scan.exe"  - 2764
5784 | C:\Windows\system32\SearchFilterHost.exe - SYSTEM - Idle - "C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524  - 3400
4716 | C:\Windows\system32\cmd.exe - Cyrielle - Normal - cmd /c ""C:\Kill'em\Pv.bat" " - 1760
4036 | C:\Windows\system32\conhost.exe - Cyrielle - Normal - \??\C:\Windows\system32\conhost.exe - 456
1104 | C:\Kill'em\Pv.exe - Cyrielle - Normal - C:\Kill'em\pv.exe  -o"%i | %f - %u - %p - %l - %r" - 4716

¤¤¤¤¤¤¤¤¤¤ Démarrage avant suppression ¤¤¤¤¤¤¤¤¤¤

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

¤¤¤¤¤¤¤¤¤¤ Winlogon

[HKLM | Winlogon] | Shell : explorer.exe
[HKLM | Winlogon] | AutoRestartShell : 1
[HKLM | Winlogon] | userinit : C:\Windows\system32\userinit.exe,
[HKLM | Winlogon] | PowerDownAfterShutdown : 1
[HKLM | Winlogon] | System : 

¤¤¤¤¤¤¤¤¤¤ Associations

[.exe] : exefile
[exefile | command] : "%1" %*
[.com] : comfile
[comfile | command] : "%1" %*
[.reg] : regfile
[regfile | command] : regedit.exe "%1"
[.scr] : scrfile
[scrfile | command] : "%1" /S
[.bat] : batfile
[batfile | command] : "%1" %*
[.cmd] : cmdfile
[cmdfile | command] : "%1" %*
[.pif] : piffile
[piffile | command] : "%1" %*
[.url] : InternetShortcut
[InternetShortcut | command] : "C:\Windows\System32undll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l
[Application.Manifest | command] : rundll32.exe dfshim.dll,ShOpenVerbApplication %1
[Application.Reference | command] : rundll32.exe dfshim.dll,ShOpenVerbShortcut %1|%2
[Folder | command] : C:\Windows\explorer.exe

¤

[Firefox | Command] | @  : "C:\Program Files\Mozilla Firefox\Firefox.exe"
[Firefox - Safemode | Command] | @ : "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
[IE | Command] | @ : "C:\Program Files\Internet Explorer\iexplore.exe"
[Applications | IE | Command] | @ : "C:\Program Files\Internet Explorer\iexplore.exe" %1
[Chrome | Command] | @ : "C:\Program Files\Google\Chrome\Application\chrome.exe"
[Assoc | Applications] | @ : http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s

¤¤¤¤¤¤¤¤¤¤ Divers

[HKLM | HideDesktopIcons\ClassicStartMenu] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {F02C1A0D-BE21-4350-88B0-7367FC96EF3C} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {208D2C60-3AEA-1069-A2D7-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {871C5380-42A0-1069-A2EA-08002B30309D} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 0
[HKLM | HideDesktopIcons\NewStartPanel] | {9343812e-1c37-4a49-a12e-4b2d810d956b} : 0
[HKCU | Desktop] | Wallpaper : C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

¤¤¤¤¤¤¤¤¤¤ Services

[Ndisuio] | Start : 3 : Actif
[Power] | Start : 2 : Actif
[Profsvc] | Start : 2 : Actif
[PlugPlay] | Start : 2 : Actif
[PEAUTH] | Start : 2 : Actif
[Parvdm] | Start : 2 : Inactif
[nsi] | Start : 2 : Actif
[NLASvc] | Start : 2 : Actif
[MPSsvc] | Start : 2 : Actif
[MMCSS] | Start : 2 : Actif
[luafv] | Start : 2 : Actif
[lltdio] | Start : 2 : Actif
[Iphlpsvc] | Start : 2 : Actif
[IKEEXT] | Start : 2 : Actif
[gpsvc] | Start : 2 : Actif
[lmhosts] | Start : 2 : Actif
[LanmanWorkstation] | Start : 2 : Actif
[LanmanServer] | Start : 2 : Actif
[agp440] | Start : 2 : Inactif
[AudioEndpointBuilder] | Start : 2 : Actif
[Audiosrv] | Start : 2 : Actif
[BFE] | Start : 2 : Actif
[Bits] | Start : 2 : Actif
[CryptSvc] | Start : 2 : Actif
[EapHost] | Start : 2 : Actif
[Wlansvc] | Start : 2 : Actif
[SharedAccess] | Start : 2 : Inactif
[windefend] | Start : 3 -> 2 : Inactif
[wuauserv] | Start : 2 : Actif
[WerSvc] | Start : 2 : Actif
[wscsvc] | Start : 2 : Actif

¤¤¤¤¤¤¤¤¤¤ Internet Explorer

[HKCU | Main] | Start Page : http://www.google.com/
[HKCU | Main] | Local Page : C:\Windows\system32\blank.htm
[HKCU | Main] | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[HKCU | SearchURL] | SearchAssistant   :  -> http://www.google.com

[HKLM | Main] | Start Page : http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Local Page : C:\Windows\System32\blank.htm
[HKLM | Main] | Default_Search_URL : http://go.microsoft.com/fwlink/?LinkId=54896
[HKLM | Main] | Default_Page_URL : http://go.microsoft.com/fwlink/?LinkId=69157
[HKLM | Main] | Search Page : http://go.microsoft.com/fwlink/?LinkId=54896

¤

[HKCU | PhishingFilter] | Enabled : 2
[HKCU | PhishingFilter] | EnabledV8 : 1
[HKCU | Internet Settings] | MigrateProxy : 1 -> 0
[HKCU | Internet Settings] | WarnonBadCertRecving : 1
[HKCU | Internet Settings] | WarnOnHTTPSToHTTPRedirect : 1
[HKCU | Internet Settings] | WarnonZoneCrossing : 1
[HKCU | Internet Settings] | AutoConfigProxy : wininet.dll

¤¤¤¤¤¤¤¤¤¤ DNS

[HKLM | Tcpip\Parameters] | DhcpNameServer = 192.168.1.254
[HKLM\CCS | Interfaces\{3F0915E2-40B7-47D7-8B66-759997250B2F}] | DhcpNameServer -> 192.168.1.254
[HKLM\CS1 | Interfaces\{3F0915E2-40B7-47D7-8B66-759997250B2F}] | DhcpNameServer -> 192.168.1.254
[HKLM\CS2 | Interfaces\{3F0915E2-40B7-47D7-8B66-759997250B2F}] | DhcpNameServer -> 192.168.1.254
[HKLM | Tcpip\Parameters] | NameServer = 

¤¤¤¤¤¤¤¤¤¤ Hosts ¤¤¤¤¤¤¤¤¤¤

#	127.0.0.1       localhost
#	::1             localhost

¤¤¤¤¤¤¤¤¤¤ Processus


¤¤¤¤¤¤¤¤¤¤ Traitement Fichiers | Dossiers | Registre

Mise en quarantaine :  C:\$Recycle.bin\S-1-5-21-2135916146-3893334040-3250946710-1000\desktop.ini
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFR2DF7.tmp
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFR63D4.tmp
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFR794F.tmp
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFRAB5B.tmp
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFRBD07.tmp
Mise en quarantaine :  C:\Users\Cyrielle\AppData\Local\Temp\TFRECC5.tmp

¤¤¤¤¤¤¤¤¤¤ IFEO


¤¤¤¤¤¤¤¤¤¤ Mountpoints2


¤¤¤¤¤¤¤¤¤¤ Listing %AppData%

[12/06/2011|18:10:21] | C:\Users\Cyrielle\AppData\Roaming\Adobe
[06/06/2011|17:39:58] | C:\Users\Cyrielle\AppData\Roaming\Identities
[12/06/2011|18:39:08] | C:\Users\Cyrielle\AppData\Roaming\Macromedia
[06/06/2011|17:39:09] | C:\Users\Cyrielle\AppData\Roaming\Media Center Programs
[06/06/2011|17:39:09] | C:\Users\Cyrielle\AppData\Roaming\Microsoft
[06/06/2011|20:07:31] | C:\Users\Cyrielle\AppData\Roaming\Mozilla
[06/06/2011|18:49:21] | C:\Users\Cyrielle\AppData\Roaming\OpenOffice.org
[12/06/2011|17:32:10] | C:\Users\Cyrielle\AppData\Roaming\Skype
[12/06/2011|18:38:17] | C:\Users\Cyrielle\AppData\Roaming\skypePM

¤¤¤¤¤¤¤¤¤¤ Listing %CommonAppData%

[12/06/2011|18:08:29] | C:\ProgramData\Adobe
[14/07/2009|05:53:55] | C:\ProgramData\Application Data
[06/06/2011|18:06:28] | C:\ProgramData\AVAST Software
[14/07/2009|05:53:55] | C:\ProgramData\Desktop
[14/07/2009|05:53:55] | C:\ProgramData\Documents
[14/07/2009|05:53:55] | C:\ProgramData\Favorites
[14/07/2009|03:37:05] | C:\ProgramData\Microsoft
[12/06/2011|17:30:12] | C:\ProgramData\Skype
[12/06/2011|18:38:16] | C:\ProgramData\Skype Extras
[14/07/2009|05:53:55] | C:\ProgramData\Start Menu
[06/06/2011|18:32:00] | C:\ProgramData\Sun
[14/07/2009|05:53:55] | C:\ProgramData\Templates

¤¤¤¤¤¤¤¤¤¤ Listing %LocalAppData%

[06/06/2011|17:39:09] | C:\Users\Cyrielle\AppData\Local\Temp
[12/06/2011|18:05:18] | C:\Users\Cyrielle\AppData\Local\Adobe
[06/06/2011|17:39:11] | C:\Users\Cyrielle\AppData\Local\Application Data
[12/06/2011|17:19:25] | C:\Users\Cyrielle\AppData\Local\GDIPFONTCACHEV1.DAT
[12/06/2011|17:31:42] | C:\Users\Cyrielle\AppData\Local\Google
[06/06/2011|17:39:11] | C:\Users\Cyrielle\AppData\Local\History
[06/06/2011|17:47:56] | C:\Users\Cyrielle\AppData\Local\IconCache.db
[06/06/2011|17:39:09] | C:\Users\Cyrielle\AppData\Local\Microsoft
[12/06/2011|22:51:53] | C:\Users\Cyrielle\AppData\Local\Microsoft Games
[06/06/2011|17:51:14] | C:\Users\Cyrielle\AppData\Local\Mozilla
[06/06/2011|17:39:11] | C:\Users\Cyrielle\AppData\Local\Temporary Internet Files
[06/06/2011|17:39:22] | C:\Users\Cyrielle\AppData\Local\VirtualStore
[12/06/2011|17:20:16] | C:\Users\Cyrielle\AppData\Local\Windows Live
[13/06/2011|11:59:12] | C:\Users\Cyrielle\AppData\Local\{00F9A805-F9B1-4E98-BD4D-6D3895890220}
[12/06/2011|18:15:45] | C:\Users\Cyrielle\AppData\Local\{A2B4DC9C-7824-478C-B034-C31F41F6184A}

¤¤¤¤¤¤¤¤¤¤ Listing %CommonFiles%

[12/06/2011|18:07:44] | C:\Program Files\Common Files\Adobe
[06/06/2011|18:31:57] | C:\Program Files\Common Files\Java
[14/07/2009|03:37:05] | C:\Program Files\Common Files\microsoft shared
[14/07/2009|03:37:05] | C:\Program Files\Common Files\Services
[12/06/2011|17:30:48] | C:\Program Files\Common Files\Skype
[14/07/2009|03:37:05] | C:\Program Files\Common Files\SpeechEngines
[14/07/2009|03:37:05] | C:\Program Files\Common Files\System
[12/06/2011|17:20:08] | C:\Program Files\Common Files\Windows Live

¤¤¤¤¤¤¤¤¤¤ Listing %Temp\Low%

[06/06/2011|19:51:07] | C:\Users\Cyrielle\AppData\Local\Temp\Low\_avast_

¤¤¤¤¤¤¤¤¤¤ Listing Tasks

[12/06/2011 | 17:31:50] | C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[12/06/2011 | 17:32:00] | C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

