Mon ordinateur rame et a un rootkit

Re,
1/
* Télécharge OTM (OldTimer) sur ton Bureau

ICI >> OTM (OldTimer)
* Double clic "OTMoveIt3.exe"
* Utilisateurs Windows Vista / 7 Clic droit sur "OTMoveIt3.exe" choisis "exécuter en tant qu'administrateur" afin de le lancer.

- Copie (Ctrl+C) le texte suivant en gras ci-dessous :

:files
c:\users\Flavien\AppData\Roaming\ml1isssd.exe

:Reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ml1isssd.exe]


- Colle (Ctrl+V) le texte précédemment copié dans le cadre: Paste Instructions for Items to be Moved.
- Clique maintenant sur le bouton MoveIt!
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.
- Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

2/
* Télécharge sur le bureau RogueKiller (par tigzy)
https://www.luanagames.com/index.fr.html
* ( Sous Vista/Seven,clique droit, lancer en tant qu'administrateur )
* Quitte tous tes programmes en cours
* Lance RogueKiller.exe
Si l'infection bloque le programme, il faut le relancer plusieurs fois ou le renommer en winlogon.exe
* Laisse le prescan se terminer, clique sur Scan
* Clique sur Rapport pour l'ouvrir puis copie/colle le sur le dans ton prochain message

@+

Salut,
1/
Est ce que tu peux nous donner le nom du Rootkit et son chemin ?

2/
Télécharge TDSSKiller sur ton Bureau.

# Décompresse le (clic droit sur le fichier et extraire) sur le bureau.
# dans le dossier crée, déplacer le fichier TDSSKiller.exe pour le mettre sur le Bureau
# Faire un double clic sur TDSSKiller.exe pour le lancer.
# Cliquer sur Start scan pour lancer l'analyse,

# Lorsque l'outil a terminé son travail d'inspection, si des nuisibles ("Malicious objects") ont été trouvés, vérifier que l'option Cure est sélectionnée,
# Si des objects suspects "Suspicious objects" ont été détectés, sur l'écran de demande de confirmation, laisser l'option sur Skip.
# Puis cliquer sur le bouton Continue.
# Attendre l'affichage du fichier rapport.
# Si l'outil a besoin d'un redémarrage pour finaliser le nettoyage, cliquer sur le bouton Reboot computer.

Envoyer en réponse le rapport de TDSSKiller

Note : Il se trouve aussi en C:\TDSSKiller.Version_Date_Heure_log.txt

@+

Le rapport est trop long il ne peut pas être posté.

Je ne me rappelle plus le chemin du rootkit. Ce message était apparu juste après la désinstallation de mon deuxième antivirus (Avira). J'avais lu qu'il valait mieux en avoir qu'un. Juste après la désinstallation une alerte rootkit était apparue.

Re,

1/
Il manque le rapport TDSSKiller comme expliqué : ici en 2/

2/ Ensuite
* Télécharge puis enregistre sur le bureau de ton PC ZHPDiag
(de Nicolas Coolman) à partir l'un des deux liens : Lien 1 ou Lien 2
* Lance-le, (Clic droit "exécuter en tant qu'administrateur" si tu es sous Vista/7)
* Clique sur l'icône en forme de loupe pour lancer le diagnostique
* Héberge le rapport ZHPDiag.txt de ton bureau sur : malekal.com ou cjoint.com
* Fais copier/coller le lien fourni dans ta prochaine réponse
* Aide ZHPDiag : <<< ICI >>>

@+

_ _ _ Fish66_ _ _ I''"""""I_ _ membre contributeur sécurité_ _I''"""""I_ _ _
¤¤¤ Le meilleur remède pour tous les problèmes, c'est la patience.... ¤¤¤

