Virus ZeroAccess me résiste ... help

bonjour

Télécharge Reload_TDSSKiller sur le bureau
https://forum.malekal.com/viewtopic.php?t=28637&start=

Lance le

choisis : lancer le nettoyage

TDSSKiller va s'ouvrir , clique sur "Start Scan"

Si TDSS.tdl2 est détecté l''option delete sera cochée par défaut.
Si TDSS.tdl3 est détecté assure toi que Cure est bien cochée.
Si TDSS.tdl4(\HardDisk0\MBR) est détecté assure toi que Cure est bien cochée.
Si Suspicious file est indiqué, laisse l''option cochée sur Skip
Si Rootkit.Win32.ZAccess.* est détecté règle sur "cure" en haut , et "delete" en bas

une fois qu'il a terminé , redemarre s'il te le demande pour finir de nettoyer

sinon , ferme tdssKiller et le rapport s'affichera sur le bureau

Copie/Colle son contenu dans ta prochaine réponse.

Merci pour ta réponse rapide.

TDSSKiller n'a pas détecté de menace.

1)

poste le rapport stp (copier coller ici)

2)

Attention : cet outil peut etre détecté à tort comme virus

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail.

Désactive toutes tes protections si possible , antivirus , sandbox , etc....

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe
https://toolslib.net

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider
Clique sur Parcourir et cherche le fichier ci-dessus.

Clique sur Ouvrir.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

si ton bureau ne reapparait pas => ctrl+alt+supp , gestionnaire des taches => onglet fichier => nouvelle tache puis tape explorer