¤¤¤¤¤¤¤¤¤¤ Drivers | Services | R0 : Boot | R1 : System | R2 : Auto

R0 - ACPI (Microsoft ACPI Driver) -> system32\DRIVERS\ACPI.sys
R1 - AFD (@%systemroot%\system32\drivers\afd.sys,-1000) -> \SystemRoot\system32\drivers\afd.sys
R2 - AMD External Events Utility () -> %SystemRoot%\system32\atiesrxx.exe
R0 - amdxata () -> system32\DRIVERS\amdxata.sys
R2 - aswFsBlk (aswFsBlk) -> (?)
R2 - aswMonFlt (aswMonFlt) -> \??\C:\Windows\system32\drivers\aswMonFlt.sys
R1 - aswRdr (aswRdr) -> (?)
R1 - aswSnx (aswSnx) -> (?)
R1 - aswSP (aswSP) -> (?)
R1 - aswTdi (avast! Network Shield Support) -> (?)
R0 - atapi (IDE Channel) -> system32\DRIVERS\atapi.sys
R2 - AudioEndpointBuilder (@%SystemRoot%\system32\audiosrv.dll,-204) -> %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
R2 - Audiosrv (@%SystemRoot%\system32\audiosrv.dll,-200) -> %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
R2 - avast! Antivirus (avast! Antivirus) -> "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
R1 - Beep (Beep) -> (?)
R2 - BFE (@%SystemRoot%\system32\bfe.dll,-1001) -> %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork
R2 - BITS (@%SystemRoot%\system32\qmgr.dll,-1000) -> %SystemRoot%\System32\svchost.exe -k netsvcs
R1 - blbdrive () -> system32\DRIVERS\blbdrive.sys
R1 - cdrom (CD-ROM Driver) -> system32\DRIVERS\cdrom.sys
R0 - CLFS (@%SystemRoot%\system32\clfs.sys,-100) -> System32\CLFS.sys
R2 - clr_optimization_v4.0.30319_32 (Microsoft .NET Framework NGEN v4.0.30319_X86) -> C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
R0 - CNG () -> System32\Drivers\cng.sys
R0 - Compbatt (Microsoft Composite Battery Driver) -> system32\DRIVERS\compbatt.sys
R2 - CryptSvc (@%SystemRoot%\system32\cryptsvc.dll,-1001) -> %SystemRoot%\system32\svchost.exe -k NetworkService
R1 - CSC (@%systemroot%\system32\cscsvc.dll,-202) -> system32\drivers\csc.sys
R2 - CscService (@%systemroot%\system32\cscsvc.dll,-200) -> %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
R2 - DcomLaunch (@oleres.dll,-5012) -> %SystemRoot%\system32\svchost.exe -k DcomLaunch
R1 - DfsC (@%systemroot%\system32\drivers\dfsc.sys,-101) -> System32\Drivers\dfsc.sys
R2 - Dhcp (@%SystemRoot%\system32\dhcpcore.dll,-100) -> %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted
R1 - discache (@%systemroot%\system32\drivers\discache.sys,-102) -> System32\drivers\discache.sys
R0 - Disk (Disk Driver) -> system32\DRIVERS\disk.sys
R2 - Dnscache (@%SystemRoot%\System32\dnsapi.dll,-101) -> %SystemRoot%\system32\svchost.exe -k NetworkService
R2 - DPS (@%systemroot%\system32\dps.dll,-500) -> %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork
R2 - EapHost (@%systemroot%\system32\eapsvc.dll,-1) -> %SystemRoot%\System32\svchost.exe -k netsvcs
R2 - eventlog (@%SystemRoot%\system32\wevtsvc.dll,-200) -> %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
R2 - EventSystem (@comres.dll,-2450) -> %SystemRoot%\system32\svchost.exe -k LocalService
R2 - FDResPub (@%systemroot%\system32\fdrespub.dll,-100) -> %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation
R0 - FileInfo (@%SystemRoot%\system32\drivers\fileinfo.sys,-100) -> system32\drivers\fileinfo.sys
R0 - FltMgr (@%SystemRoot%\system32\drivers\fltmgr.sys,-10001) -> system32\drivers\fltmgr.sys
R2 - FontCache (@%systemroot%\system32\FntCache.dll,-100) -> %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation
R0 - fvevol (@%SystemRoot%\system32\drivers\fvevol.sys,-100) -> System32\DRIVERS\fvevol.sys
R2 - gpsvc (@gpapi.dll,-112) -> %systemroot%\system32\svchost.exe -k netsvcs
R0 - hwpolicy (@%systemroot%\system32\drivers\hwpolicy.sys,-101) -> System32\drivers\hwpolicy.sys
R2 - IKEEXT (@%SystemRoot%\system32\ikeext.dll,-501) -> %systemroot%\system32\svchost.exe -k netsvcs
R2 - iphlpsvc (@%SystemRoot%\system32\iphlpsvc.dll,-500) -> %SystemRoot%\System32\svchost.exe -k NetSvcs
R0 - KSecDD () -> System32\Drivers\ksecdd.sys
R0 - KSecPkg () -> System32\Drivers\ksecpkg.sys
R2 - LanmanServer (@%systemroot%\system32\srvsvc.dll,-100) -> %SystemRoot%\system32\svchost.exe -k netsvcs
R2 - LanmanWorkstation (@%systemroot%\system32\wkssvc.dll,-100) -> %SystemRoot%\System32\svchost.exe -k NetworkService
R2 - lltdio (Link-Layer Topology Discovery Mapper I/O Driver) -> system32\DRIVERS\lltdio.sys
R2 - lmhosts (@%SystemRoot%\system32\lmhsvc.dll,-101) -> %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted
R2 - luafv (@%systemroot%\system32\drivers\luafv.sys,-100) -> \SystemRoot\system32\drivers\luafv.sys
R0 - mountmgr (@%SystemRoot%\system32\drivers\mountmgr.sys,-100) -> System32\drivers\mountmgr.sys
R2 - MpsSvc (@%SystemRoot%\system32\FirewallAPI.dll,-23090) -> %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork
R1 - Msfs () -> (?)
R0 - msisadrv () -> system32\DRIVERS\msisadrv.sys
R1 - mssmbios (Microsoft System Management BIOS Driver) -> system32\DRIVERS\mssmbios.sys
R0 - Mup (@%systemroot%\system32\drivers\mup.sys,-101) -> System32\Drivers\mup.sys
R0 - NDIS (@%SystemRoot%\system32\drivers
dis.sys,-200) -> system32\drivers
dis.sys
R1 - NetBIOS (NetBIOS Interface) -> system32\DRIVERS
etbios.sys
R1 - NetBT (@%SystemRoot%\system32\drivers
etbt.sys,-2) -> System32\DRIVERS
etbt.sys
R2 - NlaSvc (@%SystemRoot%\System32
lasvc.dll,-1) -> %SystemRoot%\System32\svchost.exe -k NetworkService
R1 - Npfs () -> (?)
R2 - nsi (@%SystemRoot%\system32
sisvc.dll,-200) -> %systemroot%\system32\svchost.exe -k LocalService
R1 - nsiproxy (@%SystemRoot%\system32\drivers
siproxy.sys,-2) -> system32\drivers
siproxy.sys
R1 - Null () -> (?)
R0 - partmgr (@%SystemRoot%\system32\drivers\partmgr.sys,-100) -> System32\drivers\partmgr.sys
R0 - pci (PCI Bus Driver) -> system32\DRIVERS\pci.sys
R0 - pciide () -> system32\DRIVERS\pciide.sys
R0 - pcw (Performance Counters for Windows Driver) -> System32\drivers\pcw.sys
R2 - PEAUTH (PEAUTH) -> system32\drivers\peauth.sys
R2 - PlugPlay (@%SystemRoot%\system32\umpnpmgr.dll,-100) -> %SystemRoot%\system32\svchost.exe -k DcomLaunch
R2 - Power (@%SystemRoot%\system32\umpo.dll,-100) -> %SystemRoot%\system32\svchost.exe -k DcomLaunch
R2 - ProfSvc (@%systemroot%\system32\profsvc.dll,-300) -> %systemroot%\system32\svchost.exe -k netsvcs
R1 - Psched (@%SystemRoot%\System32\drivers\pacer.sys,-101) -> system32\DRIVERS\pacer.sys
R1 - rdbss (@%systemroot%\system32\wkssvc.dll,-1000) -> system32\DRIVERSdbss.sys
R1 - RDPCDD (@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100) -> System32\DRIVERS\RDPCDD.sys
R1 - RDPENCDD (@%systemroot%\system32\drivers\RDPENCDD.sys,-101) -> system32\driversdpencdd.sys
R1 - RDPREFMP (@%systemroot%\system32\drivers\RdpRefMp.sys,-101) -> system32\driversdprefmp.sys
R0 - rdyboost (ReadyBoost) -> System32\driversdyboost.sys
R2 - RpcEptMapper (@%windir%\system32\RpcEpMap.dll,-1001) -> %SystemRoot%\system32\svchost.exe -k RPCSS
R2 - RpcSs (@oleres.dll,-5010) -> %SystemRoot%\system32\svchost.exe -k rpcss
R2 - rspndr (Link-Layer Topology Discovery Responder) -> system32\DRIVERSspndr.sys
R2 - SamSs (@%SystemRoot%\system32\samsrv.dll,-1) -> %SystemRoot%\system32\lsass.exe
R2 - Schedule (@%SystemRoot%\system32\schedsvc.dll,-100) -> %systemroot%\system32\svchost.exe -k netsvcs
R2 - secdrv (Security Driver) -> (?)
R2 - SENS (@%SystemRoot%\system32\Sens.dll,-200) -> %SystemRoot%\system32\svchost.exe -k netsvcs
R2 - ShellHWDetection (@%SystemRoot%\System32\shsvcs.dll,-12288) -> %SystemRoot%\System32\svchost.exe -k netsvcs
R0 - spldr (Security Processor Loader Driver) -> (?)
R2 - Spooler (@%systemroot%\system32\spoolsv.exe,-1) -> %SystemRoot%\System32\spoolsv.exe
R0 - storflt (@%SystemRoot%\system32\vmstorfltres.dll,-1000) -> system32\DRIVERS\vmstorfl.sys
R2 - SysMain (@%SystemRoot%\system32\sysmain.dll,-1000) -> %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted
R0 - Tcpip (@%SystemRoot%\system32	cpipcfg.dll,-50003) -> System32\drivers	cpip.sys
R2 - tcpipreg (TCP/IP Registry Compatibility) -> System32\drivers	cpipreg.sys
R1 - tdx (@%SystemRoot%\system32	cpipcfg.dll,-50004) -> system32\DRIVERS	dx.sys
R1 - TermDD (Terminal Device Driver) -> system32\DRIVERS	ermdd.sys
R2 - Themes (@%SystemRoot%\System32	hemeservice.dll,-8192) -> %SystemRoot%\System32\svchost.exe -k netsvcs
R2 - TrkWks (@%SystemRoot%\system32	rkwks.dll,-1) -> %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
R2 - UxSms (@%SystemRoot%\system32\dwm.exe,-2000) -> %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted
R0 - vdrvroot (Microsoft Virtual Drive Enumerator Driver) -> system32\DRIVERS\vdrvroot.sys
R1 - VgaSave () -> \SystemRoot\System32\drivers\vga.sys
R0 - volmgr (Volume Manager Driver) -> system32\DRIVERS\volmgr.sys
R0 - volmgrx (@%SystemRoot%\system32\drivers\volmgrx.sys,-100) -> System32\drivers\volmgrx.sys
R0 - volsnap (Storage volumes) -> system32\DRIVERS\volsnap.sys
R1 - vwififlt (Virtual WiFi Filter Driver) -> system32\DRIVERS\vwififlt.sys
R1 - Wanarpv6 (@%systemroot%\system32ascfg.dll,-32012) -> system32\DRIVERS\wanarp.sys
R0 - Wdf01000 (Kernel Mode Driver Frameworks service) -> system32\drivers\Wdf01000.sys
R2 - WerSvc (@%SystemRoot%\System32\wersvc.dll,-100) -> %SystemRoot%\System32\svchost.exe -k WerSvcGroup
R1 - WfpLwf (WFP Lightweight Filter) -> system32\DRIVERS\wfplwf.sys
R2 - Winmgmt (@%Systemroot%\system32\wbem\wmisvc.dll,-205) -> %systemroot%\system32\svchost.exe -k netsvcs
R2 - Wlansvc (@%SystemRoot%\System32\wlansvc.dll,-257) -> %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted
R2 - wlidsvc (Windows Live ID Sign-in Assistant) -> "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
R2 - wscsvc (@%SystemRoot%\System32\wscsvc.dll,-200) -> %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted
R2 - WSearch (@%systemroot%\system32\SearchIndexer.exe,-103) -> %systemroot%\system32\SearchIndexer.exe /Embedding
R2 - wuauserv (@%systemroot%\system32\wuaueng.dll,-105) -> %systemroot%\system32\svchost.exe -k netsvcs
R2 - wudfsvc (@%SystemRoot%\system32\wudfsvc.dll,-1000) -> %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