22:22:57.0485 5528 TDSS rootkit removing tool 2.7.37.0 May 23 2012 08:15:30
22:22:57.0824 5528 ============================================================
22:22:57.0825 5528 Current date / time: 2012/05/25 22:22:57.0824
22:22:57.0825 5528 SystemInfo:
22:22:57.0825 5528
22:22:57.0825 5528 OS Version: 6.0.6002 ServicePack: 2.0
22:22:57.0825 5528 Product type: Workstation
22:22:57.0826 5528 ComputerName: PC-DE-HP
22:22:57.0826 5528 UserName: Flavien
22:22:57.0826 5528 Windows directory: C:\Windows
22:22:57.0826 5528 System windows directory: C:\Windows
22:22:57.0826 5528 Processor architecture: Intel x86
22:22:57.0827 5528 Number of processors: 2
22:22:57.0827 5528 Page size: 0x1000
22:22:57.0827 5528 Boot type: Normal boot
22:22:57.0827 5528 ============================================================
22:22:58.0659 5528 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:22:58.0667 5528 ============================================================
22:22:58.0667 5528 \Device\Harddisk0\DR0:
22:22:58.0667 5528 MBR partitions:
22:22:58.0667 5528 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1BD207C1
22:22:58.0667 5528 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1BD20800, BlocksNum 0x14A3800
22:22:58.0668 5528 ============================================================
22:22:58.0679 5528 C: <-> \Device\Harddisk0\DR0\Partition0
22:22:58.0721 5528 D: <-> \Device\Harddisk0\DR0\Partition1
22:22:58.0721 5528 ============================================================
22:22:58.0721 5528 Initialize success
22:22:58.0721 5528 ============================================================
22:23:30.0626 4344 ============================================================
22:23:30.0627 4344 Scan started
22:23:30.0627 4344 Mode: Manual;
22:23:30.0627 4344 ============================================================
22:23:31.0053 4344 Accelerometer (3b10711ad8656c097e0d16a41b29c54c) C:\Windows\system32\DRIVERS\Accelerometer.sys
22:23:31.0056 4344 Accelerometer - ok
22:23:31.0113 4344 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
22:23:31.0119 4344 ACPI - ok
22:23:31.0207 4344 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
22:23:31.0215 4344 adp94xx - ok
22:23:31.0286 4344 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
22:23:31.0292 4344 adpahci - ok
22:23:31.0344 4344 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
22:23:31.0347 4344 adpu160m - ok
22:23:31.0377 4344 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
22:23:31.0382 4344 adpu320 - ok
22:23:31.0419 4344 AeLookupSvc (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
22:23:31.0423 4344 AeLookupSvc - ok
22:23:31.0527 4344 AESTFilters (3b1b2ee9df189f6bbb080bf393d1b2ee) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_84a4a6b7\aestsrv.exe
22:23:31.0529 4344 AESTFilters - ok
22:23:31.0615 4344 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
22:23:31.0621 4344 AFD - ok
22:23:31.0651 4344 AgereModemAudio (8ed60797908fd394eee0d6949f493224) C:\Windows\system32\agrsmsvc.exe
22:23:31.0653 4344 AgereModemAudio - ok
22:23:31.0821 4344 AgereSoftModem (3712986cc3abf0dc656b43525b9d1279) C:\Windows\system32\DRIVERS\AGRSM.sys
22:23:31.0840 4344 AgereSoftModem - ok
22:23:31.0902 4344 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
22:23:31.0904 4344 agp440 - ok
22:23:31.0933 4344 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
22:23:31.0937 4344 aic78xx - ok
22:23:31.0965 4344 ALG (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
22:23:31.0969 4344 ALG - ok
22:23:31.0986 4344 aliide (3d76fda1a10acc3dc84728f55c29b6d4) C:\Windows\system32\drivers\aliide.sys
22:23:31.0988 4344 aliide - ok
22:23:32.0010 4344 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
22:23:32.0013 4344 amdagp - ok
22:23:32.0023 4344 amdide (5b92e7839f5a1fbc1b39de67758ad6f8) C:\Windows\system32\drivers\amdide.sys
22:23:32.0025 4344 amdide - ok
22:23:32.0047 4344 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
22:23:32.0049 4344 AmdK7 - ok
22:23:32.0080 4344 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
22:23:32.0082 4344 AmdK8 - ok
22:23:32.0122 4344 ApfiltrService (4271f82a1efa933e2d4355e3825003f6) C:\Windows\system32\DRIVERS\Apfiltr.sys
22:23:32.0126 4344 ApfiltrService - ok
22:23:32.0150 4344 Appinfo (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
22:23:32.0153 4344 Appinfo - ok
22:23:32.0273 4344 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
22:23:32.0276 4344 Apple Mobile Device - ok
22:23:32.0333 4344 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
22:23:32.0336 4344 arc - ok
22:23:32.0358 4344 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
22:23:32.0360 4344 arcsas - ok
22:23:32.0402 4344 aswFsBlk (0ae43c6c411254049279c2ee55630f95) C:\Windows\system32\drivers\aswFsBlk.sys
22:23:32.0404 4344 aswFsBlk - ok
22:23:32.0461 4344 aswMonFlt (6693141560b1615d8dccf0d8eb00087e) C:\Windows\system32\drivers\aswMonFlt.sys
22:23:32.0463 4344 aswMonFlt - ok
22:23:32.0498 4344 AswRdr (da12626fd9a67f4e917e2f2fbe1e1764) C:\Windows\system32\drivers\AswRdr.sys
22:23:32.0500 4344 AswRdr - ok
22:23:32.0590 4344 aswSnx (dcb199b967375753b5019ec15f008f53) C:\Windows\system32\drivers\aswSnx.sys
22:23:32.0601 4344 aswSnx - ok
22:23:32.0675 4344 aswSP (b32873e5a1443c0a1e322266e203bf10) C:\Windows\system32\drivers\aswSP.sys
22:23:32.0681 4344 aswSP - ok
22:23:32.0702 4344 aswTdi (6ff544175a9180c5d88534d3d9c9a9f7) C:\Windows\system32\drivers\aswTdi.sys
22:23:32.0704 4344 aswTdi - ok
22:23:32.0739 4344 aswUpdSv - ok
22:23:32.0779 4344 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
22:23:32.0783 4344 AsyncMac - ok
22:23:32.0820 4344 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
22:23:32.0823 4344 atapi - ok
22:23:32.0910 4344 AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
22:23:32.0917 4344 AudioEndpointBuilder - ok
22:23:32.0931 4344 Audiosrv (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
22:23:32.0938 4344 Audiosrv - ok
22:23:33.0002 4344 avast! Antivirus (4041d31508a2a084dfb42c595854090f) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
22:23:33.0005 4344 avast! Antivirus - ok
22:23:33.0042 4344 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
22:23:33.0044 4344 Beep - ok
22:23:33.0099 4344 BFE (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll
22:23:33.0107 4344 BFE - ok
22:23:33.0250 4344 BITS (93952506c6d67330367f7e7934b6a02f) C:\Windows\system32\qmgr.dll
22:23:33.0275 4344 BITS - ok
22:23:33.0296 4344 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
22:23:33.0299 4344 blbdrive - ok
22:23:33.0407 4344 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe
22:23:33.0414 4344 Bonjour Service - ok
22:23:33.0464 4344 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
22:23:33.0467 4344 bowser - ok
22:23:33.0507 4344 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
22:23:33.0509 4344 BrFiltLo - ok
22:23:33.0527 4344 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
22:23:33.0530 4344 BrFiltUp - ok
22:23:33.0569 4344 Browser (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
22:23:33.0573 4344 Browser - ok
22:23:33.0615 4344 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
22:23:33.0618 4344 Brserid - ok
22:23:33.0652 4344 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
22:23:33.0655 4344 BrSerWdm - ok
22:23:33.0673 4344 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
22:23:33.0675 4344 BrUsbMdm - ok
22:23:33.0698 4344 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
22:23:33.0700 4344 BrUsbSer - ok
22:23:33.0744 4344 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys
22:23:33.0747 4344 BthEnum - ok
22:23:33.0765 4344 BTHMODEM (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys
22:23:33.0767 4344 BTHMODEM - ok
22:23:33.0806 4344 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys
22:23:33.0810 4344 BthPan - ok
22:23:33.0919 4344 BTHPORT (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys
22:23:33.0928 4344 BTHPORT - ok