21:39:23.0979 4556 TDSS rootkit removing tool 2.7.45.0 Jul 9 2012 12:46:35
21:39:24.0088 4556 ============================================================
21:39:24.0088 4556 Current date / time: 2012/07/16 21:39:24.0088
21:39:24.0088 4556 SystemInfo:
21:39:24.0088 4556
21:39:24.0088 4556 OS Version: 6.1.7601 ServicePack: 1.0
21:39:24.0088 4556 Product type: Workstation
21:39:24.0088 4556 ComputerName: FAMILLE-PC
21:39:24.0088 4556 UserName: Famille
21:39:24.0088 4556 Windows directory: C:\Windows
21:39:24.0088 4556 System windows directory: C:\Windows
21:39:24.0088 4556 Running under WOW64
21:39:24.0088 4556 Processor architecture: Intel x64
21:39:24.0088 4556 Number of processors: 4
21:39:24.0088 4556 Page size: 0x1000
21:39:24.0088 4556 Boot type: Normal boot
21:39:24.0088 4556 ============================================================
21:39:25.0430 4556 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:39:25.0446 4556 ============================================================
21:39:25.0446 4556 \Device\Harddisk0\DR0:
21:39:25.0446 4556 MBR partitions:
21:39:25.0446 4556 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
21:39:25.0446 4556 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800
21:39:25.0446 4556 ============================================================
21:39:25.0492 4556 C: <-> \Device\Harddisk0\DR0\Partition1
21:39:25.0492 4556 ============================================================
21:39:25.0492 4556 Initialize success
21:39:25.0492 4556 ============================================================
21:39:36.0646 3056 ============================================================
21:39:36.0646 3056 Scan started
21:39:36.0646 3056 Mode: Manual; SigCheck; TDLFS;
21:39:36.0646 3056 ============================================================
21:39:37.0723 3056 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\DRIVERS\1394ohci.sys
21:39:37.0863 3056 1394ohci - ok
21:39:38.0050 3056 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
21:39:38.0066 3056 ACPI - ok
21:39:38.0113 3056 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
21:39:38.0238 3056 AcpiPmi - ok
21:39:38.0768 3056 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:39:38.0784 3056 AdobeARMservice - ok
21:39:39.0002 3056 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:39:39.0018 3056 AdobeFlashPlayerUpdateSvc - ok
21:39:39.0142 3056 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
21:39:39.0158 3056 adp94xx - ok
21:39:39.0220 3056 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
21:39:39.0236 3056 adpahci - ok
21:39:39.0267 3056 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
21:39:39.0283 3056 adpu320 - ok
21:39:39.0361 3056 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
21:39:39.0595 3056 AeLookupSvc - ok
21:39:39.0735 3056 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
21:39:39.0782 3056 AFD - ok
21:39:39.0876 3056 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
21:39:39.0891 3056 agp440 - ok
21:39:39.0922 3056 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
21:39:40.0032 3056 ALG - ok
21:39:40.0063 3056 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
21:39:40.0078 3056 aliide - ok
21:39:40.0172 3056 AMD External Events Utility (9c616ba191b80f5cd1a1b9553e107100) C:\Windows\system32\atiesrxx.exe
21:39:40.0281 3056 AMD External Events Utility - ok
21:39:40.0422 3056 AMD FUEL Service - ok
21:39:40.0437 3056 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
21:39:40.0453 3056 amdide - ok
21:39:40.0562 3056 amdiox64 (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
21:39:40.0578 3056 amdiox64 - ok
21:39:40.0702 3056 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
21:39:40.0780 3056 AmdK8 - ok
21:39:41.0233 3056 amdkmdag (5165e83751b8ff40e5e4925996fcc506) C:\Windows\system32\DRIVERS\atikmdag.sys
21:39:41.0451 3056 amdkmdag - ok
21:39:41.0794 3056 amdkmdap (86ab3cf484260c4318f3a6e8b035f422) C:\Windows\system32\DRIVERS\atikmpag.sys
21:39:41.0826 3056 amdkmdap - ok
21:39:41.0919 3056 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
21:39:41.0982 3056 AmdPPM - ok
21:39:42.0091 3056 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
21:39:42.0106 3056 amdsata - ok
21:39:42.0138 3056 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
21:39:42.0153 3056 amdsbs - ok
21:39:42.0169 3056 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
21:39:42.0184 3056 amdxata - ok
21:39:42.0418 3056 AODDriver4.01 (5b25d1a753cc3a3edb909bb759ac1098) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
21:39:42.0434 3056 AODDriver4.01 - ok
21:39:42.0512 3056 AODDriver4.1 (5b25d1a753cc3a3edb909bb759ac1098) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
21:39:42.0528 3056 AODDriver4.1 - ok
21:39:42.0621 3056 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
21:39:42.0668 3056 AppID - ok
21:39:42.0699 3056 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
21:39:42.0777 3056 AppIDSvc - ok
21:39:42.0855 3056 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
21:39:42.0886 3056 Appinfo - ok
21:39:43.0058 3056 Apple Mobile Device (f401929ee0cc92bfe7f15161ca535383) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:39:43.0074 3056 Apple Mobile Device - ok
21:39:43.0167 3056 AppMgmt (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
21:39:43.0198 3056 AppMgmt - ok
21:39:43.0230 3056 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
21:39:43.0245 3056 arc - ok
21:39:43.0276 3056 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
21:39:43.0292 3056 arcsas - ok
21:39:43.0323 3056 ASAPIW2k - ok
21:39:43.0401 3056 ASDR (4b720cc508b4fb999a7bf0e6d84f73e1) C:\Windows\SysWOW64\ASDR.exe
21:39:43.0448 3056 ASDR ( UnsignedFile.Multi.Generic ) - warning
21:39:43.0448 3056 ASDR - detected UnsignedFile.Multi.Generic (1)
21:39:43.0479 3056 asusgsb (a4398a8914c32f18ec2ab562cba3caaf) C:\Windows\system32\drivers\asusgsb.sys
21:39:43.0495 3056 asusgsb - ok
21:39:43.0542 3056 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
21:39:43.0604 3056 AsyncMac - ok
21:39:43.0651 3056 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
21:39:43.0666 3056 atapi - ok
21:39:43.0822 3056 AtiHDAudioService (24464b908e143d2561e9e452fee97309) C:\Windows\system32\drivers\AtihdW76.sys
21:39:43.0838 3056 AtiHDAudioService - ok
21:39:43.0900 3056 AtiPcie (e82e61f46d1336447f4deff8c074f13e) C:\Windows\system32\DRIVERS\AtiPcie64.sys
21:39:43.0900 3056 AtiPcie - ok
21:39:44.0025 3056 atkdisplf (fb4187c282cb467e5e606913a1fa79a3) C:\Windows\system32\drivers\ATKDispLowFilter.sys
21:39:44.0072 3056 atkdisplf - ok
21:39:44.0088 3056 ATKFUSService (86d873fd396fa6708a99a1bdf104d120) C:\Windows\system32\ATKFUSService.exe
21:39:44.0119 3056 ATKFUSService ( UnsignedFile.Multi.Generic ) - warning
21:39:44.0119 3056 ATKFUSService - detected UnsignedFile.Multi.Generic (1)
21:39:44.0306 3056 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:39:44.0368 3056 AudioEndpointBuilder - ok
21:39:44.0384 3056 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
21:39:44.0415 3056 AudioSrv - ok
21:39:44.0540 3056 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
21:39:44.0634 3056 AxInstSV - ok
21:39:44.0774 3056 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
21:39:44.0821 3056 b06bdrv - ok
21:39:44.0914 3056 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
21:39:44.0977 3056 b57nd60a - ok
21:39:45.0022 3056 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
21:39:45.0052 3056 BDESVC - ok
21:39:45.0152 3056 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
21:39:45.0232 3056 Beep - ok
21:39:45.0362 3056 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
21:39:45.0432 3056 BITS - ok
21:39:45.0502 3056 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
21:39:45.0522 3056 blbdrive - ok
21:39:45.0672 3056 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
21:39:45.0682 3056 Bonjour Service - ok
21:39:45.0752 3056 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
21:39:45.0772 3056 bowser - ok
21:39:45.0792 3056 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:39:45.0822 3056 BrFiltLo - ok
21:39:45.0832 3056 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:39:45.0842 3056 BrFiltUp - ok
21:39:45.0912 3056 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
21:39:45.0992 3056 Browser - ok
21:39:46.0082 3056 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
21:39:46.0142 3056 Brserid - ok
21:39:46.0182 3056 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
21:39:46.0192 3056 BrSerWdm - ok
21:39:46.0202 3056 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
21:39:46.0252 3056 BrUsbMdm - ok
21:39:46.0312 3056 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
21:39:46.0342 3056 BrUsbSer - ok
21:39:46.0362 3056 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
21:39:46.0392 3056 BTHMODEM - ok
21:39:46.0422 3056 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
21:39:46.0452 3056 bthserv - ok
21:39:46.0492 3056 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
21:39:46.0542 3056 cdfs - ok
21:39:46.0602 3056 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
21:39:46.0642 3056 cdrom - ok