¤¤¤¤¤¤¤¤¤¤ Security 

[HKLM | Security Center\Svc] | AntispywareOverride : 0
[HKLM | Security Center\Svc] | AntiVirusOverride : 0
[HKLM | Security Center\Svc] | FirewallOverride : 0

¤¤¤

C:\Windows\explorer.exe -> Processus redémarré

Pre_Script.exe : Pour le faire apparaitre , glisser-déposer une icone sur Pre_scan

Fin : 12:19:31

¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

ok une question :

la sandbox d'avast est desactivée aussi ?

cycy_ · Answer

Oui elle l'était, tu veux que je recommence en la désactivant?

Tu as pu remarqué ce qui clochait?

g3n-h@ckm@n · Answer

non on va faire un diagnostic :

&#9654 Télécharge ZHPDiag (de Nicolas Coolman) 

ou :ZHPDiag

&#9654 Enregistre le sur ton Bureau.

Une fois le téléchargement achevé, 

&#9654 lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

&#9654 Clique sur le tournevis puis sur Tous pour cocher toutes les cases des options.

&#9654 Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, 

&#9654 clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

cycy_ · Answer

je n'arrive pas a lancer de rapport, dans tout ce que tu m'a dit il n'y a que l'appareil photo

g3n-h@ckm@n · Answer

fais un capture d'écran ?

cycy_ · Answer

voici : http://www.cijoint.fr/cjlink.php?file=cj201106/cijHz8QL7j.jpg

g3n-h@ckm@n · Answer

normal c'est pas zhpdiag que tu as lancé

cycy_ · Answer

jy suis arrivée ! : http://www.cijoint.fr/cjlink.php?file=cj201106/cijmP6be7x.txt

g3n-h@ckm@n · Answer

mets windows à jour

cycy_ · Answer

et comment tu fais ça? kar on m'a installé windows 7 hier

g3n-h@ckm@n · Answer

qui te l'a installé ? avec quoi ?

cycy_ · Answer

un ami avec un CD, mais le message que j'ai maintenant j'avais le même sous vista, exactement le même message. Tu vois d'où ça vient?

g3n-h@ckm@n · Answer

c'est quoi le message exactement ?

cycy_ · Answer

Voici une capture decran : 

http://www.cijoint.fr/cjlink.php?file=cj201106/cij5WqYjVr.jpg

je dois aller travailler je te répond au plus vite ce soir
tiens moi au courant
merci bcp pour ton aide

g3n-h@ckm@n · Answer

supprime pre_scan , retelecharge-le puis relance-le puis poste via cijoint.fr

cycy_ · Answer

bonjour

voici le doc : http://www.cijoint.fr/cjlink.php?file=cj201106/cij3e0UUxU.txt

cycy_ · Answer

ps : le parefeu windows etait bien désactivé, je comprend pas pkoi il dit "actif" encore

g3n-h@ckm@n · Answer

refais zhpdiag

cycy_ · Answer

http://www.cijoint.fr/cjlink.php?file=cj201106/cijpcmWNUm.txt

g3n-h@ckm@n · Answer

rien n'indique que tu aies encore cette infection dans les rapports

Télécharge ici :OTL

&#9654 enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.

&#9654 => Clique ici pour voir la Configuration

&#9654Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

Pour me le transmettre clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

juste au niveau du bouton , en fin de chargement du fichier , Un lien de cette forme apparaitra :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

&#9654 Copie ce lien dans ta réponse.

&#9654&#9654 Tu feras la meme chose avec le "Extra.txt" qui logiquement sera aussi sur ton bureau.

cycy_ · Answer

http://www.cijoint.fr/cjlink.php?file=cj201106/cijm4r40rg.txt

http://www.cijoint.fr/cjlink.php?file=cj201106/cijSWJxiX6.txt

et voici les deux docs

g3n-h@ckm@n · Answer

t'as pas exactement suivi la config

supprime tous ces installeur de flash player et compagnie puis refais OTL sans rien oublier

cycy_ · Answer

qu'enten tu pas "supprimer tous les installateurs de flash player"?

Et si j'ai suivi la config, j'ai coché tous partout et respecté tout ce qu'ils avaient coché, la je comprend pas

g3n-h@ckm@n · Answer

mmm alors tu n'as pas mmis le rapport entier

sur ton bureau tu as des trucs install_Flash_Player etc...;vire tout

cycy_ · Answer

ok, je dois filer la mais je fais ça demain je pense j'ai la journée pour m'en occuper

merci pour ton aide encore

g3n-h@ckm@n · Answer

pas de soucis à demain

cycy_ · Answer

salut ! 

j'ai refait les rapport en supprimant les instalateur flash et en suivant les consignes.

http://www.cijoint.fr/cjlink.php?file=cj201106/cijnzlVMeB.txt
http://www.cijoint.fr/cjlink.php?file=cj201106/cijzFXar5a.txt

g3n-h@ckm@n · Answer

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)  
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)   
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) 

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"SunJavaUpdateSched"=-

:Files
C:\Users\Cyrielle\AppData\Local\{*}           
C:\f7bd63d638a1153c3ee18dc84efa8de3      
C:\Users\Cyrielle\Desktop\Reload_Tds*.exe    
C:\Windows	øS      

:commands
[CLEARALLRESTOREPOINTS]
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

cycy_ · Answer

voici le rapport :

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
Process msnmsgr.exe killed successfully!
No active process named Teatimer.exe was found!
========== OTL ==========
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched deleted successfully.
========== FILES ==========
C:\Users\Cyrielle\AppData\Local\{00F9A805-F9B1-4E98-BD4D-6D3895890220} folder moved successfully.
C:\Users\Cyrielle\AppData\Local\{0666BD9C-A781-4BD4-87AC-0EAE012E0F5F} folder moved successfully.
C:\Users\Cyrielle\AppData\Local\{070EEAB5-77CC-4051-9EAC-A08834AD74C1} folder moved successfully.
C:\Users\Cyrielle\AppData\Local\{8043916B-2EE7-4F69-8334-678AA5AC1449} folder moved successfully.
C:\Users\Cyrielle\AppData\Local\{A2B4DC9C-7824-478C-B034-C31F41F6184A} folder moved successfully.
C:\Users\Cyrielle\AppData\Local\{B347C2D6-C1C1-4AF4-B4D5-083E4758F9D6} folder moved successfully.
C:\f7bd63d638a1153c3ee18dc84efa8de3 folder moved successfully.
C:\Users\Cyrielle\Desktop\Reload_Tdsskiller(1).exe moved successfully.
C:\Users\Cyrielle\Desktop\Reload_Tdsskiller(2).exe moved successfully.
C:\Users\Cyrielle\Desktop\Reload_Tdsskiller(3).exe moved successfully.
C:\Users\Cyrielle\Desktop\Reload_Tdsskiller(4).exe moved successfully.
C:\Users\Cyrielle\Desktop\Reload_Tdsskiller.exe moved successfully.
C:\Windows	øS moved successfully.
========== COMMANDS ==========

 
[EMPTYTEMP]
 
User: All Users
 
User: Cyrielle
->Temp folder emptied: 25636509 bytes
->Temporary Internet Files folder emptied: 84420615 bytes
->Java cache emptied: 350041 bytes
->FireFox cache emptied: 45027076 bytes
->Google Chrome cache emptied: 6421082 bytes
->Flash cache emptied: 834 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11807452 bytes
RecycleBin emptied: 30852784 bytes
 
Total Files Cleaned = 195,00 mb
 
 
OTL by OldTimer - Version 3.2.24.0 log created on 06152011_134055

Files\Folders moved on Reboot...
File move failed. C:\Windows	emp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

g3n-h@ckm@n · Answer

quels soucis persistent ?

cycy_ · Answer

le message a l'air de ne plus s'afficher mais c'est étrange.
Je veux juste être sur de n'avoir aucun virus. Car quand j'ai vu le même message sur 7 que sur vista ça ma fait flipper.

As tu pu voir qqch de ton côté?

g3n-h@ckm@n · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : Si tu as un message d'erreur t'indiquant qu'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

&#9654 Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

cycy_ · Answer

j'ai fait le scan, aucun virus apparement comme tu peux le voir ci dessous.
si tout est bon, comprends tu pourquoi j'ai eu ce message de seven? exactement le même que celui que j'avais eu sur vista avant de formater?
J'ai constaté que ces messages ont apparu la premiere fois (sous vista et sous seven) quand j'étais sur un site de streaming. Penses tu que cela est lié?



Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Version de la base de données: 6861

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

15/06/2011 15:27:53
mbam-log-2011-06-15 (15-27-53).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 241365
Temps écoulé: 33 minute(s), 34 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

g3n-h@ckm@n · Answer

oui cela est lié les page de streaming sont traffiquées et des codes invisibles sont rajoutés dans les pages par des pros qui connaissent les failles des codes sources des pages internet.

cycy_ · Answer

ce qui signifie ? désolée j'ai pas tout saisi?
virus pas virus? pkoi vista et 7 mont mis les meme message?

g3n-h@ckm@n · Answer

parce que tu as visité les memes site pourris avec les deux systemes

cycy_ · Answer

mais au final j'ai un virus ou c'était juste une sorte de "blague"?

Car j'ai été pendant plusieurs années sur ces sites et jamais de probleme? 
Désolée pour toutes ces questions je veux juste comprendre ^^

g3n-h@ckm@n · Answer

je ne pense pas 

refais zhpdiag

un peu de lecture aussi :

https://forum.malekal.com/viewtopic.php?t=589&start=

cycy_ · Answer

article hyper interessant, donc en gros c t du fake pour que jachette lanti virus de windows?? Mais windows ne peux pas faire ça ???! si?

cycy_ · Answer

Bah c'est une fenetre windows qui s'ouvraient, et quand je voulais effacer, il voulais que j'achete la version payante de lanti virus windows , donc quel interet de faire ça? désolée si j'insiste je veux juste comprendre ça m'interesse

sinon voici le rapport zhp diag: virus ou pas alors?