22:23:33.0992 4344 BthServ (a4c8377fa4a994e07075107dbe2e3dce) C:\Windows\System32\bthserv.dll
22:23:33.0995 4344 BthServ - ok
22:23:34.0017 4344 BTHUSB (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys
22:23:34.0019 4344 BTHUSB - ok
22:23:34.0069 4344 btwaudio (229b2c1e776062a4033305d5a9d6e28d) C:\Windows\system32\drivers\btwaudio.sys
22:23:34.0072 4344 btwaudio - ok
22:23:34.0109 4344 btwavdt (97062053359f6908e1fb2791bfa54734) C:\Windows\system32\drivers\btwavdt.sys
22:23:34.0112 4344 btwavdt - ok
22:23:34.0132 4344 btwrchid (d9269b0e3e3cf46d677fd071a40fe6cd) C:\Windows\system32\DRIVERS\btwrchid.sys
22:23:34.0134 4344 btwrchid - ok
22:23:34.0178 4344 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
22:23:34.0181 4344 cdfs - ok
22:23:34.0227 4344 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
22:23:34.0230 4344 cdrom - ok
22:23:34.0302 4344 CertPropSvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
22:23:34.0306 4344 CertPropSvc - ok
22:23:34.0329 4344 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
22:23:34.0331 4344 circlass - ok
22:23:34.0390 4344 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
22:23:34.0397 4344 CLFS - ok
22:23:34.0471 4344 clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:23:34.0474 4344 clr_optimization_v2.0.50727_32 - ok
22:23:34.0607 4344 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:23:34.0612 4344 clr_optimization_v4.0.30319_32 - ok
22:23:34.0650 4344 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
22:23:34.0652 4344 CmBatt - ok
22:23:34.0665 4344 cmdide (d36372a6ea6805efbe8884d10772313f) C:\Windows\system32\drivers\cmdide.sys
22:23:34.0668 4344 cmdide - ok
22:23:34.0780 4344 Com4QLBEx (7795f8cebc284a426b53f541e538695f) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
22:23:34.0784 4344 Com4QLBEx - ok
22:23:34.0815 4344 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
22:23:34.0817 4344 Compbatt - ok
22:23:34.0826 4344 COMSysApp - ok
22:23:34.0856 4344 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
22:23:34.0859 4344 crcdisk - ok
22:23:34.0901 4344 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
22:23:34.0903 4344 Crusoe - ok
22:23:34.0977 4344 CryptSvc (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll
22:23:34.0983 4344 CryptSvc - ok
22:23:35.0093 4344 DcomLaunch (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
22:23:35.0113 4344 DcomLaunch - ok
22:23:35.0177 4344 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
22:23:35.0181 4344 DfsC - ok
22:23:35.0440 4344 DFSR (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
22:23:35.0474 4344 DFSR - ok
22:23:35.0647 4344 Dhcp (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
22:23:35.0655 4344 Dhcp - ok
22:23:35.0712 4344 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
22:23:35.0715 4344 disk - ok
22:23:35.0775 4344 Dnscache (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
22:23:35.0781 4344 Dnscache - ok
22:23:35.0837 4344 dot3svc (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
22:23:35.0844 4344 dot3svc - ok
22:23:35.0928 4344 DpHost (5bc1d876dfd53c31c5fc65d2e9614015) C:\Program Files\DigitalPersona\Bin\DpHostW.exe
22:23:35.0934 4344 DpHost - ok
22:23:35.0980 4344 DPS (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
22:23:35.0991 4344 DPS - ok
22:23:36.0030 4344 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
22:23:36.0032 4344 drmkaud - ok
22:23:36.0138 4344 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
22:23:36.0149 4344 DXGKrnl - ok
22:23:36.0181 4344 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
22:23:36.0184 4344 E1G60 - ok
22:23:36.0218 4344 EapHost (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
22:23:36.0224 4344 EapHost - ok
22:23:36.0298 4344 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
22:23:36.0302 4344 Ecache - ok
22:23:36.0384 4344 ehRecvr (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe
22:23:36.0391 4344 ehRecvr - ok
22:23:36.0416 4344 ehSched (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
22:23:36.0420 4344 ehSched - ok
22:23:36.0440 4344 ehstart (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
22:23:36.0442 4344 ehstart - ok
22:23:36.0501 4344 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
22:23:36.0508 4344 elxstor - ok
22:23:36.0616 4344 EMDMgmt (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
22:23:36.0629 4344 EMDMgmt - ok
22:23:36.0654 4344 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
22:23:36.0657 4344 ErrDev - ok
22:23:36.0750 4344 EventSystem (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
22:23:36.0759 4344 EventSystem - ok
22:23:36.0820 4344 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
22:23:36.0824 4344 exfat - ok
22:23:36.0889 4344 ezSharedSvc (42f721c52eef2d6df9372a53813a83ef) C:\Windows\System32\ezsvc7.dll
22:23:36.0895 4344 ezSharedSvc - ok
22:23:36.0950 4344 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
22:23:36.0954 4344 fastfat - ok
22:23:36.0999 4344 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
22:23:37.0002 4344 fdc - ok
22:23:37.0030 4344 fdPHost (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
22:23:37.0036 4344 fdPHost - ok
22:23:37.0059 4344 FDResPub (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
22:23:37.0065 4344 FDResPub - ok
22:23:37.0084 4344 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
22:23:37.0087 4344 FileInfo - ok
22:23:37.0110 4344 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
22:23:37.0114 4344 Filetrace - ok
22:23:37.0134 4344 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
22:23:37.0136 4344 flpydisk - ok
22:23:37.0188 4344 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
22:23:37.0192 4344 FltMgr - ok
22:23:37.0332 4344 FontCache (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
22:23:37.0349 4344 FontCache - ok
22:23:37.0405 4344 FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
22:23:37.0408 4344 FontCache3.0.0.0 - ok
22:23:37.0446 4344 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys
22:23:37.0449 4344 fssfltr - ok
22:23:37.0667 4344 fsssvc (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
22:23:37.0691 4344 fsssvc - ok
22:23:37.0809 4344 Fs_Rec (b972a66758577e0bfd1de0f91aaa27b5) C:\Windows\system32\drivers\Fs_Rec.sys
22:23:37.0812 4344 Fs_Rec - ok
22:23:37.0853 4344 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
22:23:37.0856 4344 gagp30kx - ok
22:23:37.0898 4344 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
22:23:37.0901 4344 GEARAspiWDM - ok
22:23:37.0988 4344 gpsvc (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
22:23:38.0002 4344 gpsvc - ok
22:23:38.0056 4344 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
22:23:38.0061 4344 HdAudAddService - ok
22:23:38.0144 4344 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
22:23:38.0154 4344 HDAudBus - ok
22:23:38.0174 4344 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
22:23:38.0177 4344 HidBth - ok
22:23:38.0205 4344 HidIr (d8df3722d5e961baa1292aa2f12827e2) C:\Windows\system32\DRIVERS\hidir.sys
22:23:38.0208 4344 HidIr - ok
22:23:38.0257 4344 hidserv (84067081f3318162797385e11a8f0582) C:\Windows\System32\hidserv.dll
22:23:38.0263 4344 hidserv - ok
22:23:38.0301 4344 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
22:23:38.0304 4344 HidUsb - ok
22:23:38.0343 4344 hkmsvc (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
22:23:38.0352 4344 hkmsvc - ok
22:23:38.0453 4344 HP Health Check Service (a19b0bb5a7eb6df2dd4a0711d36955ee) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
22:23:38.0455 4344 HP Health Check Service - ok
22:23:38.0480 4344 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
22:23:38.0483 4344 HpCISSs - ok
22:23:38.0496 4344 hpdskflt (24f3f496c18efc234777723a67a85f81) C:\Windows\system32\DRIVERS\hpdskflt.sys
22:23:38.0499 4344 hpdskflt - ok
22:23:38.0533 4344 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\Windows\system32\DRIVERS\HpqKbFiltr.sys
22:23:38.0536 4344 HpqKbFiltr - ok