21:39:46.0702 3056 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:39:46.0782 3056 CertPropSvc - ok
21:39:46.0792 3056 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
21:39:46.0852 3056 circlass - ok
21:39:46.0902 3056 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
21:39:46.0922 3056 CLFS - ok
21:39:46.0992 3056 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:39:47.0002 3056 clr_optimization_v2.0.50727_32 - ok
21:39:47.0065 3056 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:39:47.0080 3056 clr_optimization_v2.0.50727_64 - ok
21:39:47.0158 3056 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:39:47.0174 3056 clr_optimization_v4.0.30319_32 - ok
21:39:47.0205 3056 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:39:47.0221 3056 clr_optimization_v4.0.30319_64 - ok
21:39:47.0252 3056 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
21:39:47.0283 3056 CmBatt - ok
21:39:47.0314 3056 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
21:39:47.0330 3056 cmdide - ok
21:39:47.0392 3056 CNG (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
21:39:47.0439 3056 CNG - ok
21:39:47.0470 3056 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
21:39:47.0470 3056 Compbatt - ok
21:39:47.0517 3056 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
21:39:47.0548 3056 CompositeBus - ok
21:39:47.0548 3056 COMSysApp - ok
21:39:47.0564 3056 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
21:39:47.0580 3056 crcdisk - ok
21:39:47.0689 3056 CryptSvc (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
21:39:47.0704 3056 CryptSvc - ok
21:39:47.0767 3056 CrystalSysInfo - ok
21:39:47.0829 3056 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
21:39:47.0876 3056 CSC - ok
21:39:47.0923 3056 CscService (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
21:39:47.0954 3056 CscService - ok
21:39:48.0032 3056 dc3d (1ca90212a99db6975c344826d11055c9) C:\Windows\system32\DRIVERS\dc3d.sys
21:39:48.0032 3056 dc3d - ok
21:39:48.0172 3056 DCamUSBVM (d00a4fe22216265783a08a05d268b902) C:\Windows\system32\Drivers\usbVM31b.sys
21:39:48.0204 3056 DCamUSBVM - ok
21:39:48.0297 3056 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:39:48.0344 3056 DcomLaunch - ok
21:39:48.0438 3056 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
21:39:48.0500 3056 defragsvc - ok
21:39:48.0578 3056 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
21:39:48.0625 3056 DfsC - ok
21:39:48.0687 3056 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
21:39:48.0734 3056 Dhcp - ok
21:39:48.0765 3056 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
21:39:48.0812 3056 discache - ok
21:39:48.0890 3056 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
21:39:48.0921 3056 Disk - ok
21:39:49.0108 3056 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
21:39:49.0140 3056 Dnscache - ok
21:39:49.0264 3056 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
21:39:49.0327 3056 dot3svc - ok
21:39:49.0374 3056 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
21:39:49.0420 3056 DPS - ok
21:39:49.0483 3056 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
21:39:49.0514 3056 drmkaud - ok
21:39:49.0608 3056 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
21:39:49.0639 3056 DXGKrnl - ok
21:39:49.0686 3056 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
21:39:49.0732 3056 EapHost - ok
21:39:50.0044 3056 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
21:39:50.0154 3056 ebdrv - ok
21:39:50.0310 3056 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
21:39:50.0356 3056 EFS - ok
21:39:50.0481 3056 EIO64 (343ada10d948db29251f2d9c809af204) C:\Windows\system32\DRIVERS\EIO64.sys
21:39:50.0497 3056 EIO64 - ok
21:39:50.0700 3056 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
21:39:50.0715 3056 elxstor - ok
21:39:50.0762 3056 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
21:39:50.0793 3056 ErrDev - ok
21:39:50.0824 3056 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
21:39:50.0871 3056 EventSystem - ok
21:39:50.0887 3056 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
21:39:50.0949 3056 exfat - ok
21:39:50.0965 3056 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
21:39:51.0027 3056 fastfat - ok
21:39:51.0105 3056 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
21:39:51.0183 3056 Fax - ok
21:39:51.0199 3056 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
21:39:51.0230 3056 fdc - ok
21:39:51.0261 3056 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
21:39:51.0308 3056 fdPHost - ok
21:39:51.0339 3056 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
21:39:51.0386 3056 FDResPub - ok
21:39:51.0402 3056 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
21:39:51.0417 3056 FileInfo - ok
21:39:51.0433 3056 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
21:39:51.0480 3056 Filetrace - ok
21:39:51.0495 3056 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
21:39:51.0511 3056 flpydisk - ok
21:39:51.0542 3056 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
21:39:51.0573 3056 FltMgr - ok
21:39:51.0636 3056 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
21:39:51.0698 3056 FontCache - ok
21:39:51.0807 3056 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:39:51.0807 3056 FontCache3.0.0.0 - ok
21:39:51.0854 3056 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
21:39:51.0854 3056 FsDepends - ok
21:39:51.0885 3056 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
21:39:51.0901 3056 Fs_Rec - ok
21:39:51.0916 3056 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
21:39:51.0948 3056 fvevol - ok
21:39:51.0994 3056 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
21:39:52.0010 3056 gagp30kx - ok
21:39:52.0072 3056 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
21:39:52.0088 3056 GEARAspiWDM - ok
21:39:52.0166 3056 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
21:39:52.0244 3056 gpsvc - ok
21:39:52.0384 3056 gusvc (c1b577b2169900f4cf7190c39f085794) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
21:39:52.0400 3056 gusvc - ok
21:39:52.0431 3056 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
21:39:52.0478 3056 hcw85cir - ok
21:39:52.0572 3056 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
21:39:52.0603 3056 HdAudAddService - ok
21:39:52.0665 3056 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
21:39:52.0712 3056 HDAudBus - ok
21:39:52.0743 3056 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
21:39:52.0774 3056 HidBatt - ok
21:39:52.0790 3056 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
21:39:52.0837 3056 HidBth - ok
21:39:52.0852 3056 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
21:39:52.0868 3056 HidIr - ok
21:39:52.0899 3056 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
21:39:52.0946 3056 hidserv - ok
21:39:53.0040 3056 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
21:39:53.0040 3056 HidUsb - ok
21:39:53.0086 3056 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
21:39:53.0164 3056 hkmsvc - ok
21:39:53.0242 3056 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
21:39:53.0289 3056 HomeGroupListener - ok
21:39:53.0336 3056 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
21:39:53.0383 3056 HomeGroupProvider - ok
21:39:53.0445 3056 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
21:39:53.0461 3056 HpSAMD - ok
21:39:53.0570 3056 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
21:39:53.0648 3056 HTTP - ok
21:39:53.0695 3056 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
21:39:53.0710 3056 hwpolicy - ok
21:39:53.0851 3056 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
21:39:53.0866 3056 i8042prt - ok
21:39:53.0960 3056 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
21:39:53.0976 3056 iaStorV - ok
21:39:54.0194 3056 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
21:39:54.0210 3056 IDriverT ( UnsignedFile.Multi.Generic ) - warning
21:39:54.0210 3056 IDriverT - detected UnsignedFile.Multi.Generic (1)
21:39:54.0334 3056 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:39:54.0366 3056 idsvc - ok
21:39:54.0522 3056 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
21:39:54.0537 3056 iirsp - ok
21:39:54.0678 3056 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
21:39:54.0740 3056 IKEEXT - ok
21:39:54.0990 3056 IntcAzAudAddService (eb5fa493a4b6ea290200ae39eba2fbc6) C:\Windows\system32\drivers\RTKVHD64.sys
21:39:55.0068 3056 IntcAzAudAddService - ok
21:39:55.0161 3056 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
21:39:55.0161 3056 intelide - ok
21:39:55.0208 3056 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
21:39:55.0239 3056 intelppm - ok
21:39:55.0270 3056 IOMap (a01c412699b6f21645b2885c2bae4454) C:\Windows\system32\drivers\IOMap64.sys
21:39:55.0286 3056 IOMap - ok
21:39:55.0317 3056 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
21:39:55.0380 3056 IPBusEnum - ok
21:39:55.0411 3056 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:39:55.0458 3056 IpFilterDriver - ok
21:39:55.0489 3056 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
21:39:55.0520 3056 IPMIDRV - ok
21:39:55.0551 3056 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
21:39:55.0582 3056 IPNAT - ok