Rapport de ZHPDiag v1.27.2301 par Nicolas Coolman, Update du 13/06/2011
Run by Cyrielle at 15/06/2011 16:25:51
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html


---\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385
MFIE: Mozilla Firefox 4.0.1 v4.0.1 (Defaut)
GCIE: Google Chrome v12.0.742.100

---\ System Information
Windows 7 Ultimate Edition, 32-bit  (Build 7600)
Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3071 MB (54% free)
System Restore: Activé (Enable)
System drive C: has 276 GB (92%) free of 298 GB

---\ Logged in mode
Computer Name: CYRIELLE-PC
User Name: Cyrielle
All Users Names: Guest, Cyrielle, Administrator, 
Unselected Option: None
Logged in as Administrator

---\ Environnement Variables
%AppData%=C:\Users\Cyrielle\AppData\Roaming
%LocalAppData%=C:\Users\Cyrielle\AppData\Local
%StartMenu%=C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 276 Go of 298 Go)
D:\ CD-ROM drive (Not Inserted)



---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK



---\ Search Generic System Files
[MD5.2AF58D15EDC06EC6FDACCE1F19482BBF] - (.Microsoft Corporation - Explorateur Windows.) (.26/02/2011 05:33:07.) -- C:\Windows\Explorer.exe [2614784]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 01:14:45.) -- C:\Windows\system32\Wininit.exe [96256]
[MD5.214605C48AE416BC067C39D227CFCC57] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.24/02/2011 05:32:44.) -- C:\Windows\system32\wininet.dll [981504]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.28/10/2009 06:17:59.) -- C:\Windows\system32\Winlogon.exe [285696]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 01:26:15.) -- C:\Windows\system32\drivers\atapi.sys [21584]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.14/07/2009 01:20:44.) -- C:\Windows\system32\drivers
tfs.sys [1210432]



---\ Processi correnti
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- C:\Windows\System32undll32.exe   [44544]
[MD5.D378BFFB70923139D6A4F546864AA61C] - (.Microsoft Corporation - Bloc-notes.) -- C:\Windows
otepad.exe   [179712]
[MD5.4C6898F15701AE7C41775C14E423FE25] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe   [3459712]
[MD5.B0DA80FF42A0819D162A86612896AAF2] - (.Microsoft Corporation - Windows Update.) -- C:\Windows\system32\wuauclt.exe   [47104]
[MD5.2487C45B64790FC210547919F18FAC71] - (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe   [1047656]
[MD5.F06CA6475B7A538DB9DC3F7B896B97E4] - (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe   [449584]
[MD5.D378BFFB70923139D6A4F546864AA61C] - (.Microsoft Corporation - Bloc-notes.) -- C:\Windows\system32\NOTEPAD.EXE   [179712]
[MD5.E83508D9A0F0D0D8449317DC6A4C5E02] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe   [924632]
[MD5.3B2CC09944488DB5ED5DFDC315C9AB57] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe   [16856]
[MD5.392C346D281BD5309CCE9C31B08D37A9] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [658432]



---\ Mozilla Firefox, Plugins,Avviamento,Ricerca,Estensione (P2,M0,M1,M2,M3)
C:\Users\Cyrielle\AppData\Roaming\Mozilla\Firefox\Profiles\jmh1635h.default\prefs.js
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [Cyrielle] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Unknown owner - No comment.) -- C:\Windows\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_22 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.0.60310.0.) -- c:\Program Files\Microsoft Silverlight\4.0.60310.0
pctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3502.0922] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=15.4.3508.1109] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.2.183.23
pGoogleOneClick8.dll
M0 - MFSP: prefs.js [Cyrielle - jmh1635h.default] WWW.GOOGLE.FR



---\ Google Chrome, Avviamento,Ricerca,Estensione (G0,G1,G3)
C:\Users\Cyrielle\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://www.google.com
G2 - GCE: Preference [User Data\Default] [icmlaeflemplmjndnaapfdbbnpncnbda] avast! WebRep v.6.0.1125 (Activé)



---\ Internet Explorer, Avviamento,Ricerca,Estensione (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com
R0 - HKUS\S-1-5-21-2135916146-3893334040-3250946710-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKUS\S-1-5-21-2135916146-3893334040-3250946710-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\System32\ieframe.dll
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2



---\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll



---\ ---\ Changed inifile Value, Mapped to Registry (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe



---\ Browser Helper Objects (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corp. - Microsoft® Windows Live ID Login Helper.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jp2ssv.dll



---\ ---\ Auto loading programs from Registry (O4)
O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe 
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe 
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-21-2135916146-3893334040-3250946710-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe 
O4 - HKUS\S-1-5-21-2135916146-3893334040-3250946710-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 



---\ ---\ Other User Links (O4)
O4 - Global Startup: C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Cyrielle\Desktop\Computer - Shortcut.lnk - Orphean Key
O4 - Global Startup: C:\Users\Cyrielle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk . (.Google Inc..)  -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - Global Startup: C:\Users\Cyrielle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.)  -- C:\Program Files\Internet Explorer\iexplore.exe



---\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBro
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico



---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32
apinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\Windows\system32\wshbth.dll
O10 - WLSP:\000000000008\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
O10 - WLSP:\000000000009\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL



---\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{3F0915E2-40B7-47D7-8B66-759997250B2F}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254



---\ Extra protocols and protocol Hijackers (O18)
O18 - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} . (.Skype Technologies S.A. - Skype add-on for IE.) -- C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} . (.Skype Technologies - Skype for COM API.) -- C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL



---\ ShellServiceObjectDelayLoad (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.



---\ non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: C:\Windows\system32\Alg.exe (AMD External Events Utility) . (.AMD - AMD External Events Service Module.) - C:\Windows\system32\atiesrxx.exe
O23 - Service:  (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service:  (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: C:\Windows\system32\drivers\luafv.sys (MBAMService) . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service:  (wlidsvc) . (.Microsoft Corp. - Microsoft® Windows Live ID Service.) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.exe



---\ Windows Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) -  (.not file.)



---\ Compiti progettati in automazione (O39)
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe
[MD5.0EA8C1256AA9F68287CD8F06EB527238] [APT] [{567C4356-2387-4AF6-905C-5D6BDE6F905B}] (.Skype Technologies S.A..) -- C:\Program Files\Skype\Phone\Skype.exe



---\ Drivers lanciati all'avviamento (O41)
O41 - Driver: C:\Windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver:  (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\system32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\System32\drivers\csc.sys
O41 - Driver: C:\Windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver:  (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver:  (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS
etbios.sys
O41 - Driver: C:\Windows\system32\drivers
etbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS
etbt.sys
O41 - Driver: C:\Windows\system32\drivers
siproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers
siproxy.sys
O41 - Driver: C:\Windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERSdbss.sys
O41 - Driver: C:\Windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\driversdpencdd.sys
O41 - Driver: C:\Windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\driversdprefmp.sys
O41 - Driver: C:\Windows\system32	cpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS	dx.sys
O41 - Driver:  (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS	ermdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver:  (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\Windows\System32\DRIVERS\vwififlt.sys
O41 - Driver: C:\Windows\system32ascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver:  (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys



---\ Softwares installati (O42)
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader 9.4.0 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A94000000001}
O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM] -- {488F0347-C4A7-4374-91A7-30818BEDA710}
O42 - Logiciel: Google Chrome - (.Google Inc..) [HKLM] -- Google Chrome
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Java(TM) 6 Update 22 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216022FF}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM] -- {1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
O42 - Logiciel: Malwarebytes' Anti-Malware version 1.51.0.1200 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Mozilla Firefox 4.0.1 (x86 fr) - (.Mozilla.) [HKLM] -- Mozilla Firefox 4.0.1 (x86 fr)
O42 - Logiciel: OpenOffice.org 3.3 - (.OpenOffice.org.) [HKLM] -- {05653DE1-6567-40C6-B930-39D399B64369}
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) - (.Microsoft Corporation.) [HKLM] -- {3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2446708
O42 - Logiciel: Skype Toolbars - (.Skype Technologies S.A..) [HKLM] -- {B6CF2967-C81E-40C0-9815-C05774FEF120}
O42 - Logiciel: Skype(TM) 5.3 - (.Skype Technologies S.A..) [HKLM] -- {5335DADB-34BA-4AE8-A519-648D78498846}
O42 - Logiciel: Windows Live - (.Microsoft Corporation.) [HKLM] -- WinLiveSuite
O42 - Logiciel: Windows Live - (.Microsoft Corporation.) [HKLM] -- {34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM] -- {D45240D3-B6B3-4FF9-B243-54ECE3E10066}
O42 - Logiciel: Windows Live ID Sign-in Assistant - (.Microsoft Corporation.) [HKLM] -- {61AD15B2-50DB-4686-A739-14FE180D4429}
O42 - Logiciel: Windows Live Installer - (.Microsoft Corporation.) [HKLM] -- {0B0F231F-CE6A-483D-AA23-77B364F75917}
O42 - Logiciel: Windows Live MIME IFilter - (.Microsoft Corporation.) [HKLM] -- {AF844339-2F8A-4593-81B3-9F4C54038C4E}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {9D56775A-93F3-44A3-8092-840E3826DE30}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM] -- {9FAE6E8D-E686-49F5-A574-0A58DFD9580C}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {6057E21C-ABE9-4059-AE3E-3BEB9925E660}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM] -- {EB4DF488-AAEF-406F-A341-CB2AAA315B90}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM] -- {92EA4134-10D1-418A-91E1-5A0453131A38}
O42 - Logiciel: Windows Live PIMT Platform - (.Microsoft Corporation.) [HKLM] -- {83C292B7-38A5-440B-A731-07070E81A64F}
O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {A9BDCA6B-3653-467B-AC83-94367DA3BFE3}
O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM] -- {C893D8C0-1BA0-4517-B11C-E89B65E72F70}
O42 - Logiciel: Windows Live Photo Gallery - (.Microsoft Corporation.) [HKLM] -- {3336F667-9049-4D46-98B6-4C743EEBC5B1}
O42 - Logiciel: Windows Live SOXE - (.Microsoft Corporation.) [HKLM] -- {682B3E4F-696A-42DE-A41C-4C07EA1678B4}
O42 - Logiciel: Windows Live SOXE Definitions - (.Microsoft Corporation.) [HKLM] -- {200FEC62-3C34-4D60-9CE8-EC372E01C08F}
O42 - Logiciel: Windows Live UX Platform - (.Microsoft Corporation.) [HKLM] -- {CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}
O42 - Logiciel: Windows Live UX Platform Language Pack - (.Microsoft Corporation.) [HKLM] -- {05E379CC-F626-4E7D-8354-463865B303BF}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {3B9A92DA-6374-4872-B646-253F18624D5F}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {A726AE06-AAA3-43D1-87E3-70F510314F04}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM] -- {AAAFC670-569B-4A2F-82B4-42945E0DE3EF}
O42 - Logiciel: Windows Live Writer Resources - (.Microsoft Corporation.) [HKLM] -- {62687B11-58B5-4A18-9BC3-9DF4CE03F194}
O42 - Logiciel: avast! Free Antivirus - (.AVAST Software.) [HKLM] -- avast

---\ HKCU & HKLM Software Keys
[HKCU\Software\AVAST Software]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\EasyBits]
[HKCU\Software\Google]
[HKCU\Software\IM Providers]
[HKCU\Software\JavaSoft]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Netscape]
[HKCU\Software\OpenOffice.org]
[HKCU\Software\Policies]
[HKCU\Software\Skype]
[HKCU\Software\Sysinternals]
[HKCU\Software\g3n-h@ckm@n]
[HKLM\Software\AMD]
[HKLM\Software\ATI Technologies]
[HKLM\Software\AVAST Software]
[HKLM\Software\Adobe]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\Google]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\ODBC]
[HKLM\Software\OldTimer Tools]
[HKLM\Software\OpenOffice.org]
[HKLM\Software\Policies]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Skype]
[HKLM\Software\Sonic]
[HKLM\Software\mozilla.org]
[HKLM\Software	dbg_trace]