22:23:38.0580 4344 hpqwmiex (1665c7121a026df10c903db9bc5e9d43) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
22:23:38.0583 4344 hpqwmiex - ok
22:23:38.0600 4344 hpsrv (6d0ac28c5bd8d8495f83f5929a45e559) C:\Windows\system32\Hpservice.exe
22:23:38.0606 4344 hpsrv - ok
22:23:38.0690 4344 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
22:23:38.0703 4344 HTTP - ok
22:23:38.0722 4344 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
22:23:38.0725 4344 i2omp - ok
22:23:38.0766 4344 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
22:23:38.0769 4344 i8042prt - ok
22:23:38.0870 4344 IAANTMON (cb686f44bf955ea02520710a56874fa4) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
22:23:38.0877 4344 IAANTMON - ok
22:23:38.0918 4344 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys
22:23:38.0924 4344 iaStor - ok
22:23:38.0962 4344 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
22:23:38.0969 4344 iaStorV - ok
22:23:39.0054 4344 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
22:23:39.0057 4344 IDriverT - ok
22:23:39.0210 4344 idsvc (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:23:39.0224 4344 idsvc - ok
22:23:39.0254 4344 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
22:23:39.0257 4344 iirsp - ok
22:23:39.0347 4344 IKEEXT (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
22:23:39.0359 4344 IKEEXT - ok
22:23:39.0398 4344 intelide (dd512a049bd7b4bce8a83554c5eff2c1) C:\Windows\system32\drivers\intelide.sys
22:23:39.0401 4344 intelide - ok
22:23:39.0416 4344 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
22:23:39.0419 4344 intelppm - ok
22:23:39.0443 4344 IPBusEnum (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
22:23:39.0451 4344 IPBusEnum - ok
22:23:39.0475 4344 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:23:39.0478 4344 IpFilterDriver - ok
22:23:39.0545 4344 iphlpsvc (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll
22:23:39.0553 4344 iphlpsvc - ok
22:23:39.0562 4344 IpInIp - ok
22:23:39.0605 4344 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
22:23:39.0608 4344 IPMIDRV - ok
22:23:39.0642 4344 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
22:23:39.0645 4344 IPNAT - ok
22:23:39.0784 4344 iPod Service (ce004777b92dea56fe14ec900d20baa4) C:\Program Files\iPod\bin\iPodService.exe
22:23:39.0797 4344 iPod Service - ok
22:23:39.0821 4344 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
22:23:39.0824 4344 IRENUM - ok
22:23:39.0860 4344 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
22:23:39.0863 4344 isapnp - ok
22:23:39.0921 4344 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
22:23:39.0926 4344 iScsiPrt - ok
22:23:39.0949 4344 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
22:23:39.0953 4344 iteatapi - ok
22:23:39.0990 4344 itecir (8bcd857c7932ad005d5f9c89329da2e1) C:\Windows\system32\DRIVERS\itecir.sys
22:23:39.0996 4344 itecir - ok
22:23:40.0008 4344 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
22:23:40.0013 4344 iteraid - ok
22:23:40.0049 4344 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
22:23:40.0051 4344 kbdclass - ok
22:23:40.0082 4344 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
22:23:40.0084 4344 kbdhid - ok
22:23:40.0135 4344 KeyIso (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
22:23:40.0143 4344 KeyIso - ok
22:23:40.0195 4344 KSecDD (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
22:23:40.0204 4344 KSecDD - ok
22:23:40.0264 4344 KtmRm (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
22:23:40.0277 4344 KtmRm - ok
22:23:40.0342 4344 LanmanServer (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\System32\srvsvc.dll
22:23:40.0356 4344 LanmanServer - ok
22:23:40.0424 4344 LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll
22:23:40.0440 4344 LanmanWorkstation - ok
22:23:40.0474 4344 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
22:23:40.0477 4344 lltdio - ok
22:23:40.0534 4344 lltdsvc (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
22:23:40.0544 4344 lltdsvc - ok
22:23:40.0573 4344 lmhosts (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
22:23:40.0581 4344 lmhosts - ok
22:23:40.0613 4344 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
22:23:40.0617 4344 LSI_FC - ok
22:23:40.0641 4344 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
22:23:40.0644 4344 LSI_SAS - ok
22:23:40.0663 4344 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
22:23:40.0667 4344 LSI_SCSI - ok
22:23:40.0694 4344 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
22:23:40.0697 4344 luafv - ok
22:23:40.0738 4344 Mcx2Svc (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll
22:23:40.0746 4344 Mcx2Svc - ok
22:23:40.0786 4344 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
22:23:40.0789 4344 megasas - ok
22:23:40.0845 4344 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
22:23:40.0853 4344 MegaSR - ok
22:23:40.0872 4344 MMCSS (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
22:23:40.0881 4344 MMCSS - ok
22:23:40.0906 4344 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
22:23:40.0909 4344 Modem - ok
22:23:40.0928 4344 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
22:23:40.0931 4344 monitor - ok
22:23:40.0958 4344 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
22:23:40.0961 4344 mouclass - ok
22:23:40.0987 4344 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
22:23:40.0989 4344 mouhid - ok
22:23:41.0007 4344 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
22:23:41.0011 4344 MountMgr - ok
22:23:41.0044 4344 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
22:23:41.0048 4344 mpio - ok
22:23:41.0074 4344 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
22:23:41.0077 4344 mpsdrv - ok
22:23:41.0163 4344 MpsSvc (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll
22:23:41.0178 4344 MpsSvc - ok
22:23:41.0195 4344 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
22:23:41.0198 4344 Mraid35x - ok
22:23:41.0263 4344 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
22:23:41.0267 4344 MRxDAV - ok
22:23:41.0329 4344 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
22:23:41.0333 4344 mrxsmb - ok
22:23:41.0387 4344 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:23:41.0392 4344 mrxsmb10 - ok
22:23:41.0417 4344 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:23:41.0424 4344 mrxsmb20 - ok
22:23:41.0459 4344 msahci (aa305cff241da187bd5077de4a2a043d) C:\Windows\system32\drivers\msahci.sys
22:23:41.0462 4344 msahci - ok
22:23:41.0514 4344 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
22:23:41.0517 4344 msdsm - ok
22:23:41.0569 4344 MSDTC (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
22:23:41.0580 4344 MSDTC - ok
22:23:41.0658 4344 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
22:23:41.0660 4344 Msfs - ok
22:23:41.0694 4344 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
22:23:41.0696 4344 msisadrv - ok
22:23:41.0750 4344 MSiSCSI (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
22:23:41.0760 4344 MSiSCSI - ok
22:23:41.0776 4344 msiserver - ok
22:23:41.0827 4344 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
22:23:41.0829 4344 MSKSSRV - ok
22:23:41.0854 4344 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
22:23:41.0862 4344 MSPCLOCK - ok
22:23:41.0886 4344 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
22:23:41.0889 4344 MSPQM - ok
22:23:41.0959 4344 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
22:23:41.0964 4344 MsRPC - ok
22:23:42.0016 4344 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
22:23:42.0019 4344 mssmbios - ok
22:23:42.0082 4344 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
22:23:42.0085 4344 MSTEE - ok
22:23:42.0163 4344 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
22:23:42.0166 4344 Mup - ok
22:23:42.0253 4344 napagent (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
22:23:42.0272 4344 napagent - ok
22:23:42.0376 4344 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
22:23:42.0380 4344 NativeWifiP - ok