21:39:55.0754 3056 iPod Service (a9ab99ee7d39725eafec82732d2b3271) C:\Program Files\iPod\bin\iPodService.exe
21:39:55.0785 3056 iPod Service - ok
21:39:55.0801 3056 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
21:39:55.0863 3056 IRENUM - ok
21:39:55.0879 3056 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
21:39:55.0910 3056 isapnp - ok
21:39:55.0957 3056 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
21:39:55.0972 3056 iScsiPrt - ok
21:39:56.0004 3056 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
21:39:56.0019 3056 kbdclass - ok
21:39:56.0066 3056 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
21:39:56.0082 3056 kbdhid - ok
21:39:56.0175 3056 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:39:56.0191 3056 KeyIso - ok
21:39:56.0206 3056 KSecDD (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
21:39:56.0222 3056 KSecDD - ok
21:39:56.0269 3056 KSecPkg (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
21:39:56.0284 3056 KSecPkg - ok
21:39:56.0316 3056 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
21:39:56.0362 3056 ksthunk - ok
21:39:56.0425 3056 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
21:39:56.0487 3056 KtmRm - ok
21:39:56.0550 3056 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
21:39:56.0596 3056 LanmanServer - ok
21:39:56.0659 3056 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
21:39:56.0721 3056 LanmanWorkstation - ok
21:39:56.0799 3056 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
21:39:56.0846 3056 lltdio - ok
21:39:56.0924 3056 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
21:39:56.0955 3056 lltdsvc - ok
21:39:56.0955 3056 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
21:39:57.0002 3056 lmhosts - ok
21:39:57.0096 3056 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
21:39:57.0096 3056 LSI_FC - ok
21:39:57.0174 3056 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
21:39:57.0189 3056 LSI_SAS - ok
21:39:57.0189 3056 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:39:57.0205 3056 LSI_SAS2 - ok
21:39:57.0283 3056 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:39:57.0298 3056 LSI_SCSI - ok
21:39:57.0391 3056 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
21:39:57.0441 3056 luafv - ok
21:39:57.0451 3056 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
21:39:57.0461 3056 megasas - ok
21:39:57.0491 3056 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
21:39:57.0521 3056 MegaSR - ok
21:39:57.0601 3056 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:39:57.0651 3056 MMCSS - ok
21:39:57.0671 3056 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
21:39:57.0711 3056 Modem - ok
21:39:57.0771 3056 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
21:39:57.0811 3056 monitor - ok
21:39:57.0911 3056 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
21:39:57.0921 3056 mouclass - ok
21:39:57.0961 3056 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
21:39:57.0991 3056 mouhid - ok
21:39:58.0041 3056 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
21:39:58.0051 3056 mountmgr - ok
21:39:58.0271 3056 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:39:58.0291 3056 MozillaMaintenance - ok
21:39:58.0341 3056 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
21:39:58.0351 3056 mpio - ok
21:39:58.0371 3056 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
21:39:58.0411 3056 mpsdrv - ok
21:39:58.0441 3056 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
21:39:58.0471 3056 MRxDAV - ok
21:39:58.0521 3056 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
21:39:58.0551 3056 mrxsmb - ok
21:39:58.0601 3056 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:39:58.0611 3056 mrxsmb10 - ok
21:39:58.0661 3056 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:39:58.0671 3056 mrxsmb20 - ok
21:39:58.0711 3056 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
21:39:58.0721 3056 msahci - ok
21:39:58.0801 3056 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
21:39:58.0811 3056 msdsm - ok
21:39:58.0861 3056 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
21:39:58.0901 3056 MSDTC - ok
21:39:58.0941 3056 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
21:39:58.0971 3056 Msfs - ok
21:39:59.0001 3056 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
21:39:59.0051 3056 mshidkmdf - ok
21:39:59.0061 3056 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
21:39:59.0071 3056 msisadrv - ok
21:39:59.0161 3056 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
21:39:59.0231 3056 MSiSCSI - ok
21:39:59.0231 3056 msiserver - ok
21:39:59.0291 3056 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
21:39:59.0331 3056 MSKSSRV - ok
21:39:59.0341 3056 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
21:39:59.0391 3056 MSPCLOCK - ok
21:39:59.0401 3056 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
21:39:59.0448 3056 MSPQM - ok
21:39:59.0494 3056 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
21:39:59.0510 3056 MsRPC - ok
21:39:59.0541 3056 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
21:39:59.0541 3056 mssmbios - ok
21:39:59.0572 3056 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
21:39:59.0619 3056 MSTEE - ok
21:39:59.0650 3056 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
21:39:59.0682 3056 MTConfig - ok
21:39:59.0728 3056 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
21:39:59.0744 3056 Mup - ok
21:39:59.0775 3056 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
21:39:59.0838 3056 napagent - ok
21:39:59.0900 3056 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
21:39:59.0931 3056 NativeWifiP - ok
21:40:00.0056 3056 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
21:40:00.0087 3056 NDIS - ok
21:40:00.0118 3056 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
21:40:00.0150 3056 NdisCap - ok
21:40:00.0196 3056 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
21:40:00.0243 3056 NdisTapi - ok
21:40:00.0306 3056 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
21:40:00.0352 3056 Ndisuio - ok
21:40:00.0384 3056 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
21:40:00.0430 3056 NdisWan - ok
21:40:00.0477 3056 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
21:40:00.0508 3056 NDProxy - ok
21:40:00.0555 3056 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
21:40:00.0602 3056 NetBIOS - ok
21:40:00.0618 3056 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
21:40:00.0680 3056 NetBT - ok
21:40:00.0696 3056 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:40:00.0711 3056 Netlogon - ok
21:40:00.0805 3056 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
21:40:00.0852 3056 Netman - ok
21:40:00.0867 3056 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
21:40:00.0930 3056 netprofm - ok
21:40:01.0023 3056 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:40:01.0039 3056 NetTcpPortSharing - ok
21:40:01.0086 3056 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
21:40:01.0101 3056 nfrd960 - ok
21:40:01.0179 3056 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
21:40:01.0242 3056 NlaSvc - ok
21:40:01.0273 3056 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
21:40:01.0304 3056 Npfs - ok
21:40:01.0335 3056 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
21:40:01.0382 3056 nsi - ok
21:40:01.0413 3056 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
21:40:01.0460 3056 nsiproxy - ok
21:40:01.0585 3056 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
21:40:01.0632 3056 Ntfs - ok
21:40:01.0772 3056 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
21:40:01.0819 3056 Null - ok
21:40:01.0897 3056 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
21:40:01.0912 3056 nvraid - ok
21:40:01.0959 3056 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
21:40:01.0975 3056 nvstor - ok
21:40:01.0990 3056 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
21:40:01.0990 3056 nv_agp - ok
21:40:02.0022 3056 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
21:40:02.0053 3056 ohci1394 - ok
21:40:02.0162 3056 ose (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:40:02.0178 3056 ose - ok
21:40:02.0646 3056 osppsvc (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:40:02.0770 3056 osppsvc - ok
21:40:02.0911 3056 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:40:02.0958 3056 p2pimsvc - ok
21:40:03.0316 3056 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
21:40:03.0348 3056 p2psvc - ok
21:40:03.0410 3056 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
21:40:03.0410 3056 Parport - ok
21:40:03.0441 3056 partmgr (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
21:40:03.0457 3056 partmgr - ok
21:40:03.0488 3056 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
21:40:03.0519 3056 PcaSvc - ok
21:40:03.0550 3056 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
21:40:03.0566 3056 pci - ok
21:40:03.0582 3056 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
21:40:03.0582 3056 pciide - ok
21:40:03.0613 3056 PCLEPCI - ok
21:40:03.0660 3056 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
21:40:03.0706 3056 pcmcia - ok
21:40:03.0722 3056 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