---\ Contenuto delle files comuni (O43)
O43 - CFD: 12/06/2011 - 18:07:46 - [244060795] ----D- C:\Program Files\Adobe
O43 - CFD: 06/06/2011 - 18:06:30 - [162375671] ----D- C:\Program Files\AVAST Software
O43 - CFD: 12/06/2011 - 18:07:46 - [359170041] ----D- C:\Program Files\Common Files
O43 - CFD: 06/06/2011 - 20:23:04 - [83297300] ----D- C:\Program Files\DVD Maker
O43 - CFD: 12/06/2011 - 17:36:48 - [256009311] ----D- C:\Program Files\Google
O43 - CFD: 06/06/2011 - 20:23:04 - [4560041] ----D- C:\Program Files\Internet Explorer
O43 - CFD: 06/06/2011 - 18:30:22 - [90682362] ----D- C:\Program Files\Java
O43 - CFD: 15/06/2011 - 14:53:14 - [7566409] ----D- C:\Program Files\Malwarebytes' Anti-Malware
O43 - CFD: 14/07/2009 - 08:50:26 - [148361778] ----D- C:\Program Files\Microsoft Games
O43 - CFD: 13/06/2011 - 11:57:34 - [38388859] ----D- C:\Program Files\Microsoft Silverlight
O43 - CFD: 12/06/2011 - 17:52:34 - [1829877] ----D- C:\Program Files\Microsoft SQL Server Compact Edition
O43 - CFD: 13/06/2011 - 12:04:48 - [15715] ----D- C:\Program Files\Microsoft.NET
O43 - CFD: 06/06/2011 - 20:07:28 - [33786165] ----D- C:\Program Files\Mozilla Firefox
O43 - CFD: 14/07/2009 - 05:52:32 - [25757] ----D- C:\Program Files\MSBuild
O43 - CFD: 06/06/2011 - 18:35:32 - [368732202] ----D- C:\Program Files\OpenOffice.org 3
O43 - CFD: 06/06/2011 - 18:40:56 - [786432] ----D- C:\Program Files\Protector Suite
O43 - CFD: 14/07/2009 - 05:52:32 - [38597377] ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 12/06/2011 - 17:31:34 - [28812298] R---D- C:\Program Files\Skype
O43 - CFD: 14/07/2009 - 05:53:24 - [0] --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 06/06/2011 - 20:23:04 - [3147264] ----D- C:\Program Files\Windows Defender
O43 - CFD: 06/06/2011 - 20:23:04 - [7121528] ----D- C:\Program Files\Windows Journal
O43 - CFD: 12/06/2011 - 17:51:58 - [147268936] ----D- C:\Program Files\Windows Live
O43 - CFD: 06/06/2011 - 20:23:06 - [6704640] ----D- C:\Program Files\Windows Mail
O43 - CFD: 06/06/2011 - 20:23:04 - [6741931] ----D- C:\Program Files\Windows Media Player
O43 - CFD: 14/07/2009 - 05:52:32 - [12257460] ----D- C:\Program Files\Windows NT
O43 - CFD: 06/06/2011 - 20:23:04 - [4457224] ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 05:52:34 - [189440] ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 06/06/2011 - 20:23:06 - [7761634] ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 15/06/2011 - 16:26:02 - [4065199] ----D- C:\Program Files\ZHPDiag
O43 - CFD: 12/06/2011 - 18:08:36 - [6281214] ----D- C:\Program Files\Common Files\Adobe
O43 - CFD: 06/06/2011 - 18:31:58 - [1243079] ----D- C:\Program Files\Common Files\Java
O43 - CFD: 12/06/2011 - 17:46:22 - [55563822] ----D- C:\Program Files\Common Files\microsoft shared
O43 - CFD: 14/07/2009 - 03:37:06 - [2702] ----D- C:\Program Files\Common Files\Services
O43 - CFD: 12/06/2011 - 17:30:50 - [2254216] ----D- C:\Program Files\Common Files\Skype
O43 - CFD: 14/07/2009 - 03:37:06 - [41106343] ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 06/06/2011 - 20:23:04 - [10383859] ----D- C:\Program Files\Common Files\System
O43 - CFD: 12/06/2011 - 17:20:10 - [242334806] ----D- C:\Program Files\Common Files\Windows Live
O43 - CFD: 12/06/2011 - 18:11:00 - [763] ----D- C:\ProgramData\Adobe
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Application Data
O43 - CFD: 06/06/2011 - 18:06:30 - [33714513] ----D- C:\ProgramData\AVAST Software
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Desktop
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Documents
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Favorites
O43 - CFD: 15/06/2011 - 14:53:12 - [6813578] ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 12/06/2011 - 17:46:52 - [145597068] -S--D- C:\ProgramData\Microsoft
O43 - CFD: 12/06/2011 - 17:30:40 - [23206924] ----D- C:\ProgramData\Skype
O43 - CFD: 12/06/2011 - 18:39:32 - [5318087] ----D- C:\ProgramData\Skype Extras
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 06/06/2011 - 18:32:02 - [119] ----D- C:\ProgramData\Sun
O43 - CFD: 14/07/2009 - 05:53:56 - [0] -SH-D- C:\ProgramData\Templates
O43 - CFD: 12/06/2011 - 18:39:10 - [146348] ----D- C:\Users\Cyrielle\AppData\Roaming\Adobe
O43 - CFD: 06/06/2011 - 17:40:00 - [0] ----D- C:\Users\Cyrielle\AppData\Roaming\Identities
O43 - CFD: 12/06/2011 - 18:39:10 - [456] ----D- C:\Users\Cyrielle\AppData\Roaming\Macromedia
O43 - CFD: 15/06/2011 - 14:53:18 - [1052] ----D- C:\Users\Cyrielle\AppData\Roaming\Malwarebytes
O43 - CFD: 14/07/2009 - 08:48:46 - [0] ----D- C:\Users\Cyrielle\AppData\Roaming\Media Center Programs
O43 - CFD: 12/06/2011 - 19:31:00 - [1517404] -S--D- C:\Users\Cyrielle\AppData\Roaming\Microsoft
O43 - CFD: 06/06/2011 - 20:07:44 - [13604898] ----D- C:\Users\Cyrielle\AppData\Roaming\Mozilla
O43 - CFD: 06/06/2011 - 18:49:22 - [1501890] ----D- C:\Users\Cyrielle\AppData\Roaming\OpenOffice.org
O43 - CFD: 15/06/2011 - 14:49:20 - [1534557] ----D- C:\Users\Cyrielle\AppData\Roaming\Skype
O43 - CFD: 14/06/2011 - 17:28:38 - [57240] ----D- C:\Users\Cyrielle\AppData\Roaming\skypePM
O43 - CFD: 12/06/2011 - 18:10:38 - [4427817] ----D- C:\Users\Cyrielle\Appdata\Local\Adobe
O43 - CFD: 06/06/2011 - 17:39:12 - [0] -SH-D- C:\Users\Cyrielle\Appdata\Local\Application Data
O43 - CFD: 12/06/2011 - 18:38:44 - [923001] ----D- C:\Users\Cyrielle\Appdata\Local\Google
O43 - CFD: 06/06/2011 - 17:39:12 - [0] -SH-D- C:\Users\Cyrielle\Appdata\Local\History
O43 - CFD: 12/06/2011 - 18:05:58 - [108274881] ----D- C:\Users\Cyrielle\Appdata\Local\Microsoft
O43 - CFD: 12/06/2011 - 22:53:14 - [148987] ----D- C:\Users\Cyrielle\Appdata\Local\Microsoft Games
O43 - CFD: 06/06/2011 - 17:51:16 - [38773658] ----D- C:\Users\Cyrielle\Appdata\Local\Mozilla
O43 - CFD: 15/06/2011 - 16:25:36 - [446273] ----D- C:\Users\Cyrielle\Appdata\Local\Temp
O43 - CFD: 06/06/2011 - 17:39:12 - [0] -SH-D- C:\Users\Cyrielle\Appdata\Local\Temporary Internet Files
O43 - CFD: 06/06/2011 - 17:39:24 - [0] ----D- C:\Users\Cyrielle\Appdata\Local\VirtualStore
O43 - CFD: 15/06/2011 - 05:55:24 - [32768] ----D- C:\Users\Cyrielle\Appdata\Local\Windows Live
O43 - CFD: 14/07/2009 - 05:42:06 - [14619] R---D- C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 06/06/2011 - 19:40:06 - [174] R---D- C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 14/07/2009 - 05:37:44 - [580] R---D- C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 12/06/2011 - 21:08:42 - [0] R---D- C:\Users\Cyrielle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup



---\ Ultimi files modificati o creati sotto Windows e System32 (O44)
O44 - LFC:[MD5.2C000000000000000000000064EF1200] - 15/06/2011 - 15:22:36 ---A- . (...) -- C:\Windows\WindowsUpdate.log   [1943523]
O44 - LFC:[MD5.27F9186F8A6A0792EDC961541EDBE048] - 15/06/2011 - 12:49:16 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0   [10016]
O44 - LFC:[MD5.27F9186F8A6A0792EDC961541EDBE048] - 15/06/2011 - 12:49:16 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0   [10016]
O44 - LFC:[MD5.43AA7CAF94FDBA1E29DC459474D67645] - 15/06/2011 - 12:48:30 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI   [1549700]
O44 - LFC:[MD5.F1B6F8652097712E94BF2F0BA624FB60] - 15/06/2011 - 12:48:30 ---A- . (...) -- C:\Windows\System32\perfc009.dat   [106388]
O44 - LFC:[MD5.C52DD6FD99A9F9A3001E1F8555BD9F59] - 15/06/2011 - 12:48:30 ---A- . (...) -- C:\Windows\System32\perfc00C.dat   [130140]
O44 - LFC:[MD5.10D71BD4C0B0BF7C0DF65AFBFA39F8CE] - 15/06/2011 - 12:48:30 ---A- . (...) -- C:\Windows\System32\perfh009.dat   [616008]
O44 - LFC:[MD5.FDD32DE50532C629D94B14C5A9C7EDEF] - 15/06/2011 - 12:48:30 ---A- . (...) -- C:\Windows\System32\perfh00C.dat   [694430]
O44 - LFC:[MD5.AF3F60C3807DEA8BD2702E216CD6DC6A] - 15/06/2011 - 12:44:00 ---A- . (...) -- C:\Windows\setupact.log   [18840]
O44 - LFC:[MD5.21BD3C134939BAF1E5458BED69DD76F0] - 15/06/2011 - 12:43:56 -S-A- . (...) -- C:\Windows\bootstat.dat   [67584]
O44 - LFC:[MD5.41BAC50958DD7472152DDC96D99AAE0C] - 14/06/2011 - 11:49:03 ---A- . (...) -- C:\PhysicalDisk0_MBR.bin   [512]
O44 - LFC:[MD5.CB8AE0A9E927256868F494E380834451] - 12/06/2011 - 20:44:21 --HA- . (...) -- C:\Windows\System32\ezsidmv.dat   [56]
O44 - LFC:[MD5.4730F594A4ADB365B414C2416F6BB134] - 12/06/2011 - 18:22:42 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\Windows\System32\FlashPlayerCPLApp.cpl   [404640]
O44 - LFC:[MD5.EE021374B601BA01BD2835A19B86B8D2] - 12/06/2011 - 17:35:31 ---A- . (...) -- C:\Windows\PFRO.log   [308]
O44 - LFC:[MD5.4B1D0FDE9AA768E94742F2A514192335] - 06/06/2011 - 19:29:37 ---A- . (...) -- C:\Windows\IE9_main.log   [2265]
O44 - LFC:[MD5.07BA000B2E67565BDF112C35171865A5] - 06/06/2011 - 19:22:34 ---A- . (...) -- C:\Windows\System32\perfd00C.dat   [38160]
O44 - LFC:[MD5.04F6C9757DB75FF27C427E5B31DDB289] - 06/06/2011 - 19:22:34 ---A- . (...) -- C:\Windows\System32\perfi00C.dat   [344522]
O44 - LFC:[MD5.8C838DC3D32E243742317A39A61CED62] - 06/06/2011 - 18:39:06 ---A- . (...) -- C:\Windows\System32\FNTCACHE.DAT   [292080]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 06/06/2011 - 17:41:19 --HA- . (...) -- C:\Windows\System32\drivers\Msft_Kernel_WinUSB_01009.Wdf   [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 06/06/2011 - 17:41:19 --HA- . (...) -- C:\Windows\System32\drivers\Msft_User_tcwbf_01_09_00.Wdf   [0]
O44 - LFC:[MD5.27CADAE7E69FEEE773EA55108A8F9F47] - 06/06/2011 - 17:30:28 ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Windows\System32\deployJava1.dll   [472808]
O44 - LFC:[MD5.51A850830CB841FBE5B90142BCC6B854] - 06/06/2011 - 17:30:28 ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Windows\System32\java.exe   [145184]
O44 - LFC:[MD5.87893167C98FCEF5D14077511F219B75] - 06/06/2011 - 17:30:28 ---A- . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Windows\System32\javaw.exe   [145184]
O44 - LFC:[MD5.42278A946AB729CB746AA47D48F5FCC0] - 06/06/2011 - 17:30:28 ---A- . (.Sun Microsystems, Inc. - Java(TM) Web Start Launcher.) -- C:\Windows\System32\javaws.exe   [153376]
O44 - LFC:[MD5.0AF7946AD9B2E82058C6421EEC960FCF] - 06/06/2011 - 17:24:21 ---A- . (.Intel(R) Corporation - No comment.) -- C:\Windows\System32\ir32_32.dll   [197632]
O44 - LFC:[MD5.17A4BE67FB6B9219A802F39C263AC8AC] - 06/06/2011 - 17:24:21 ---A- . (.Radius Inc. - Codec Cinepak®.) -- C:\Windows\System32\iccvid.dll   [82944]
O44 - LFC:[MD5.D592AAA377748FC50E34D731F0D0D7B8] - 06/06/2011 - 17:23:49 ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\Windows\System32\atmlib.dll   [34304]
O44 - LFC:[MD5.7D643BB2B21B22621D76BE185AE9F7F8] - 06/06/2011 - 17:23:49 ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\Windows\System32\atmfd.dll   [294912]
O44 - LFC:[MD5.01C47C2ECED034EF6F8C1552A97CFF00] - 06/06/2011 - 17:20:17 ---A- . (...) -- C:\Windows\System32\config.nt   [2577]
O44 - LFC:[MD5.7F08D9C504B015D81A8ABD75C80028C5] - 06/06/2011 - 17:13:44 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\Windows\System32\drivers\aswFsBlk.sys   [19544]
O44 - LFC:[MD5.D6788E3211AFA9951ED7A4D617F68A4F] - 06/06/2011 - 17:13:41 ---A- . (.AVAST Software - avast! self protection module.) -- C:\Windows\System32\drivers\aswSP.sys   [307928]
O44 - LFC:[MD5.AC48BDD4CD5D44AF33087C06D6E9511C] - 06/06/2011 - 17:13:24 ---A- . (.AVAST Software - avast! TDI RDR Driver.) -- C:\Windows\System32\drivers\aswRdr.sys   [25432]
O44 - LFC:[MD5.4D100C45517809439C7B6DD98997FA00] - 06/06/2011 - 17:13:21 ---A- . (.AVAST Software - avast! TDI Filter Driver.) -- C:\Windows\System32\drivers\aswTdi.sys   [49240]
O44 - LFC:[MD5.B64134316FCD1F20E0F10EF3E65BD522] - 06/06/2011 - 17:13:19 ---A- . (.AVAST Software - avast! Virtualization Driver.) -- C:\Windows\System32\drivers\aswSnx.sys   [441176]
O44 - LFC:[MD5.9BDC8E9CE17B773F69D2C6696C768C4F] - 06/06/2011 - 17:13:00 ---A- . (.AVAST Software - avast! File System Minifilter for Windows 2.) -- C:\Windows\System32\drivers\aswMonFlt.sys   [53592]
O44 - LFC:[MD5.B8576757416F471C9D7F83B2B04B1F9D] - 06/06/2011 - 17:06:36 ---A- . (.AVAST Software - avast! Screen Saver stub.) -- C:\Windows\avastSS.scr   [40112]
O44 - LFC:[MD5.A4FF904203B176D2D7498AA7CECAFE0C] - 06/06/2011 - 17:06:35 ---A- . (.AVAST Software - avast! start-up scanner.) -- C:\Windows\System32\aswBoot.exe   [199304]
O44 - LFC:[MD5.E73694DCFE105A03479692A90E021AAD] - 06/06/2011 - 15:32:50 ---A- . (...) -- C:\Windows\System32\license.rtf   [42045]
O44 - LFC:[MD5.51370BDA636A3391207F190F4E2A3283] - 06/06/2011 - 15:31:58 ---A- . (...) -- C:\Windows\TSSysprep.log   [1313]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 06/06/2011 - 15:31:22 ---A- . (...) -- C:\Windows\ativpsrm.bin   [0]
O44 - LFC:[MD5.6497407F82E41274B9A34C035E16F3B1] - 06/06/2011 - 15:29:54 ---A- . (...) -- C:\Windows\DtcInstall.log   [1774]
O44 - LFC:[MD5.B309912717C29FC67E1BA4730A82B6DD] - 29/05/2011 - 08:11:30 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbamswissarmy.sys   [39984]
O44 - LFC:[MD5.3D2C13377763EEAC0CA6FB46F57217ED] - 29/05/2011 - 08:11:20 ---A- . (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Windows\System32\drivers\mbam.sys   [22712]