22:23:42.0453 4344 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
22:23:42.0465 4344 NDIS - ok
22:23:42.0501 4344 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
22:23:42.0503 4344 NdisTapi - ok
22:23:42.0533 4344 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
22:23:42.0537 4344 Ndisuio - ok
22:23:42.0586 4344 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
22:23:42.0590 4344 NdisWan - ok
22:23:42.0619 4344 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
22:23:42.0623 4344 NDProxy - ok
22:23:42.0654 4344 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
22:23:42.0657 4344 NetBIOS - ok
22:23:42.0736 4344 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
22:23:42.0741 4344 netbt - ok
22:23:42.0791 4344 Netlogon (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
22:23:42.0800 4344 Netlogon - ok
22:23:42.0863 4344 Netman (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
22:23:42.0877 4344 Netman - ok
22:23:42.0935 4344 netprofm (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
22:23:42.0948 4344 netprofm - ok
22:23:43.0023 4344 NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:23:43.0027 4344 NetTcpPortSharing - ok
22:23:43.0309 4344 NETw3v32 (35d5458d9a1b26b2005abffbf4c1c5e7) C:\Windows\system32\DRIVERS\NETw3v32.sys
22:23:43.0346 4344 NETw3v32 - ok
22:23:43.0831 4344 NETw5v32 (8de67bd902095a13329fd82c85a1fa09) C:\Windows\system32\DRIVERS\NETw5v32.sys
22:23:43.0888 4344 NETw5v32 - ok
22:23:44.0030 4344 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
22:23:44.0034 4344 nfrd960 - ok
22:23:44.0086 4344 NlaSvc (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
22:23:44.0098 4344 NlaSvc - ok
22:23:44.0128 4344 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
22:23:44.0132 4344 Npfs - ok
22:23:44.0166 4344 nsi (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
22:23:44.0176 4344 nsi - ok
22:23:44.0199 4344 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
22:23:44.0202 4344 nsiproxy - ok
22:23:44.0351 4344 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
22:23:44.0370 4344 Ntfs - ok
22:23:44.0414 4344 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
22:23:44.0417 4344 ntrigdigi - ok
22:23:44.0443 4344 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
22:23:44.0446 4344 Null - ok
22:23:45.0418 4344 nvlddmkm (24000b817cc84ac1555f41929879af5a) C:\Windows\system32\DRIVERS\nvlddmkm.sys
22:23:45.0571 4344 nvlddmkm - ok
22:23:45.0725 4344 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys
22:23:45.0734 4344 nvraid - ok
22:23:45.0753 4344 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys
22:23:45.0756 4344 nvstor - ok
22:23:45.0820 4344 nvsvc (c4d17f11526f87bc762f31da5bd2580b) C:\Windows\system32\nvvsvc.exe
22:23:45.0835 4344 nvsvc - ok
22:23:45.0874 4344 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys
22:23:45.0878 4344 nv_agp - ok
22:23:45.0888 4344 NwlnkFlt - ok
22:23:45.0910 4344 NwlnkFwd - ok
22:23:46.0021 4344 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
22:23:46.0035 4344 odserv - ok
22:23:46.0095 4344 ohci1394 (790e27c3db53410b40ff9ef2fd10a1d9) C:\Windows\system32\DRIVERS\ohci1394.sys
22:23:46.0098 4344 ohci1394 - ok
22:23:46.0175 4344 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:23:46.0179 4344 ose - ok
22:23:46.0295 4344 p2pimsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
22:23:46.0319 4344 p2pimsvc - ok
22:23:46.0346 4344 p2psvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
22:23:46.0367 4344 p2psvc - ok
22:23:46.0411 4344 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
22:23:46.0416 4344 Parport - ok
22:23:46.0462 4344 partmgr (b9c2b89f08670e159f7181891e449cd9) C:\Windows\system32\drivers\partmgr.sys
22:23:46.0467 4344 partmgr - ok
22:23:46.0498 4344 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
22:23:46.0501 4344 Parvdm - ok
22:23:46.0541 4344 PcaSvc (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
22:23:46.0553 4344 PcaSvc - ok
22:23:46.0601 4344 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
22:23:46.0606 4344 pci - ok
22:23:46.0625 4344 pciide (1d8b3d8df8eb7fcf2f0ac02f9f947802) C:\Windows\system32\drivers\pciide.sys
22:23:46.0628 4344 pciide - ok
22:23:46.0681 4344 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
22:23:46.0687 4344 pcmcia - ok
22:23:46.0826 4344 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
22:23:46.0846 4344 PEAUTH - ok
22:23:47.0002 4344 pla (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
22:23:47.0035 4344 pla - ok
22:23:47.0188 4344 PlugPlay (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
22:23:47.0204 4344 PlugPlay - ok
22:23:47.0317 4344 PNRPAutoReg (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
22:23:47.0338 4344 PNRPAutoReg - ok
22:23:47.0362 4344 PNRPsvc (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
22:23:47.0383 4344 PNRPsvc - ok
22:23:47.0431 4344 PolicyAgent (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
22:23:47.0443 4344 PolicyAgent - ok
22:23:47.0497 4344 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
22:23:47.0500 4344 PptpMiniport - ok
22:23:47.0528 4344 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
22:23:47.0531 4344 Processor - ok
22:23:47.0596 4344 ProfSvc (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
22:23:47.0610 4344 ProfSvc - ok
22:23:47.0659 4344 ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
22:23:47.0667 4344 ProtectedStorage - ok
22:23:47.0731 4344 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
22:23:47.0735 4344 PSched - ok
22:23:47.0852 4344 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
22:23:47.0871 4344 ql2300 - ok
22:23:47.0934 4344 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
22:23:47.0938 4344 ql40xx - ok
22:23:48.0073 4344 QPCapSvc (648218a6c858e37e3e9eaa51812e3e65) C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
22:23:48.0079 4344 QPCapSvc - ok
22:23:48.0110 4344 QPSched (6b704dc5de8a78adbfede8109d925915) C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
22:23:48.0114 4344 QPSched - ok
22:23:48.0173 4344 QWAVE (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
22:23:48.0188 4344 QWAVE - ok
22:23:48.0208 4344 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
22:23:48.0211 4344 QWAVEdrv - ok
22:23:48.0237 4344 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
22:23:48.0240 4344 RasAcd - ok
22:23:48.0272 4344 RasAuto (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
22:23:48.0285 4344 RasAuto - ok
22:23:48.0308 4344 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
22:23:48.0312 4344 Rasl2tp - ok
22:23:48.0388 4344 RasMan (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll
22:23:48.0404 4344 RasMan - ok
22:23:48.0458 4344 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
22:23:48.0461 4344 RasPppoe - ok
22:23:48.0513 4344 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
22:23:48.0517 4344 RasSstp - ok
22:23:48.0585 4344 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
22:23:48.0591 4344 rdbss - ok
22:23:48.0611 4344 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
22:23:48.0617 4344 RDPCDD - ok
22:23:48.0668 4344 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys
22:23:48.0674 4344 rdpdr - ok
22:23:48.0686 4344 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
22:23:48.0689 4344 RDPENCDD - ok
22:23:48.0764 4344 RDPWD (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
22:23:48.0769 4344 RDPWD - ok
22:23:48.0831 4344 Recovery Service for Windows (7196d5e5005f5da73cce36f4ffe96a9b) C:\Windows\SMINST\BLService.exe
22:23:48.0838 4344 Recovery Service for Windows - ok
22:23:48.0883 4344 RemoteAccess (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
22:23:48.0893 4344 RemoteAccess - ok
22:23:48.0944 4344 RemoteRegistry (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll
22:23:48.0957 4344 RemoteRegistry - ok
22:23:49.0001 4344 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys
22:23:49.0006 4344 RFCOMM - ok
22:23:49.0023 4344 RpcLocator (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