21:40:03.0722 3056 pcw - ok
21:40:03.0800 3056 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
21:40:03.0862 3056 PEAUTH - ok
21:40:03.0925 3056 PeerDistSvc (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
21:40:03.0972 3056 PeerDistSvc - ok
21:40:04.0050 3056 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
21:40:04.0065 3056 PerfHost - ok
21:40:04.0237 3056 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
21:40:04.0299 3056 pla - ok
21:40:04.0362 3056 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
21:40:04.0408 3056 PlugPlay - ok
21:40:04.0440 3056 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
21:40:04.0455 3056 PNRPAutoReg - ok
21:40:04.0518 3056 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
21:40:04.0549 3056 PNRPsvc - ok
21:40:04.0642 3056 Point64 (4f0878fd62d5f7444c5f1c4c66d9d293) C:\Windows\system32\DRIVERS\point64.sys
21:40:04.0642 3056 Point64 - ok
21:40:04.0736 3056 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
21:40:04.0798 3056 PolicyAgent - ok
21:40:04.0830 3056 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
21:40:04.0876 3056 Power - ok
21:40:04.0923 3056 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
21:40:04.0986 3056 PptpMiniport - ok
21:40:05.0001 3056 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
21:40:05.0032 3056 Processor - ok
21:40:05.0064 3056 ProfSvc (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
21:40:05.0095 3056 ProfSvc - ok
21:40:05.0142 3056 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:40:05.0157 3056 ProtectedStorage - ok
21:40:05.0282 3056 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
21:40:05.0329 3056 Psched - ok
21:40:05.0391 3056 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
21:40:05.0422 3056 ql2300 - ok
21:40:05.0563 3056 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
21:40:05.0578 3056 ql40xx - ok
21:40:05.0610 3056 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
21:40:05.0641 3056 QWAVE - ok
21:40:05.0656 3056 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
21:40:05.0672 3056 QWAVEdrv - ok
21:40:05.0703 3056 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
21:40:05.0750 3056 RasAcd - ok
21:40:05.0781 3056 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
21:40:05.0812 3056 RasAgileVpn - ok
21:40:05.0859 3056 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
21:40:05.0906 3056 RasAuto - ok
21:40:05.0984 3056 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
21:40:06.0046 3056 Rasl2tp - ok
21:40:06.0093 3056 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
21:40:06.0140 3056 RasMan - ok
21:40:06.0171 3056 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
21:40:06.0218 3056 RasPppoe - ok
21:40:06.0234 3056 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
21:40:06.0296 3056 RasSstp - ok
21:40:06.0405 3056 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
21:40:06.0452 3056 rdbss - ok
21:40:06.0483 3056 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
21:40:06.0499 3056 rdpbus - ok
21:40:06.0514 3056 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
21:40:06.0546 3056 RDPCDD - ok
21:40:06.0577 3056 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
21:40:06.0608 3056 RDPDR - ok
21:40:06.0670 3056 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
21:40:06.0733 3056 RDPENCDD - ok
21:40:06.0764 3056 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
21:40:06.0795 3056 RDPREFMP - ok
21:40:06.0858 3056 RDPWD (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
21:40:06.0873 3056 RDPWD - ok
21:40:06.0982 3056 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
21:40:06.0998 3056 rdyboost - ok
21:40:07.0076 3056 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
21:40:07.0138 3056 RemoteAccess - ok
21:40:07.0216 3056 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
21:40:07.0263 3056 RemoteRegistry - ok
21:40:07.0341 3056 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
21:40:07.0388 3056 RpcEptMapper - ok
21:40:07.0419 3056 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
21:40:07.0450 3056 RpcLocator - ok
21:40:07.0528 3056 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
21:40:07.0560 3056 RpcSs - ok
21:40:07.0669 3056 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
21:40:07.0700 3056 rspndr - ok
21:40:07.0778 3056 RTL8167 (ee082e06a82ff630351d1e0ebbd3d8d0) C:\Windows\system32\DRIVERS\Rt64win7.sys
21:40:07.0809 3056 RTL8167 - ok
21:40:07.0825 3056 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
21:40:07.0840 3056 s3cap - ok
21:40:07.0887 3056 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:40:07.0903 3056 SamSs - ok
21:40:07.0996 3056 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
21:40:08.0028 3056 sbp2port - ok
21:40:08.0106 3056 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
21:40:08.0168 3056 SCardSvr - ok
21:40:08.0308 3056 SCDEmu (6ce6f98ea3d07a9c2ce3cd0a5a86352d) C:\Windows\system32\drivers\SCDEmu.sys
21:40:08.0324 3056 SCDEmu - ok
21:40:08.0340 3056 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
21:40:08.0386 3056 scfilter - ok
21:40:08.0480 3056 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
21:40:08.0558 3056 Schedule - ok
21:40:08.0574 3056 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
21:40:08.0605 3056 SCPolicySvc - ok
21:40:08.0667 3056 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
21:40:08.0698 3056 SDRSVC - ok
21:40:08.0776 3056 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
21:40:08.0823 3056 secdrv - ok
21:40:08.0870 3056 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
21:40:08.0901 3056 seclogon - ok
21:40:08.0917 3056 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
21:40:08.0964 3056 SENS - ok
21:40:09.0010 3056 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
21:40:09.0026 3056 SensrSvc - ok
21:40:09.0073 3056 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
21:40:09.0120 3056 Serenum - ok
21:40:09.0182 3056 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
21:40:09.0198 3056 Serial - ok
21:40:09.0244 3056 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
21:40:09.0276 3056 sermouse - ok
21:40:09.0322 3056 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
21:40:09.0369 3056 SessionEnv - ok
21:40:09.0400 3056 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
21:40:09.0416 3056 sffdisk - ok
21:40:09.0447 3056 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
21:40:09.0478 3056 sffp_mmc - ok
21:40:09.0525 3056 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
21:40:09.0556 3056 sffp_sd - ok
21:40:09.0572 3056 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
21:40:09.0588 3056 sfloppy - ok
21:40:09.0650 3056 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
21:40:09.0697 3056 ShellHWDetection - ok
21:40:09.0775 3056 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:40:09.0775 3056 SiSRaid2 - ok
21:40:09.0806 3056 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
21:40:09.0806 3056 SiSRaid4 - ok
21:40:09.0900 3056 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
21:40:09.0962 3056 Smb - ok
21:40:10.0040 3056 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
21:40:10.0071 3056 SNMPTRAP - ok
21:40:10.0087 3056 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
21:40:10.0087 3056 spldr - ok
21:40:10.0134 3056 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
21:40:10.0180 3056 Spooler - ok
21:40:10.0539 3056 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
21:40:10.0648 3056 sppsvc - ok
21:40:10.0758 3056 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
21:40:10.0789 3056 sppuinotify - ok
21:40:10.0898 3056 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
21:40:10.0929 3056 srv - ok
21:40:10.0992 3056 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
21:40:11.0038 3056 srv2 - ok
21:40:11.0070 3056 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
21:40:11.0101 3056 srvnet - ok
21:40:11.0210 3056 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
21:40:11.0257 3056 SSDPSRV - ok
21:40:11.0304 3056 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
21:40:11.0335 3056 SstpSvc - ok
21:40:11.0413 3056 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
21:40:11.0428 3056 stexstor - ok
21:40:11.0569 3056 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
21:40:11.0647 3056 stisvc - ok
21:40:11.0694 3056 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
21:40:11.0709 3056 storflt - ok
21:40:11.0756 3056 StorSvc (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
21:40:11.0803 3056 StorSvc - ok
21:40:11.0818 3056 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
21:40:11.0865 3056 storvsc - ok
21:40:11.0928 3056 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
21:40:11.0928 3056 swenum - ok
21:40:12.0084 3056 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
21:40:12.0146 3056 swprv - ok
21:40:12.0349 3056 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
21:40:12.0411 3056 SysMain - ok
21:40:12.0614 3056 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
21:40:12.0661 3056 TabletInputService - ok
21:40:12.0676 3056 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