---\ Ultimi files creati sotto Windows Prefetcher (O45)
O45 - LFCP:[MD5.AE0AE8E62D674F95BC9F4D7813287668] - 06/06/2011 - 15:30:12 ---A- - C:\Windows\Prefetch\AgAppLaunch.db
O45 - LFCP:[MD5.BDAC677DB38951843FAEC10DCD8F8A6E] - 06/06/2011 - 15:31:52 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-9EFC97F2.pf
O45 - LFCP:[MD5.8FBEE36E24B44B22A2EC62C4ED3C2EB5] - 06/06/2011 - 15:32:09 ---A- - C:\Windows\Prefetch\SPPSVC.EXE-B0F8131B.pf
O45 - LFCP:[MD5.AAD56328DD3AF4D830389AFA868BA8E2] - 06/06/2011 - 15:32:44 ---A- - C:\Windows\Prefetch\NETSH.EXE-F1B6DA12.pf
O45 - LFCP:[MD5.695599FB68CA09C26F81FB4468EE1EB3] - 06/06/2011 - 15:32:46 ---A- - C:\Windows\Prefetch\CLRGC.EXE-A87AD925.pf
O45 - LFCP:[MD5.C16EAFA20812BB05A0C8A5496172B292] - 06/06/2011 - 16:36:33 ---A- - C:\Windows\Prefetch\NET.EXE-DF44F913.pf
O45 - LFCP:[MD5.A454B268322C11AA5BA029CBC6121AD9] - 06/06/2011 - 16:36:33 ---A- - C:\Windows\Prefetch\NET1.EXE-849DA590.pf
O45 - LFCP:[MD5.C922C650AD7F15568F10A1B8A279466D] - 06/06/2011 - 16:36:33 ---A- - C:\Windows\Prefetch\SC.EXE-945D79AE.pf
O45 - LFCP:[MD5.D74B67E9E4871105C0F139A245BEFC2C] - 06/06/2011 - 16:37:40 ---A- - C:\Windows\Prefetch\FINDSTR.EXE-2E9C6FE2.pf
O45 - LFCP:[MD5.C17657223017810F1BF66AA55B33ECCE] - 06/06/2011 - 16:37:43 ---A- - C:\Windows\Prefetch\BOOTINST.EXE-1C97BF89.pf
O45 - LFCP:[MD5.B285AA71067B714F308CF3493B62D221] - 06/06/2011 - 16:37:48 ---A- - C:\Windows\Prefetch\DISKPART.EXE-9046403A.pf
O45 - LFCP:[MD5.67EA4F610169EDE54C12E2A1A027939F] - 06/06/2011 - 16:37:48 ---A- - C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf
O45 - LFCP:[MD5.639E6330826DDB3FEE38A3E90F6051EC] - 06/06/2011 - 16:43:55 ---A- - C:\Windows\Prefetch\IE4UINIT.EXE-3A7E0C67.pf
O45 - LFCP:[MD5.386F2EED77570EDCB7BAFA499CBD7CB5] - 06/06/2011 - 16:46:58 ---A- - C:\Windows\Prefetch\FIREFOX%20SETUP%204.0.1[1].EX-D8F68F37.pf
O45 - LFCP:[MD5.259ED8868E66B043FE9AE4B4FFD00AAB] - 06/06/2011 - 16:47:37 ---A- - C:\Windows\Prefetch\SETUP.EXE-8D19AEFE.pf
O45 - LFCP:[MD5.6BD4E51C4E591D5883AC9CB337A8436E] - 06/06/2011 - 17:04:56 ---A- - C:\Windows\Prefetch\AVAST_FREE6_01NET.EXE-7BDC2CBD.pf
O45 - LFCP:[MD5.3BBABA688980FF4C6450DD6612A1BC9B] - 06/06/2011 - 17:05:09 ---A- - C:\Windows\Prefetch\AVAST.SETUP-8ECDE82B.pf
O45 - LFCP:[MD5.C84341064937939E42D6DE6019FEADBE] - 06/06/2011 - 17:06:54 ---A- - C:\Windows\Prefetch\VCREDIST_X86_SP1.EXE-08439203.pf
O45 - LFCP:[MD5.3542691931B60F48FCD193290EE5462B] - 06/06/2011 - 17:06:57 ---A- - C:\Windows\Prefetch\INSTALL.EXE-03D4B465.pf
O45 - LFCP:[MD5.325034C2E9F76470C49E9753DBEEE6AA] - 06/06/2011 - 17:09:04 ---A- - C:\Windows\Prefetch\RUNDLL32.EXE-E02536F7.pf
O45 - LFCP:[MD5.AEFA6F6C52E0D7884D2FF3B70D8DF4BA] - 06/06/2011 - 17:10:57 ---A- - C:\Windows\Prefetch\TASKMGR.EXE-5F5F473D.pf
O45 - LFCP:[MD5.47F5228EDE2BDBF6C2165159421318AE] - 06/06/2011 - 17:13:56 ---A- - C:\Windows\Prefetch\AVASTSVC.EXE-AEB722C6.pf
O45 - LFCP:[MD5.80CC915441F2D7B7AEBE411C578C11EC] - 06/06/2011 - 17:14:26 ---A- - C:\Windows\Prefetch\ASHQUICK.EXE-AA982584.pf
O45 - LFCP:[MD5.2269730E6BFD8DF39F4BFD9E009BEADB] - 06/06/2011 - 17:15:43 ---A- - C:\Windows\Prefetch\VCREDIST_X86.EXE-93F3B0FE.pf
O45 - LFCP:[MD5.D32B9DFBCD3CED09E08A38586C54C288] - 06/06/2011 - 17:15:44 ---A- - C:\Windows\Prefetch\INSTALL.EXE-2D324AE2.pf
O45 - LFCP:[MD5.2FF800100C5996DED7EF98201870D60D] - 06/06/2011 - 17:15:56 ---A- - C:\Windows\Prefetch\SETUP.EXE-498A4033.pf
O45 - LFCP:[MD5.E24535639AB2DD8EA7A85DAA623870CF] - 06/06/2011 - 17:19:47 ---A- - C:\Windows\Prefetch\SETUP.OVR-56BCD126.pf
O45 - LFCP:[MD5.1C0C04EF8A76126AF70DACA32B9890E3] - 06/06/2011 - 17:21:55 ---A- - C:\Windows\Prefetch\ASWREGSVR.EXE-AD27A91B.pf
O45 - LFCP:[MD5.D7E63425E0025758D5FFB703CDB0861F] - 06/06/2011 - 17:24:49 ---A- - C:\Windows\Prefetch\OOO_3.3.0_WIN_X86_INSTALL-WJR-1A2E44E6.pf
O45 - LFCP:[MD5.588C8A847AAE9D6EB7845C77F0169B97] - 06/06/2011 - 17:25:21 ---A- - C:\Windows\Prefetch\SETUP.EXE-507A085B.pf
O45 - LFCP:[MD5.C50A27142372D0CBFECA0450D93470E4] - 06/06/2011 - 17:25:22 ---A- - C:\Windows\Prefetch\VCREDIST_X86.EXE-4A3607A6.pf
O45 - LFCP:[MD5.212F9039E5CB0DA8818E902099867F6F] - 06/06/2011 - 17:25:24 ---A- - C:\Windows\Prefetch\INSTALL.EXE-411B3091.pf
O45 - LFCP:[MD5.28002C7159EC605ECF88C8316C65FD3F] - 06/06/2011 - 17:26:49 ---A- - C:\Windows\Prefetch\JRE-WINDOWS-I586.EXE-0916EA9E.pf
O45 - LFCP:[MD5.388C2B5B96C609DDBE1B0F4F2283072B] - 06/06/2011 - 17:27:25 ---A- - C:\Windows\Prefetch\MPAS-FE.EXE-6BCBD37D.pf
O45 - LFCP:[MD5.01D7AE248673377D0ECFBAF9A19D5832] - 06/06/2011 - 17:27:25 ---A- - C:\Windows\Prefetch\MPSIGSTUB.EXE-C9D7ADC8.pf
O45 - LFCP:[MD5.00C54531E9922E14D5E0A3DEA0908794] - 06/06/2011 - 17:30:41 ---A- - C:\Windows\Prefetch\ZIPPER.EXE-45D9BE29.pf
O45 - LFCP:[MD5.E09B8216857B6F90A0C632A9A34F4CDC] - 06/06/2011 - 17:31:03 ---A- - C:\Windows\Prefetch\UNPACK200.EXE-FB3B322C.pf
O45 - LFCP:[MD5.7052E01CDCE7391D2DF041185A2E8E0D] - 06/06/2011 - 17:32:00 ---A- - C:\Windows\Prefetch\JAUREG.EXE-171665BB.pf
O45 - LFCP:[MD5.050466FA9E1B42CB930D8C3A372CAA2A] - 06/06/2011 - 17:35:15 ---A- - C:\Windows\Prefetch\RSTRUI.EXE-2D50C58D.pf
O45 - LFCP:[MD5.7C492EC54E35856775E639151FA9B529] - 06/06/2011 - 17:35:16 ---A- - C:\Windows\Prefetch\WBENGINE.EXE-28FD7E8B.pf
O45 - LFCP:[MD5.A0DF615BABE3EC085C6C31661F4E7F96] - 06/06/2011 - 17:35:23 ---A- - C:\Windows\Prefetch\VDSLDR.EXE-6B089E8B.pf
O45 - LFCP:[MD5.116B554827DD4CCB4541D118C377C0A2] - 06/06/2011 - 17:35:24 ---A- - C:\Windows\Prefetch\VDS.EXE-6E7946F9.pf
O45 - LFCP:[MD5.47BD9B35AC2847A84FA4F76AFAE099C2] - 06/06/2011 - 17:39:45 ---A- - C:\Windows\Prefetch\UNOPKG.EXE-B11D2061.pf
O45 - LFCP:[MD5.441FD228A2BD8E76B5DB6B74F0FE1FBB] - 06/06/2011 - 17:39:48 ---A- - C:\Windows\Prefetch\UNOPKG.BIN-A4AB393C.pf
O45 - LFCP:[MD5.D6F93BD8CBA1E1092312984FF042450C] - 06/06/2011 - 17:41:26 ---A- - C:\Windows\Prefetch\WUDFHOST.EXE-AFFEF87C.pf
O45 - LFCP:[MD5.EC5B94311911F994F96ECFF8B763754E] - 06/06/2011 - 17:46:12 ---A- - C:\Windows\Prefetch\MPSYSCHK.EXE-933ADA9A.pf
O45 - LFCP:[MD5.64E41BD77D58B94BDE18C91059958532] - 06/06/2011 - 17:49:43 ---A- - C:\Windows\Prefetch\JAVA.EXE-264CA9D2.pf
O45 - LFCP:[MD5.79866B2D198C33944974391EDA31C5E9] - 06/06/2011 - 17:49:47 ---A- - C:\Windows\Prefetch\WMIC.EXE-A7D06383.pf
O45 - LFCP:[MD5.35BD4EA04C585E0F5B00959342F302C4] - 06/06/2011 - 17:54:18 ---A- - C:\Windows\Prefetch\STIKYNOT.EXE-AD181651.pf
O45 - LFCP:[MD5.CFCDF2EEC4F96430A62BE9E9CE79F462] - 06/06/2011 - 17:54:40 ---A- - C:\Windows\Prefetch\WFS.EXE-BA5DB8A8.pf
O45 - LFCP:[MD5.64FFE65EB3F4B304D5C2340BFEF25A51] - 06/06/2011 - 17:54:46 ---A- - C:\Windows\Prefetch\FXSSVC.EXE-A5D83991.pf
O45 - LFCP:[MD5.A9D88A85E102AF1D5CE3640DDF3B9A7D] - 06/06/2011 - 17:54:58 ---A- - C:\Windows\Prefetch\MRT.EXE-851529F7.pf
O45 - LFCP:[MD5.7C89BF58715F47352F2618A1D336BBE7] - 06/06/2011 - 17:55:00 ---A- - C:\Windows\Prefetch\WINDOWS-KB890830-V3.19.EXE-1C83B633.pf
O45 - LFCP:[MD5.F3DE4859B824FCAD2BF09800FC90B13C] - 06/06/2011 - 17:55:02 ---A- - C:\Windows\Prefetch\MRTSTUB.EXE-824C0FD8.pf
O45 - LFCP:[MD5.B6A48C6BC4BCF4119F75BFAB4B9771E7] - 06/06/2011 - 18:21:44 ---A- - C:\Windows\Prefetch\WINSAT.EXE-DE36CB46.pf
O45 - LFCP:[MD5.D7F2AB0B29B3D0DC2D33A294F8520F4C] - 06/06/2011 - 18:24:43 ---A- - C:\Windows\Prefetch\RUNDLL32.EXE-411A328D.pf
O45 - LFCP:[MD5.4096C54768991E6E577BB79BF0640646] - 06/06/2011 - 18:24:45 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
O45 - LFCP:[MD5.EBFA033B198E791F1D76509BB503C40E] - 06/06/2011 - 18:26:45 ---A- - C:\Windows\Prefetch\POWERCFG.EXE-668FA411.pf
O45 - LFCP:[MD5.40496E16F482F9FEDB928455CC7CB2CE] - 06/06/2011 - 18:31:41 ---A- - C:\Windows\Prefetch\CSC.EXE-A3B8D95D.pf
O45 - LFCP:[MD5.2B524EA9BBD05CCA8A578EB5E976CED8] - 06/06/2011 - 18:31:41 ---A- - C:\Windows\Prefetch\CVTRES.EXE-069169FB.pf
O45 - LFCP:[MD5.21EDC4A046941F7F02DC0608C7CB91D6] - 06/06/2011 - 18:31:44 ---A- - C:\Windows\Prefetch\RUNDLL32.EXE-230FC512.pf
O45 - LFCP:[MD5.9651082B69920C1225B0190751EA8B5B] - 06/06/2011 - 18:31:44 ---A- - C:\Windows\Prefetch\W32TM.EXE-1101AF41.pf
O45 - LFCP:[MD5.0095923BB1B8CD6F8B6A0728E0BF29CD] - 06/06/2011 - 18:31:45 ---A- - C:\Windows\Prefetch\SDIAGNHOST.EXE-8D72177C.pf
O45 - LFCP:[MD5.7621B2F16895115E7B6C8D8B250F770D] - 06/06/2011 - 18:31:53 ---A- - C:\Windows\Prefetch\PING.EXE-7E94E73E.pf
O45 - LFCP:[MD5.63B57B8BA70F81AFA886FA39D10ADAFF] - 06/06/2011 - 18:37:35 ---A- - C:\Windows\Prefetch\POQEXEC.EXE-69592829.pf
O45 - LFCP:[MD5.CC1C67D879A07ABCFE1D69B8C15ADA89] - 06/06/2011 - 18:40:16 ---A- - C:\Windows\Prefetch\SPOOLSV.EXE-D1F6B8B6.pf
O45 - LFCP:[MD5.3C378C88BA926E504C436C45339A9EB6] - 06/06/2011 - 18:40:16 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-FEDB32D0.pf
O45 - LFCP:[MD5.D60BF4D074F449902EE2B01E5266EBCB] - 06/06/2011 - 18:40:16 ---A- - C:\Windows\Prefetch\TZUPD.EXE-2128F25C.pf
O45 - LFCP:[MD5.B89227F820763FE935BDC3D5320A3C8D] - 06/06/2011 - 18:40:16 ---A- - C:\Windows\Prefetch\WFS.EXE-147AA976.pf
O45 - LFCP:[MD5.1C86FBB7DEF682A417D1A1D1CF23E6A8] - 06/06/2011 - 18:45:20 ---A- - C:\Windows\Prefetch\RUNDLL32.EXE-1B239DE1.pf
O45 - LFCP:[MD5.D3055071A40738E858E2C62728DA321B] - 06/06/2011 - 18:45:27 ---A- - C:\Windows\Prefetch\HELPPANE.EXE-FEDC965B.pf
O45 - LFCP:[MD5.8906D1F864AEAECA1D14FEFAE55ABF8F] - 06/06/2011 - 18:50:25 ---A- - C:\Windows\Prefetch\UNINSTALLER.EXE-FB9CC9A0.pf
O45 - LFCP:[MD5.E370D39B61DE471B52EE24C93794333C] - 06/06/2011 - 18:50:33 ---A- - C:\Windows\Prefetch\AU_.EXE-6421903A.pf
O45 - LFCP:[MD5.E241AAAD99C96CC32EE8C2C27B122E5B] - 06/06/2011 - 18:50:34 ---A- - C:\Windows\Prefetch\DLLHOST.EXE-7FAA2E4C.pf
O45 - LFCP:[MD5.7C77123083D8957A395ED2FC272B234F] - 06/06/2011 - 18:50:41 ---A- - C:\Windows\Prefetch\VERCLSID.EXE-7C52E31C.pf
O45 - LFCP:[MD5.EC4B8C25457741B25099201AD8A21D0F] - 06/06/2011 - 18:52:48 ---A- - C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