22:23:49.0031 4344 RpcLocator - ok
22:23:49.0128 4344 RpcSs (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
22:23:49.0148 4344 RpcSs - ok
22:23:49.0192 4344 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
22:23:49.0195 4344 rspndr - ok
22:23:49.0261 4344 RTL8169 (2d19a7469ea19993d0c12e627f4530bc) C:\Windows\system32\DRIVERS\Rtlh86.sys
22:23:49.0270 4344 RTL8169 - ok
22:23:49.0315 4344 SamSs (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
22:23:49.0323 4344 SamSs - ok
22:23:49.0347 4344 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
22:23:49.0351 4344 sbp2port - ok
22:23:49.0410 4344 SCardSvr (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
22:23:49.0424 4344 SCardSvr - ok
22:23:49.0525 4344 Schedule (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
22:23:49.0546 4344 Schedule - ok
22:23:49.0603 4344 SCPolicySvc (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
22:23:49.0607 4344 SCPolicySvc - ok
22:23:49.0656 4344 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys
22:23:49.0660 4344 sdbus - ok
22:23:49.0729 4344 SDRSVC (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
22:23:49.0743 4344 SDRSVC - ok
22:23:49.0855 4344 SeaPort (16a252022535b680046f6e34e136d378) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
22:23:49.0860 4344 SeaPort - ok
22:23:49.0883 4344 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
22:23:49.0886 4344 secdrv - ok
22:23:49.0913 4344 seclogon (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
22:23:49.0929 4344 seclogon - ok
22:23:49.0956 4344 SENS (a9bbab5759771e523f55563d6cbe140f) C:\Windows\system32\sens.dll
22:23:49.0969 4344 SENS - ok
22:23:50.0016 4344 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
22:23:50.0019 4344 Serenum - ok
22:23:50.0047 4344 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
22:23:50.0051 4344 Serial - ok
22:23:50.0073 4344 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
22:23:50.0076 4344 sermouse - ok
22:23:50.0144 4344 SessionEnv (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
22:23:50.0157 4344 SessionEnv - ok
22:23:50.0184 4344 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
22:23:50.0188 4344 sffdisk - ok
22:23:50.0218 4344 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
22:23:50.0221 4344 sffp_mmc - ok
22:23:50.0245 4344 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
22:23:50.0248 4344 sffp_sd - ok
22:23:50.0272 4344 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
22:23:50.0275 4344 sfloppy - ok
22:23:50.0336 4344 SharedAccess (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
22:23:50.0346 4344 SharedAccess - ok
22:23:50.0425 4344 ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
22:23:50.0440 4344 ShellHWDetection - ok
22:23:50.0467 4344 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
22:23:50.0471 4344 sisagp - ok
22:23:50.0507 4344 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
22:23:50.0510 4344 SiSRaid2 - ok
22:23:50.0529 4344 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
22:23:50.0533 4344 SiSRaid4 - ok
22:23:50.0911 4344 slsvc (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
22:23:50.0976 4344 slsvc - ok
22:23:51.0114 4344 SLUINotify (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
22:23:51.0126 4344 SLUINotify - ok
22:23:51.0206 4344 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
22:23:51.0210 4344 Smb - ok
22:23:51.0256 4344 SNMPTRAP (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
22:23:51.0268 4344 SNMPTRAP - ok
22:23:51.0368 4344 Sony SCSI Helper Service (3bb48f7e33c2b76184ddf233000c09cd) C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
22:23:51.0374 4344 Sony SCSI Helper Service - ok
22:23:51.0413 4344 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
22:23:51.0417 4344 spldr - ok
22:23:51.0475 4344 Spooler (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
22:23:51.0490 4344 Spooler - ok
22:23:51.0568 4344 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
22:23:51.0575 4344 srv - ok
22:23:51.0641 4344 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
22:23:51.0646 4344 srv2 - ok
22:23:51.0670 4344 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
22:23:51.0675 4344 srvnet - ok
22:23:51.0715 4344 SSDPSRV (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
22:23:51.0730 4344 SSDPSRV - ok
22:23:51.0781 4344 SstpSvc (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
22:23:51.0795 4344 SstpSvc - ok
22:23:51.0911 4344 STacSV (b2f685678a31b7c52c7b60000b3a251d) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_84a4a6b7\STacSV.exe
22:23:51.0916 4344 STacSV - ok
22:23:52.0009 4344 STHDA (4b2aa9c486039ef821a07fe51bb1b065) C:\Windows\system32\DRIVERS\stwrt.sys
22:23:52.0018 4344 STHDA - ok
22:23:52.0110 4344 stisvc (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
22:23:52.0130 4344 stisvc - ok
22:23:52.0163 4344 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
22:23:52.0167 4344 swenum - ok
22:23:52.0247 4344 swprv (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
22:23:52.0264 4344 swprv - ok
22:23:52.0282 4344 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
22:23:52.0285 4344 Symc8xx - ok
22:23:52.0309 4344 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
22:23:52.0312 4344 Sym_hi - ok
22:23:52.0327 4344 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
22:23:52.0331 4344 Sym_u3 - ok
22:23:52.0428 4344 SysMain (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
22:23:52.0449 4344 SysMain - ok
22:23:52.0478 4344 TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
22:23:52.0493 4344 TabletInputService - ok
22:23:52.0568 4344 TapiSrv (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll
22:23:52.0585 4344 TapiSrv - ok
22:23:52.0605 4344 TBS (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
22:23:52.0620 4344 TBS - ok
22:23:52.0766 4344 Tcpip (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\drivers\tcpip.sys
22:23:52.0782 4344 Tcpip - ok
22:23:52.0811 4344 Tcpip6 (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\DRIVERS\tcpip.sys
22:23:52.0827 4344 Tcpip6 - ok
22:23:52.0873 4344 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
22:23:52.0877 4344 tcpipreg - ok
22:23:52.0917 4344 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
22:23:52.0921 4344 TDPIPE - ok
22:23:52.0966 4344 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
22:23:52.0970 4344 TDTCP - ok
22:23:53.0030 4344 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
22:23:53.0034 4344 tdx - ok
22:23:53.0083 4344 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
22:23:53.0086 4344 TermDD - ok
22:23:53.0178 4344 TermService (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll
22:23:53.0200 4344 TermService - ok
22:23:53.0275 4344 Themes (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
22:23:53.0290 4344 Themes - ok
22:23:53.0328 4344 THREADORDER (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
22:23:53.0337 4344 THREADORDER - ok
22:23:53.0386 4344 TrkWks (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
22:23:53.0401 4344 TrkWks - ok
22:23:53.0468 4344 TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
22:23:53.0470 4344 TrustedInstaller - ok
22:23:53.0516 4344 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
22:23:53.0520 4344 tssecsrv - ok
22:23:53.0552 4344 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
22:23:53.0555 4344 tunmp - ok
22:23:53.0585 4344 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
22:23:53.0589 4344 tunnel - ok
22:23:53.0628 4344 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
22:23:53.0632 4344 uagp35 - ok
22:23:53.0684 4344 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
22:23:53.0690 4344 udfs - ok
22:23:53.0753 4344 UI0Detect (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
22:23:53.0767 4344 UI0Detect - ok
22:23:53.0785 4344 UIUSys - ok
22:23:53.0822 4344 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
22:23:53.0826 4344 uliagpkx - ok