21:40:12.0754 3056 TapiSrv - ok
21:40:12.0770 3056 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
21:40:12.0801 3056 TBS - ok
21:40:13.0051 3056 Tcpip (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
21:40:13.0098 3056 Tcpip - ok
21:40:13.0332 3056 TCPIP6 (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
21:40:13.0378 3056 TCPIP6 - ok
21:40:13.0519 3056 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
21:40:13.0566 3056 tcpipreg - ok
21:40:13.0597 3056 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
21:40:13.0628 3056 TDPIPE - ok
21:40:13.0659 3056 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
21:40:13.0690 3056 TDTCP - ok
21:40:13.0815 3056 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
21:40:13.0846 3056 tdx - ok
21:40:13.0893 3056 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
21:40:13.0940 3056 TermDD - ok
21:40:14.0190 3056 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
21:40:14.0252 3056 TermService - ok
21:40:14.0377 3056 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
21:40:14.0392 3056 Themes - ok
21:40:14.0502 3056 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
21:40:14.0533 3056 THREADORDER - ok
21:40:14.0611 3056 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
21:40:14.0658 3056 TrkWks - ok
21:40:14.0938 3056 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
21:40:14.0985 3056 TrustedInstaller - ok
21:40:15.0079 3056 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
21:40:15.0126 3056 tssecsrv - ok
21:40:15.0204 3056 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
21:40:15.0235 3056 TsUsbFlt - ok
21:40:15.0453 3056 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
21:40:15.0484 3056 tunnel - ok
21:40:15.0578 3056 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
21:40:15.0594 3056 uagp35 - ok
21:40:15.0718 3056 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
21:40:15.0750 3056 udfs - ok
21:40:15.0812 3056 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
21:40:15.0828 3056 UI0Detect - ok
21:40:15.0906 3056 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
21:40:15.0921 3056 uliagpkx - ok
21:40:15.0984 3056 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
21:40:16.0046 3056 umbus - ok
21:40:16.0062 3056 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
21:40:16.0093 3056 UmPass - ok
21:40:16.0155 3056 UmRdpService (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
21:40:16.0218 3056 UmRdpService - ok
21:40:16.0311 3056 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
21:40:16.0374 3056 upnphost - ok
21:40:16.0483 3056 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
21:40:16.0514 3056 USBAAPL64 ( UnsignedFile.Multi.Generic ) - warning
21:40:16.0514 3056 USBAAPL64 - detected UnsignedFile.Multi.Generic (1)
21:40:16.0545 3056 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
21:40:16.0576 3056 usbccgp - ok
21:40:16.0592 3056 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
21:40:16.0608 3056 usbcir - ok
21:40:16.0639 3056 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
21:40:16.0670 3056 usbehci - ok
21:40:16.0732 3056 usbfilter (76e2ffad301490ba27b947c6507752fb) C:\Windows\system32\DRIVERS\usbfilter.sys
21:40:16.0732 3056 usbfilter - ok
21:40:16.0826 3056 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
21:40:16.0904 3056 usbhub - ok
21:40:16.0935 3056 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
21:40:16.0951 3056 usbohci - ok
21:40:17.0044 3056 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
21:40:17.0060 3056 usbprint - ok
21:40:17.0200 3056 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
21:40:17.0216 3056 usbscan - ok
21:40:17.0263 3056 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:40:17.0294 3056 USBSTOR - ok
21:40:17.0310 3056 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
21:40:17.0372 3056 usbuhci - ok
21:40:17.0434 3056 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
21:40:17.0466 3056 UxSms - ok
21:40:17.0528 3056 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
21:40:17.0544 3056 VaultSvc - ok
21:40:17.0637 3056 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
21:40:17.0653 3056 vdrvroot - ok
21:40:17.0762 3056 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
21:40:17.0824 3056 vds - ok
21:40:17.0887 3056 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
21:40:17.0902 3056 vga - ok
21:40:17.0918 3056 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
21:40:17.0965 3056 VgaSave - ok
21:40:18.0012 3056 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
21:40:18.0043 3056 vhdmp - ok
21:40:18.0074 3056 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
21:40:18.0074 3056 viaide - ok
21:40:18.0090 3056 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
21:40:18.0105 3056 vmbus - ok
21:40:18.0152 3056 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
21:40:18.0246 3056 VMBusHID - ok
21:40:18.0277 3056 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
21:40:18.0292 3056 volmgr - ok
21:40:18.0464 3056 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
21:40:18.0495 3056 volmgrx - ok
21:40:18.0651 3056 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
21:40:18.0667 3056 volsnap - ok
21:40:18.0854 3056 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
21:40:18.0885 3056 vsmraid - ok
21:40:19.0197 3056 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
21:40:19.0306 3056 VSS - ok
21:40:19.0525 3056 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
21:40:19.0556 3056 vwifibus - ok
21:40:19.0618 3056 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
21:40:19.0681 3056 W32Time - ok
21:40:19.0743 3056 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
21:40:19.0774 3056 WacomPen - ok
21:40:19.0930 3056 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:40:19.0962 3056 WANARP - ok
21:40:19.0962 3056 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
21:40:20.0008 3056 Wanarpv6 - ok
21:40:20.0320 3056 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
21:40:20.0367 3056 WatAdminSvc - ok
21:40:20.0539 3056 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
21:40:20.0586 3056 wbengine - ok
21:40:20.0773 3056 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
21:40:20.0788 3056 WbioSrvc - ok
21:40:20.0835 3056 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
21:40:20.0882 3056 wcncsvc - ok
21:40:20.0882 3056 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
21:40:20.0898 3056 WcsPlugInService - ok
21:40:21.0007 3056 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
21:40:21.0022 3056 Wd - ok
21:40:21.0069 3056 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
21:40:21.0085 3056 Wdf01000 - ok
21:40:21.0132 3056 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:40:21.0412 3056 WdiServiceHost - ok
21:40:21.0412 3056 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
21:40:21.0428 3056 WdiSystemHost - ok
21:40:21.0475 3056 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
21:40:21.0506 3056 WebClient - ok
21:40:21.0553 3056 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
21:40:21.0615 3056 Wecsvc - ok
21:40:21.0662 3056 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
21:40:21.0709 3056 wercplsupport - ok
21:40:21.0787 3056 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
21:40:21.0849 3056 WerSvc - ok
21:40:21.0912 3056 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
21:40:21.0943 3056 WfpLwf - ok
21:40:21.0958 3056 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
21:40:21.0958 3056 WIMMount - ok
21:40:21.0974 3056 WinHttpAutoProxySvc - ok
21:40:22.0068 3056 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
21:40:22.0114 3056 Winmgmt - ok
21:40:22.0333 3056 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
21:40:22.0426 3056 WinRM - ok
21:40:22.0738 3056 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
21:40:22.0754 3056 WinUsb - ok
21:40:22.0801 3056 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
21:40:22.0863 3056 Wlansvc - ok
21:40:22.0879 3056 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
21:40:22.0910 3056 WmiAcpi - ok
21:40:22.0972 3056 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
21:40:23.0019 3056 wmiApSrv - ok
21:40:23.0097 3056 WMPNetworkSvc - ok
21:40:23.0300 3056 WMZuneComm (83b6ca03c846fcd47f9883d77d1eb27b) C:\Program Files\Zune\WMZuneComm.exe
21:40:23.0316 3056 WMZuneComm - ok
21:40:23.0347 3056 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
21:40:23.0362 3056 WPCSvc - ok
21:40:23.0394 3056 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
21:40:23.0472 3056 WPDBusEnum - ok
21:40:23.0503 3056 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
21:40:23.0534 3056 ws2ifsl - ok
21:40:23.0534 3056 WSearch - ok
21:40:23.0752 3056 wuauserv (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
21:40:23.0815 3056 wuauserv - ok
21:40:23.0986 3056 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
21:40:24.0033 3056 WudfPf - ok
21:40:24.0189 3056 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
21:40:24.0252 3056 WUDFRd - ok
21:40:24.0314 3056 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
21:

Désolé pour la longueur du rapport.
Pour le prochain je mets un lien ...

Winlogon en cours

Winlogon : https://pjjoint.malekal.com/files.php?id=20120716_10q14u10c14f7

tdss
https://pjjoint.malekal.com/files.php?id=20120716_i12r8b10g6w15

hummm

Attention, avant de commencer, lit attentivement la procédure, et imprime la

Aide à l'utilisation
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Télécharge ComboFix de sUBs que tu renommes gwena.exe avant de l'enregistrer sur ton Bureau :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et <gras>DESACTIVES TOUTES LES DEFENSES, antivirus et antispyware y compris /!\ </gras>

---> Double-clique sur ComboFix.exe
Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
(si il te propose de l'installer remets internet)

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

CONTRIBUTEUR SECURITE

En désinfection, c'est la fin le plus important !
"Restez" jusqu'au bout...merci

ComboFix a l'air d'avoir trouvé et supprimé les fichiers !

https://pjjoint.malekal.com/files.php?id=20120716_m6v7l8k9k8

oui

il y avait un rootkit en + !

on regarde le reste du pc

Télécharge ZHPDiag ( de Nicolas coolman ).
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html


(outil de diagnostic)

Double clique sur le fichier d'installation, puis installe le avec les paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista/Seven )

Clique sur la loupe en haut à gauche, puis laisse l'outil scanner.

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

ok

1)

Copie tout le texte présent en gras ci-dessous (tu le selectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )



EMPTYTEMP
EMPTYFLASH
[HKCU\Software\AppDataLow\Software\PriceGong] => Infection BT (Adware.PriceGong)
[HKCU\Software\Grand Virtual] => Infection PUP (PUP.GrandVirtual)
C:\Users\Famille\AppData\LocalLow\PriceGong
M2 - MFEP: prefs.js [Famille - b3phzehw.default\{05eeb91a-aef7-4f8a-978f-fb83e7b03f8e}] [] uTorrentBar_FR Community Toolbar v3.13.0.6 (.Conduit Ltd..) => Toolbar.Conduit
[HKCU\Software\AppDataLow\Software\Conduit] => Toolbar.Conduit
O43 - CFD: 26/12/2011 - 16:56:57 - [0,609] ----D C:\Program Files (x86)\Conduit => Toolbar.Conduit
O43 - CFD: 24/04/2012 - 15:49:20 - [0] ----D C:\Users\Famille\AppData\Local\Conduit => Toolbar.Conduit
O43 - CFD: 26/12/2011 - 16:56:57 - [0,609] ----D C:\Program Files (x86)\Conduit => Toolbar.Conduit
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639..clientLogIsEnabled", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ALLOW_SHOWING_HIDDEN_TOOLBAR", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.CTID", "CT2851639"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.CurrentServerDate", "16-7-2012"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.DSInstall", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.DialogsAlignMode", "LTR"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.DialogsGetterLastCheckTime", "Sun Jul 15 2012 21:44:46 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.DownloadReferralCookieData", ""); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.EMailNotifierPollDate", "Mon Dec 26 2011 15:57:02 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedLastCount2548968607390276962", 158); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156812186649977", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813040823546", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813130095866", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813224203613", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813230837251", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813454291735", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813729834876", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156813860870021", "Mon Dec 26 2011 15:57:04 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156814264681793", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156814863075366", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedPollDate2429156815257761081", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedTTL2429156813040823546", 15); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedTTL2429156813130095866", 10); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedTTL2429156813454291735", 5); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FeedTTL2429156814264681793", 5); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FirstServerDate", "26-12-2011"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FirstTime", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FirstTimeFF3", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.FixPageNotFoundErrors", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.GroupingServerCheckInterval", 1440); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.HPInstall", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.HasUserGlobalKeys", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.Initialize", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.InitializeCommonPrefs", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.InstallationAndCookieDataSentCount", 3); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.InstalledDate", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.IsGrouping", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.IsInitSetupIni", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.IsMulticommunity", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.IsOpenThankYouPage", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.IsOpenUninstallPage", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LanguagePackLastCheckTime", "Sun Jul 15 2012 21:44:46 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LanguagePackReloadIntervalMM", 1440); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LastLogin_3.12.0.7", "Wed Apr 25 2012 18:12:59 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LastLogin_3.12.2.3", "Thu May 31 2012 17:48:35 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LastLogin_3.13.0.6", "Mon Jul 16 2012 21:07:29 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LastLogin_3.8.1.0", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.LatestVersion", "3.13.0.6"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.Locale", "fr"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.MCDetectTooltipHeight", "83"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.MCDetectTooltipUrl", "http://@EB_INSTALL_LINK@/rank/tooltip/?version=1"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.MCDetectTooltipWidth", "295"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.MyStuffEnabledAtInstallation", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.OriginalFirstVersion", "3.8.1.0"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SearchFromAddressBarIsInit", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SearchInNewTabEnabled", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SearchInNewTabIntervalMM", 1440); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SearchInNewTabLastCheckTime", "Sun Jul 15 2012 21:44:46 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SendProtectorDataViaLogin", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ServiceMapLastCheckTime", "Mon Jul 16 2012 22:33:22 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SettingsLastCheckTime", "Mon Jul 16 2012 21:07:28 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.SettingsLastUpdate", "1340630740"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ThirdPartyComponentsInterval", 504); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ThirdPartyComponentsLastCheck", "Mon Dec 26 2011 15:57:01 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ThirdPartyComponentsLastUpdate", "1255344667"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.ToolbarShrinkedFromSetup", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.UserID", "UN54601201705498962"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.WeatherNetwork", ""); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.WeatherPollDate", "Mon Dec 26 2011 15:57:04 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.WeatherUnit", "C"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.alertChannelId", "1243674"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.autoDisableScopes", -1); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.backendstorage.cbfirsttime", "4D6F6E2044656320323620323031312031353A35373A303520474D542B30313030"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.backendstorage.scriptsource", "687474703A2F2F3132372E302E302E313A31303030302F6775692F"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.components.1000034", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.components.129351529700900053", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.components.129422840102831305", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.globalFirstTimeInfoLastCheckTime", "Mon Dec 26 2011 15:57:02 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.homepageProtectorEnableByLogin", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.initDone", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.isAppTrackingManagerOn", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.myStuffEnabled", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.myStuffPublihserMinWidth", 400); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.myStuffServiceIntervalMM", 1440); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.revertSettingsEnabled", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.searchProtectorDialogDelayInSec", 10); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.searchProtectorEnableByLogin", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.testingCtid", ""); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.toolbarAppMetaDataLastCheckTime", "Sun Jul 15 2012 21:44:46 GMT+0200"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.toolbarContextMenuLastCheckTime", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CT2851639.usagesFlag", 2); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.ETag.http://servicemap.conduit-services.com/Toolbar/?ownerId=CT2851639", "\"5a3bfb736bf65ca0cca630a3f0[...] => Toolbar.Conduit
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.8.1.0"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", ""); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.ToolbarsList", "CT2851639"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.ToolbarsList2", "CT2851639"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.ToolbarsList4", "CT2851639"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Dec 26 2011 15:57:04 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.globalUserId", "fb0fac90-c648-4f78-ad49-e4b966be5d9f"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2851639"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Mon Dec 26 2011 15:57:03 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.alertInfoInterval", 60); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Mon Dec 26 2011 15:57:11 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.locale", "en"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Mon Dec 26 2011 15:57:02 GMT+0100"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.showTrayIcon", false); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.notifications.userId", "f4ac1883-070f-49c8-a427-bf6b9123ee4f"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.originalHomepage", "chrome://branding/locale/browserconfig.properties"); => Toolbar.Agent
O69 - SBI: prefs.js [Famille - b3phzehw.default] user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties"); => Toolbar.Agent
[HKLM\Software\Classes\Toolbar.CT2851639] => Toolbar.Agent
C:\Program Files (x86)\Conduit => Toolbar.Conduit
C:\Users\Famille\AppData\Local\Conduit => Toolbar.Conduit
C:\Users\Famille\AppData\LocalLow\Conduit
O2 - BHO: AMD SteadyVideo BHO [64Bits] - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} Clé orpheline => Orphean Key not necessary
O41 - Driver: (PCLEPCI) . (. - .) - C:\Windows\system32\drivers\pclepci.sys (.not file.) => Fichier absent
O42 - Logiciel: Everest Poker.fr (Remove Only) - (.Pas de propriétaire.) [HKLM] -- Everest Poker.fr => Everest Poker.net
O43 - CFD: 15/07/2012 - 21:36:39 - [28,283] ----D C:\Program Files (x86)\Everest Poker.fr => Online Game
O43 - CFD: 15/07/2012 - 21:36:39 - [28,283] ----D C:\Program Files (x86)\Everest Poker.fr



Puis Lance ZHPFix depuis le raccourci du bureau . (Clique droit -> Executer en tant qu'admin pour Vista ou Seven)

* Une fois l'outil ZHPFix ouvert ,

- Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)
- Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes
- Clique sur le bouton « GO » pour lancer le nettoyage,
- Copie/colle la totalité du rapport dans ta prochaine réponse

le rapport se trouve dans le dossier de zhpdiag dans program files sous le nom de ZHPFixReport

................

2)

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.

https://toolslib.net

Lance le, clique sur SUPPRESSION puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleane.txt

....................

3)

Redemarre le pc et dis moi si tu as encore des soucis

Voici ZHPFix : https://pjjoint.malekal.com/files.php?id=20120716_611n15l9d10

AdwCleaner : https://pjjoint.malekal.com/files.php?id=20120716_e6q12g7i15n5

J'ai redémarré une deuxième fois, cela semble mieux

La ligne Localhost est elle normale ?

https://pjjoint.malekal.com/files.php?id=20120716_g11u9e15w7d12

oui

tout est ok sur le rapport

qui te signalait le virus ?

ok

poste moi le résultat de l'examen stp

sourire

mse est sans plus, le mieux serait avast ou antivir

mais un pc à jour et un surf sécurisé feront la difference

pour terminer on fait le ménage

tout est ecrit là :
https://gen-hackman.kanak.fr/

(merci à mon ami g3n-h@ckm@n)

arffff

redémarrer le pc en mode sans échec avec prise en charge reseau

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php

puis lance roguekiller en mode suppression

https://pjjoint.malekal.com/files.php?id=20120717_k9b6m7q15m7

mse semble s'en être débarassé !
mais pour combien de temps !!!

on refait combofix mais tu le retélécharges mais cette fois ci renommes le gwena avant de le lancer

reste en mode sans echec avec reseau

https://forums.commentcamarche.net/forum/affich-25610730-virus-zeroaccess-me-resiste-help#9