O45 - LFCP:[MD5.42D012FF128AD1D9011C168152EA1DDC] - 06/06/2011 - 19:06:37 ---A- - C:\Windows\Prefetch\WUAPP.EXE-C6167071.pf
O45 - LFCP:[MD5.3482ECAE914FAB94725905EA39128C78] - 06/06/2011 - 19:07:07 ---A- - C:\Windows\Prefetch\DLLHOST.EXE-74857ABA.pf
O45 - LFCP:[MD5.62B3CFC5DC51FB6C8C07D404BB18355B] - 06/06/2011 - 19:07:24 ---A- - C:\Windows\Prefetch\FIREFOX%20SETUP%204.0.1[1].EX-167125DC.pf
O45 - LFCP:[MD5.A167073AD3D3FEFBB238939DFAB91173] - 06/06/2011 - 19:07:29 ---A- - C:\Windows\Prefetch\SETUP.EXE-F4C0229F.pf
O45 - LFCP:[MD5.E683B932C0AE8D8065ADE8E3284383FF] - 06/06/2011 - 19:07:50 ---A- - C:\Windows\Prefetch\HELPER.EXE-8AEDE3E3.pf
O45 - LFCP:[MD5.1EF8ED136F9F2292CB145A483667D0C4] - 06/06/2011 - 19:24:34 ---A- - C:\Windows\Prefetch\LPKSETUP.EXE-90F505D8.pf
O45 - LFCP:[MD5.76D064F91C5C682D3EFB0A86142FDA6C] - 06/06/2011 - 19:30:32 ---A- - C:\Windows\Prefetch\RUNDLL32.EXE-9E25227B.pf
O45 - LFCP:[MD5.143A69EB28D6C11A845966B567B07888] - 12/06/2011 - 16:13:03 ---A- - C:\Windows\Prefetch\DLLHOST.EXE-010CA916.pf
O45 - LFCP:[MD5.25A3FC75A8DC85500C2218727E2C66E1] - 12/06/2011 - 16:28:36 ---A- - C:\Windows\Prefetch\SETUP_WM.EXE-674F654A.pf
O45 - LFCP:[MD5.B0793AC9CB4F6707BF6FD066277FB543] - 12/06/2011 - 16:28:58 ---A- - C:\Windows\Prefetch\WMPLAYER.EXE-BAD6BD53.pf
O45 - LFCP:[MD5.75EE627E7ECA51CEE75AFB8A940C8D39] - 12/06/2011 - 16:30:52 ---A- - C:\Windows\Prefetch\ATTRIB.EXE-A990CB86.pf
O45 - LFCP:[MD5.1EB98D3882A894BBD1CD93D2EB09B4A5] - 12/06/2011 - 16:45:57 ---A- - C:\Windows\Prefetch\DEVICEDISPLAYOBJECTPROVIDER.E-17410B90.pf
O45 - LFCP:[MD5.0919E4DEC9E0E97C7A1C223426FAA195] - 12/06/2011 - 17:13:32 ---A- - C:\Windows\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pf
O45 - LFCP:[MD5.454AF8707EBB230898814E89DB03572E] - 12/06/2011 - 17:37:19 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-007FEA55.pf
O45 - LFCP:[MD5.B18EA6112B02F09268C056111DEFDB7E] - 12/06/2011 - 18:43:35 ---A- - C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
O45 - LFCP:[MD5.BF4C81962D769E412CDBA68AE96A8D5C] - 12/06/2011 - 19:02:27 ---A- - C:\Windows\Prefetch\JAVA.EXE-E27B75C2.pf
O45 - LFCP:[MD5.682847B32DED39284C31C157FA332C05] - 12/06/2011 - 19:06:33 ---A- - C:\Windows\Prefetch\AVASTUI.EXE-56B29A08.pf
O45 - LFCP:[MD5.F0E8BD610FCEBE6C7D810A44E136CE80] - 12/06/2011 - 20:05:39 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
O45 - LFCP:[MD5.017C5E158F26BBF274C24F2D6441F755] - 12/06/2011 - 20:05:57 ---A- - C:\Windows\Prefetch\CONSENT.EXE-531BD9EA.pf
O45 - LFCP:[MD5.68777FC3673FCE9B007E9BA4E11A0070] - 12/06/2011 - 20:23:34 ---A- - C:\Windows\Prefetch\MPCMDRUN.EXE-F401FBB4.pf
O45 - LFCP:[MD5.EE607CDF77191AB1BB73F342A1866E32] - 12/06/2011 - 21:20:23 ---A- - C:\Windows\Prefetch\JAUCHECK.EXE-7E60136B.pf
O45 - LFCP:[MD5.E93E52F974FB127F8F9E63A4206B207F] - 12/06/2011 - 21:20:28 ---A- - C:\Windows\Prefetch\JAVAW.EXE-91B81925.pf
O45 - LFCP:[MD5.AAD1012410D9D3DC8C84732F8F3072E8] - 12/06/2011 - 21:20:28 ---A- - C:\Windows\Prefetch\JAVAWS.EXE-5FA6EB7C.pf
O45 - LFCP:[MD5.DDBD7EC4C1CDFA40D109D0AB65F84C27] - 12/06/2011 - 21:51:27 ---A- - C:\Windows\Prefetch\SOFFICE.BIN-FFFF76B3.pf
O45 - LFCP:[MD5.4D746C144DA239E1DB6C56891506ECC3] - 12/06/2011 - 21:51:27 ---A- - C:\Windows\Prefetch\SOFFICE.EXE-0C715DD8.pf
O45 - LFCP:[MD5.12B6DBEF58EF7095B72031D92D851C81] - 13/06/2011 - 13:20:17 ---A- - C:\Windows\Prefetch\SDCLT.EXE-E10B972A.pf
O45 - LFCP:[MD5.BCBB58D83F67C2C4EF90391328BCA572] - 13/06/2011 - 13:32:44 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-61AE5AB6.pf
O45 - LFCP:[MD5.5A9C7CA0DB189618769D30CD94235B6D] - 13/06/2011 - 13:38:38 ---A- - C:\Windows\Prefetch\DLLHOST.EXE-766398D2.pf
O45 - LFCP:[MD5.A12259D5E5CECEACDDD278E0164BB57D] - 14/06/2011 - 10:36:42 ---A- - C:\Windows\Prefetch\VSSVC.EXE-B8AFC319.pf
O45 - LFCP:[MD5.37EB4E97F9D5DBED5FC39D1D30ECCFC1] - 14/06/2011 - 10:36:43 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf
O45 - LFCP:[MD5.CE84DDD2BC22817274AB8579EE6AF705] - 14/06/2011 - 10:37:22 ---A- - C:\Windows\Prefetch\DRVINST.EXE-4CB4314A.pf
O45 - LFCP:[MD5.99164B9AAB3FBC4B3A6D09F39D031F8B] - 14/06/2011 - 10:39:07 ---A- - C:\Windows\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
O45 - LFCP:[MD5.D4BA91286F5AC70B78FC76DA8A9234D2] - 14/06/2011 - 16:30:38 ---A- - C:\Windows\Prefetch\AgCx_SC2.db
O45 - LFCP:[MD5.8C1A9397A5F38C5982089CA3C721B5EB] - 14/06/2011 - 22:50:30 ---A- - C:\Windows\Prefetch\MAKECAB.EXE-0F1704A4.pf
O45 - LFCP:[MD5.8894D3FECA84FFD2331443482DC01874] - 14/06/2011 - 23:44:23 ---A- - C:\Windows\Prefetch\NTOSBOOT-B00DFAAD.pf
O45 - LFCP:[MD5.C39FC15299F345512C3950DAABE917AC] - 15/06/2011 - 11:31:50 ---A- - C:\Windows\Prefetch\SVCHOST.EXE-05F624AB.pf
O45 - LFCP:[MD5.EF69758659D779590BDA5872013AA72A] - 15/06/2011 - 11:50:25 ---A- - C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf
O45 - LFCP:[MD5.56926F7560A02B1D8C799B9738ABC9DB] - 15/06/2011 - 11:50:30 ---A- - C:\Windows\Prefetch\AgCx_SC1.db.trx
O45 - LFCP:[MD5.974D67625FECD55EC67951A09DA3138C] - 15/06/2011 - 11:51:30 ---A- - C:\Windows\Prefetch\AgCx_SC1.db
O45 - LFCP:[MD5.19CA22F838F26DAEA0FFD73C6F2B7B14] - 15/06/2011 - 11:55:07 ---A- - C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-2135916146-3893334040-3250946710-1000.db
O45 - LFCP:[MD5.126BB90E3295BC81E42D70A3A5959478] - 15/06/2011 - 11:55:07 ---A- - C:\Windows\Prefetch\AgGlUAD_S-1-5-21-2135916146-3893334040-3250946710-1000.db
O45 - LFCP:[MD5.5F11044A54D577E608C23F42B5BBE1CC] - 15/06/2011 - 11:55:09 ---A- - C:\Windows\Prefetch\WMPNETWK.EXE-D9F2A96F.pf
O45 - LFCP:[MD5.40F4A2E52357D2DB1146480EF8788DCE] - 15/06/2011 - 11:55:47 ---A- - C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
O45 - LFCP:[MD5.36543632D0705C2AD8DB026FFFD7C012] - 15/06/2011 - 12:43:09 ---A- - C:\Windows\Prefetch\PfSvPerfStats.bin
O45 - LFCP:[MD5.013CDE657040D8C874B945250CD972BE] - 15/06/2011 - 12:46:03 ---A- - C:\Windows\Prefetch\AVAST.SETUP-B1D66586.pf
O45 - LFCP:[MD5.2A46F7087F3A58BF754A288BE0AD327D] - 15/06/2011 - 12:47:45 ---A- - C:\Windows\Prefetch\WUAUCLT.EXE-70318591.pf
O45 - LFCP:[MD5.803862CE6C44691010F75CC68AC336D3] - 15/06/2011 - 12:48:26 ---A- - C:\Windows\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
O45 - LFCP:[MD5.CF5F70CEDAFD185C7FD207AB12FE2BF4] - 15/06/2011 - 12:57:16 ---A- - C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf
O45 - LFCP:[MD5.BFAB68BEBF6F5E3247D957CC971F42F7] - 15/06/2011 - 13:45:38 ---A- - C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf
O45 - LFCP:[MD5.E907E0C22095304FF96390ED9CA7287A] - 15/06/2011 - 13:47:44 ---A- - C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
O45 - LFCP:[MD5.46D78D90A53D7FA2BE93E2333E440B31] - 15/06/2011 - 13:48:43 ---A- - C:\Windows\Prefetch\WMPNSCFG.EXE-FC0D39BF.pf
O45 - LFCP:[MD5.7B866BF643D1AB5B002C811947F2D515] - 15/06/2011 - 13:52:40 ---A- - C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf
O45 - LFCP:[MD5.ED1C5AA92A894B5629BB58ED9C785BA1] - 15/06/2011 - 14:31:19 ---A- - C:\Windows\Prefetch\FIREFOX.EXE-A606B53C.pf
O45 - LFCP:[MD5.3DE74127D54640A7781744F2C13F0ED2] - 15/06/2011 - 14:50:41 ---A- - C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
O45 - LFCP:[MD5.5FCB5AD7841169A35695CF4498F30C95] - 15/06/2011 - 15:02:36 ---A- - C:\Windows\Prefetch\TASKHOST.EXE-7238F31D.pf
O45 - LFCP:[MD5.05651023F8CE7B61015197853323DF09] - 15/06/2011 - 15:10:12 ---A- - C:\Windows\Prefetch\AgGlGlobalHistory.db
O45 - LFCP:[MD5.39C6DEC46E16DE818419BA24EF93962E] - 15/06/2011 - 15:10:12 ---A- - C:\Windows\Prefetch\AgRobust.db
O45 - LFCP:[MD5.33AEB005204E0455CC0169F5A2945A15] - 15/06/2011 - 15:10:13 ---A- - C:\Windows\Prefetch\AgGlFaultHistory.db
O45 - LFCP:[MD5.3127CDABA33215F2BC6B58DA1AEBF7EA] - 15/06/2011 - 15:10:13 ---A- - C:\Windows\Prefetch\AgGlFgAppHistory.db
O45 - LFCP:[MD5.DE3E04F4C477D5C44FEE06A771116EC8] - 15/06/2011 - 15:24:29 ---A- - C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf
O45 - LFCP:[MD5.B5F81AFD6E2FD8708BABFAEC8E81C9EA] - 15/06/2011 - 15:24:29 ---A- - C:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf
O45 - LFCP:[MD5.FC71A43DC57D94119384CCF4B3FA32D7] - 15/06/2011 - 15:25:38 ---A- - C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf
O45 - LFCP:[MD5.A54DACEB0ABCCDC2C9DC8A6BE3A55CAD] - 15/06/2011 - 15:26:01 ---A- - C:\Windows\Prefetch\CMD.EXE-4A81B364.pf
O45 - LFCP:[MD5.664B2E7D7EFD0B3988D5F173B2B519C3] - 15/06/2011 - 15:26:01 ---A- - C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf



---\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Codec Cinepak®.) -- C:\Windows\System32\iccvid.dll
O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm
O52 - TDSD: \drivers.desc\"wdmaud.drv"="Microsoft 1.1 UAA Function Driver for High Definition Audio" . (.Unknown owner - No comment.) -- (.not file.)



---\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\system32\credssp.dll



---\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3
O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1
O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "lega

g3n-h@ckm@n · Answer

Bah c'est une fenetre windows qui s'ouvraient, et quand je voulais effacer, il voulais que j'achete la version payante de lanti virus windows , donc quel interet de faire ça? désolée si j'insiste je veux juste comprendre ça m'interesse 

oui mais c'est pas microsoft qui la produit :)

================================

ca n'a rien avoir avec microsoft je te repete

cycy_ · Answer

ok mais c'est quoi l'interet de ces mecs de faire ça?

Et c dangereux comme virus?

Est til toujours sur mon système?

Désolée je veux juste être sure !

g3n-h@ckm@n · Answer

tu n'as donc pas bien lu la page que je t'ai indiquée

cycy_ · Answer

si mais j'ai pas compris ce que tu voulais que je comprenne apparement.
eclaire moi

Virus présent malgré formatage complet

64 réponses

Votre réponse

Discussions similaires

Newsletters