22:23:53.0881 4344 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
22:23:53.0887 4344 uliahci - ok
22:23:53.0916 4344 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
22:23:53.0921 4344 UlSata - ok
22:23:53.0944 4344 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
22:23:53.0949 4344 ulsata2 - ok
22:23:53.0972 4344 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
22:23:53.0975 4344 umbus - ok
22:23:54.0040 4344 upnphost (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
22:23:54.0056 4344 upnphost - ok
22:23:54.0114 4344 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\Windows\system32\Drivers\usbaapl.sys
22:23:54.0118 4344 USBAAPL - ok
22:23:54.0154 4344 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
22:23:54.0158 4344 usbccgp - ok
22:23:54.0204 4344 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
22:23:54.0208 4344 usbcir - ok
22:23:54.0254 4344 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
22:23:54.0257 4344 usbehci - ok
22:23:54.0308 4344 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
22:23:54.0314 4344 usbhub - ok
22:23:54.0346 4344 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
22:23:54.0350 4344 usbohci - ok
22:23:54.0379 4344 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
22:23:54.0382 4344 usbprint - ok
22:23:54.0410 4344 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:23:54.0414 4344 USBSTOR - ok
22:23:54.0443 4344 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
22:23:54.0447 4344 usbuhci - ok
22:23:54.0487 4344 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
22:23:54.0491 4344 usbvideo - ok
22:23:54.0520 4344 UxSms (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
22:23:54.0536 4344 UxSms - ok
22:23:54.0612 4344 vds (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
22:23:54.0631 4344 vds - ok
22:23:54.0674 4344 vfs101x (4d45a93a7dd638ca2db0a86fbfbf42d1) C:\Windows\system32\drivers\vfs101x.sys
22:23:54.0678 4344 vfs101x - ok
22:23:54.0776 4344 vfsFPService (d4584341007df94e31943b19bb9c110e) C:\Windows\system32\vfsFPService.exe
22:23:54.0802 4344 vfsFPService - ok
22:23:54.0903 4344 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
22:23:54.0907 4344 vga - ok
22:23:54.0956 4344 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
22:23:54.0960 4344 VgaSave - ok
22:23:55.0033 4344 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
22:23:55.0036 4344 viaagp - ok
22:23:55.0061 4344 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
22:23:55.0064 4344 ViaC7 - ok
22:23:55.0092 4344 viaide (ea1aa6e3abb3c194feba12a46de8cf2c) C:\Windows\system32\drivers\viaide.sys
22:23:55.0095 4344 viaide - ok
22:23:55.0123 4344 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
22:23:55.0127 4344 volmgr - ok
22:23:55.0203 4344 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
22:23:55.0216 4344 volmgrx - ok
22:23:55.0266 4344 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
22:23:55.0272 4344 volsnap - ok
22:23:55.0300 4344 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
22:23:55.0306 4344 vsmraid - ok
22:23:55.0442 4344 VSS (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
22:23:55.0476 4344 VSS - ok
22:23:55.0566 4344 W32Time (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
22:23:55.0584 4344 W32Time - ok
22:23:55.0658 4344 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
22:23:55.0662 4344 WacomPen - ok
22:23:55.0697 4344 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
22:23:55.0701 4344 Wanarp - ok
22:23:55.0713 4344 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
22:23:55.0718 4344 Wanarpv6 - ok
22:23:55.0772 4344 wcncsvc (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
22:23:55.0794 4344 wcncsvc - ok
22:23:55.0826 4344 WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
22:23:55.0841 4344 WcsPlugInService - ok
22:23:55.0863 4344 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
22:23:55.0867 4344 Wd - ok
22:23:55.0934 4344 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
22:23:55.0944 4344 Wdf01000 - ok
22:23:55.0974 4344 WdiServiceHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
22:23:55.0993 4344 WdiServiceHost - ok
22:23:56.0004 4344 WdiSystemHost (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
22:23:56.0020 4344 WdiSystemHost - ok
22:23:56.0084 4344 WebClient (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
22:23:56.0100 4344 WebClient - ok
22:23:56.0168 4344 Wecsvc (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
22:23:56.0184 4344 Wecsvc - ok
22:23:56.0214 4344 wercplsupport (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
22:23:56.0229 4344 wercplsupport - ok
22:23:56.0283 4344 WerSvc (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
22:23:56.0298 4344 WerSvc - ok
22:23:56.0394 4344 WinDefend (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
22:23:56.0399 4344 WinDefend - ok
22:23:56.0416 4344 WinHttpAutoProxySvc - ok
22:23:56.0521 4344 Winmgmt (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
22:23:56.0526 4344 Winmgmt - ok
22:23:56.0689 4344 WinRM (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
22:23:56.0721 4344 WinRM - ok
22:23:56.0827 4344 Wlansvc (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
22:23:56.0849 4344 Wlansvc - ok
22:23:56.0970 4344 wlcrasvc (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
22:23:56.0973 4344 wlcrasvc - ok
22:23:57.0165 4344 wlidsvc (0a70f4022ec2e14c159efc4f69aa2477) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
22:23:57.0192 4344 wlidsvc - ok
22:23:58.0094 4344 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
22:23:58.0098 4344 WmiAcpi - ok
22:23:58.0202 4344 wmiApSrv (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
22:23:58.0211 4344 wmiApSrv - ok
22:23:58.0375 4344 WMPNetworkSvc (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
22:23:58.0391 4344 WMPNetworkSvc - ok
22:23:58.0450 4344 WPCSvc (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
22:23:58.0467 4344 WPCSvc - ok
22:23:58.0556 4344 WPDBusEnum (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
22:23:58.0573 4344 WPDBusEnum - ok
22:23:58.0636 4344 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
22:23:58.0640 4344 WpdUsb - ok
22:23:58.0820 4344 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
22:23:58.0833 4344 WPFFontCache_v0400 - ok
22:23:58.0868 4344 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
22:23:58.0872 4344 ws2ifsl - ok
22:23:58.0927 4344 wscsvc (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\system32\wscsvc.dll
22:23:58.0943 4344 wscsvc - ok
22:23:58.0954 4344 WSearch - ok
22:23:59.0193 4344 wuauserv (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
22:23:59.0236 4344 wuauserv - ok
22:23:59.0347 4344 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
22:23:59.0351 4344 WUDFRd - ok
22:23:59.0391 4344 wudfsvc (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
22:23:59.0407 4344 wudfsvc - ok
22:23:59.0472 4344 yukonwlh (7d1f3b131d503ef43ee594b5a2b9b427) C:\Windows\system32\DRIVERS\yk60x86.sys
22:23:59.0478 4344 yukonwlh - ok
22:23:59.0554 4344 {55662437-DA8C-40c0-AADA-2C816A897A49} (bdfde977f5e88a539187aef24ded7c40) C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl
22:23:59.0557 4344 {55662437-DA8C-40c0-AADA-2C816A897A49} - ok
22:23:59.0619 4344 MBR (0x1B8) (588ae8f0c685c02ba11f30d9cd7e61a0) \Device\Harddisk0\DR0
22:23:59.0734 4344 \Device\Harddisk0\DR0 - ok
22:23:59.0742 4344 Boot (0x1200) (9d94e8eef117b6c627c2371da266dd6f) \Device\Harddisk0\DR0\Partition0
22:23:59.0747 4344 \Device\Harddisk0\DR0\Partition0 - ok
22:23:59.0758 4344 Boot (0x1200) (d9b3eaa2b582656a20f5f1ef580db4e7) \Device\Harddisk0\DR0\Partition1
22:23:59.0761 4344 \Device\Harddisk0\DR0\Partition1 - ok
22:23:59.0765 4344 ============================================================
22:23:59.0765 4344 Scan finished
22:23:59.0765 4344 ============================================================
22:23:59.0799 3160 Detected object count: 0
22:23:59.0801 3160 Actual detected object count: 0

Voici le rapport ZHPDiag:
http://pjjoint.malekal.com/files.php?id=ZHPDiag_20120525_s11c8e7d12e9

Bonjour,

Avant d'utiliser ComboFix :

Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

si tu as ce genre de d'outils sur ton pc Utilise Defogger pour les désactiver temporairement : sinon passe directement à combofix

* Télécharge Defogger (de jpshortstuff) sur ton Bureau
* Lance le

* Une fenêtre apparait : clique sur "Disable"

* Fais redémarrer l'ordinateur si l'outil te le demande

Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

===================================================

Attention, avant de commencer, lis attentivement la procédure

********************************************************

/!\ Ne pas utiliser ce logiciel en dehors du cadre de cette désinfection : DANGEUREUX /!\

* Fais un clic droit sur ce lien, enregistre le dans ton bureau sous un autre nom exemple « ton pseudo.exe »
Voici Aide combofix

* /!\ Déconnecte-toi du net et ARRÊTE TES LOGICIELS DE PROTECTION /!\


*Double-clique sur ComboFix.exe (ou exécuter en tant qu'administrateur pour vista et seven)

Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

** SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)

? Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

*En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

** /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

*Note : Le rapport se trouve également là : C:\ComboFix.txt

@+

ComboFix 12-05-26.02 - Flavien 26/05/2012 19:37:07.3.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3068.1832 [GMT 2:00]
Lancé depuis: c:\users\Flavien\Desktop\Manon.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1761747792
c:\programdata\961704704
c:\users\Flavien\AppData\Roaming\69d27407
c:\windows\Update.bat
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-04-26 au 2012-05-26 ))))))))))))))))))))))))))))))))))))
.
.
2012-05-26 17:53 . 2012-05-26 17:53 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-05-26 17:53 . 2012-05-26 17:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-25 20:39 . 2012-05-25 20:43 -------- d-----w- C:\ZHP
2012-05-25 20:38 . 2012-05-25 20:40 -------- d-----w- c:\program files\ZHPDiag
2012-05-25 19:34 . 2012-05-25 19:33 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-25 19:07 . 2012-05-08 16:40 6737808 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A110723B-FE4F-4E11-B8DF-1576CC21415C}\mpengine.dll
2012-05-11 15:03 . 2012-03-20 23:28 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-11 15:03 . 2012-03-30 12:39 905600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-11 15:03 . 2012-02-01 15:11 1218048 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-05-11 15:03 . 2012-02-01 15:10 1404928 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\InkObj.dll
2012-05-11 15:02 . 2012-02-01 15:10 964608 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-05-11 15:02 . 2012-02-01 15:10 983040 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-05-11 15:02 . 2012-02-01 15:10 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-11 15:02 . 2012-02-01 13:58 47104 ----a-w- c:\program files\Windows Journal\PDIALOG.exe
2012-05-11 15:02 . 2012-02-29 13:41 1069056 ----a-w- c:\windows\system32\DWrite.dll
2012-05-11 15:02 . 2012-03-01 14:46 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-05-11 15:02 . 2012-02-29 14:08 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-05-11 15:02 . 2012-03-01 14:46 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-05-11 15:02 . 2012-02-29 13:44 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-05-11 15:02 . 2012-04-03 08:16 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-11 15:02 . 2012-04-03 08:16 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-11 15:02 . 2012-04-02 13:36 2044928 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-25 19:33 . 2010-04-19 18:33 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-09 16:08 . 2012-03-09 16:08 230400 ----a-w- c:\users\Flavien\AppData\Roaming\ml1isssd.exe
2012-03-09 15:43 . 2012-03-09 15:43 161792 ----a-w- c:\windows\system32\msls31.dll
2012-03-09 15:43 . 2012-03-09 15:43 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-09 15:43 . 2012-03-09 15:43 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-09 15:43 . 2012-03-09 15:43 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-09 15:43 . 2012-03-09 15:43 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-09 15:43 . 2012-03-09 15:43 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-03-09 15:42 . 2012-03-09 15:42 367104 ----a-w- c:\windows\system32\html.iec
2012-03-09 15:42 . 2012-03-09 15:42 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-03-09 15:42 . 2012-03-09 15:42 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-09 15:42 . 2012-03-09 15:42 152064 ----a-w- c:\windows\system32\wextract.exe
2012-03-09 15:42 . 2012-03-09 15:42 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-03-09 15:42 . 2012-03-09 15:42 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-03-09 15:42 . 2012-03-09 15:42 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-09 15:42 . 2012-03-09 15:42 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-03-09 15:42 . 2012-03-09 15:42 11776 ----a-w- c:\windows\system32\mshta.exe
2012-03-09 15:42 . 2012-03-09 15:42 101888 ----a-w- c:\windows\system32\admparse.dll
2012-03-09 15:42 . 2012-03-09 15:42 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-03-07 00:15 . 2012-03-09 19:33 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:15 . 2012-03-09 19:33 201352 ----a-w- c:\windows\system32\aswBoot.exe
2012-03-07 00:03 . 2012-03-09 19:34 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:03 . 2012-03-09 19:34 337880 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:02 . 2012-03-09 19:34 35672 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-03-07 00:01 . 2012-03-09 19:34 53848 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2012-03-09 19:33 57688 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2012-03-09 19:34 20696 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-02-29 15:11 . 2012-04-14 15:35 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-14 15:35 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-14 15:35 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-14 15:35 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-02-28 01:18 . 2012-04-14 15:41 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-14 15:40 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-14 15:40 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-14 15:41 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2008-05-23 253952]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"readericon10"="c:\program files\Multimedia Card Reader\readericon10.exe" [2007-11-21 131072]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-08-07 1148200]
"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-08-01 1144104]
"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-08-01 210216]
"TVAgent"="c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe" [2008-07-23 468264]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-08-07 910128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2009-12-01 842816]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-12 906648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 13826664]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-08-11 442460]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-6-19 727592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-21 09:47 136176 ----atw- c:\users\Flavien\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ml1isssd.exe]
2012-03-09 16:08 230400 ----a-w- c:\users\Flavien\AppData\Roaming\ml1isssd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_84a4a6b7\aestsrv.exe [2008-06-27 77824]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'
.
2012-05-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1782375973-3423765673-106299274-1002Core.job
- c:\users\Flavien\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-08 09:47]
.
2012-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1782375973-3423765673-106299274-1002UA.job
- c:\users\Flavien\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-08 09:47]
.
2012-05-26 c:\windows\Tasks\HPCeeScheduleForFlavien.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-09-03 13:14]
.
2012-05-26 c:\windows\Tasks\User_Feed_Synchronization-{5BE08CCB-4892-4F1A-8CA9-80FD71042162}.job
- c:\windows\system32\msfeedssync.exe [2012-03-09 15:42]
.
2012-05-26 c:\windows\Tasks\User_Feed_Synchronization-{C49EB43D-81BC-4F9E-8170-21487A0945BE}.job
- c:\windows\system32\msfeedssync.exe [2012-03-09 15:42]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://isearch.glarysoft.com/?src=iehome
mStart Page = hxxp://isearch.glarysoft.com/?src=iehome
uInternet Settings,ProxyOverride = *.local
IE: &Recherche AOL Toolbar - c:\programdata\AOL\ieToolbar\resources\fr-FR\local\search.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-26 19:53
Windows 6.0.6002 Service Pack 2 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'lsass.exe'(760)
c:\windows\system32\DPPWDFLT.dll
.
- - - - - - - > 'Explorer.exe'(4656)
c:\program files\DigitalPersona\Bin\DpoFeedb.dll
c:\windows\system32\btmmhook.dll
c:\program files\DigitalPersona\Bin\DpoSet.dll
.
Heure de fin: 2012-05-26 20:00:30
ComboFix-quarantined-files.txt 2012-05-26 18:00
.
Avant-CF: 23 698 644 992 octets libres
Après-CF: 24 121 233 408 octets libres
.
- - End Of File - - D524956ECD22D22E1AFB1DC1D77C9003

Voilà pour le 1):

========== FILES ==========
c:\users\Flavien\AppData\Roaming\ml1isssd.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ml1isssd.exe\ deleted successfully.

OTM by OldTimer - Version 3.1.19.0 log created on 05262012_222503

Voilà pour le 2/

RogueKiller V7.5.0 [24/05/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur: Flavien [Droits d'admin]
Mode: Recherche -- Date: 26/05/2012 22:33:15

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 2 ¤¤¤
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver: [CHARGE] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: FUJITSU MHZ2250BH G2 +++++
--- User ---
[MBR] 271c302cbc8cd363e26009a1a9b9a995
[BSP] 2288ab725dafbbf19f40644ffa80cfcb : Toshiba tatooed MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 227904 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 466749440 | Size: 10567 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[1].txt >>
RKreport[1].txt

Dois-je supprimer les éléments?

(Il me demande avant de quitter)

Merci pour ton aide en tout cas :)

Re,

On n'a pas encore terminé! :-)

=========================
/!\ ATTENTION : cette analyse peut durer quelques heures /!\

* Télécharge MBAM et installe le selon l'emplacement par défaut
https://www.malwarebytes.com/mwb-download/
* Installe-le puis configure-le comme indiqué : <<< ICI >>>
* si tu n'as rien modifié fais directement quitter sinon enregistrer
* Lance Malwarebytes' Anti-Malware
Si MBAM est déjà installé, aller directement à la mise à jour puis à l'analyse.

==> Ce logiciel gratuit est à garder.
* Fais la mise à jour
* Clique dans l'onglet "Recherche"
* Coche l'option "Exécuter un examen complet" puis sur le bouton "Rechercher"
* Choisis de scanner tous tes disques durs, puis clique sur 'Lancer l'examen"

A la fin de l'analyse, si MBAM n'a rien trouvé :

* Clique sur OK, le rapport s'ouvre spontanément

Si des menaces ont été détectées :

* Clique sur OK puis "Afficher les résultats"
*Vérifie que toutes les lignes sont cochées
* Choisis l'option "Supprimer la sélection"
* Si MBAM demande le redémarrage de Windows : Clique sur "Oui"
* Le rapport s'ouvre automatiquement après la suppression, il se trouve aussi dans l'onglet "Rapports/Logs"

* Copie/colle le rapport dans le prochain message

Remarque :
- S'il y'a un problème de mise à jour de mbam, tu peux la faire manuellement en téléchargeant ce fichier puis en l'exécutant.

A demain

Bonne nuit

Je lance ça cette nuit

A demain

Merci toi aussi :)

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.05.26.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Flavien :: PC-DE-HP [administrateur]

26/05/2012 23:34:37
mbam-log-2012-05-26 (23-34-37).txt

Type d'examen: Examen complet
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 399779
Temps écoulé: 2 heure(s), 15 minute(s), 29 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\_OTM\MovedFiles\05262012_222503\c_users\Flavien\AppData\Roaming\ml1isssd.exe (Spyware.Zbot.ES) -> Mis en quarantaine et supprimé avec succès.

(fin)

Je supprime et relance mon ordi là

C'est fini?

Tu pourras m'aider à désinstaller tout ce qu'on a utilisé après stp?

Parce que y a des programmes qui ne sont pas dans le panneau de config

Merci :)

Salut,

Lance ZHPDiag depuis le bureau et prépare stp un nouveau

rapport ZHPDiag (à héberger)

@+

Tiens:

http://pjjoint.malekal.com/files.php?id=20120527_j15l6w14u13n5

Re,

Tu n'as pas hébergé tous le rapport, héberle de nouveau stp! merci

@+