Virus Live security platinum Résolu/Fermé

Question

Bonjour, Experte pour surfer sur le web, mais pas vraiment calée pour réparer quand ça déconne, j'ai besoin d'aide... Mon ordinateur a été infecté par Live Security Platinum, après avoir fait Roguekiller: RogueKiller V7.6.4 [17/07/2012] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows Vista (6.0.6002 Service Pack 2) 32 bits version Demarrage : Mode normal Utilisateur: Cindy [Droits d'admin] Mode: Suppression -- Date: 28/07/2012 20:38:47 ¤¤¤ Processus malicieux: 7 ¤¤¤ [ZeroAccess] n -- c:\windows\system32\n -> UNLOADED [ZeroAccess] n -- c:\windows\system32\n -> UNLOADED [SUSP PATH] 036DFF8500483E6786ABFA152F3B707C.exe -- C:\ProgramData\036DFF8500483E6786ABFA152F3B707C\036DFF8500483E6786ABFA152F3B707C.exe -> KILLED [TermProc] [ZeroAccess] n -- c:\windows\system32\n -> UNLOADED [RESIDUE] 036DFF8500483E6786ABFA152F3B707C.exe -- C:\ProgramData\036DFF8500483E6786ABFA152F3B707C\036DFF8500483E6786ABFA152F3B707C.exe -> KILLED [TermProc] [ZeroAccess] n -- c:\windows\system32\n -> UNLOADED [RESIDUE] 036DFF8500483E6786ABFA152F3B707C.exe -- C:\ProgramData\036DFF8500483E6786ABFA152F3B707C\036DFF8500483E6786ABFA152F3B707C.exe -> KILLED [TermProc] ¤¤¤ Entrees de registre: 1 ¤¤¤ [PROXY IE] HKCU\[...]\Internet Settings : ProxyEnable (1) -> NOT REMOVED, USE PROXYFIX ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ [ZeroAccess][FOLDER] n : c:\windows\installer\{7646c641-8eed-a95d-12d4-130064abf510}\n --> RAR ERROR [ZeroAccess][FILE] @ : c:\windows\installer\{7646c641-8eed-a95d-12d4-130064abf510}\@ --> REMOVED AT REBOOT [ZeroAccess][FOLDER] U : c:\windows\installer\{7646c641-8eed-a95d-12d4-130064abf510}\U --> RAR ERROR [ZeroAccess][FOLDER] L : c:\windows\installer\{7646c641-8eed-a95d-12d4-130064abf510}\L --> RAR ERROR [ZeroAccess][FOLDER] n : c:\users\cindy\appdata\local\{7646c641-8eed-a95d-12d4-130064abf510}\n --> RAR ERROR [ZeroAccess][FOLDER] @ : c:\users\cindy\appdata\local\{7646c641-8eed-a95d-12d4-130064abf510}\@ --> RAR ERROR [ZeroAccess][FOLDER] U : c:\users\cindy\appdata\local\{7646c641-8eed-a95d-12d4-130064abf510}\U --> RAR ERROR [ZeroAccess][FOLDER] L : c:\users\cindy\appdata\local\{7646c641-8eed-a95d-12d4-130064abf510}\L --> RAR ERROR ¤¤¤ Driver: [CHARGE] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ 127.0.0.1 localhost ::1 localhost ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: WDC WD5000BEVT-22ZAT0 ATA Device +++++ --- User --- [MBR] b2bd9dda226db935a665eb585df23bf5 [BSP] dbb55f1f3ff912d4e3646d7826eed06a : Acer tatooed MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 13312 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 27265024 | Size: 463626 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[3].txt >> RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt Après quelques recherches sur Internet, j'ai aussi lancé Mawarebytes Anti-Malware Malwarebytes Anti-Malware (Essai) 1.62.0.1300 www.malwarebytes.org Version de la base de données: v2012.07.28.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Cindy :: PC-DE-CINDY [administrateur] Protection: Désactivé 28/07/2012 23:35:26 mbam-log-2012-07-28 (23-35-26).txt Type d'examen: Examen rapide Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM Options d'examen désactivées: P2P Elément(s) analysé(s): 228331 Temps écoulé: 5 minute(s), 56 seconde(s) Processus mémoire détecté(s): 0 (Aucun élément nuisible détecté) Module(s) mémoire détecté(s): 0 (Aucun élément nuisible détecté) Clé(s) du Registre détectée(s): 0 (Aucun élément nuisible détecté) Valeur(s) du Registre détectée(s): 0 (Aucun élément nuisible détecté) Elément(s) de données du Registre détecté(s): 0 (Aucun élément nuisible détecté) Dossier(s) détecté(s): 0 (Aucun élément nuisible détecté) Fichier(s) détecté(s): 0 (Aucun élément nuisible détecté) (fin) Et enfin AdwCleaner # AdwCleaner v1.703 - Rapport créé le 28/07/2012 à 23:21:34 # Mis à jour le 20/07/2012 par Xplode # Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Nom d'utilisateur : Cindy - PC-DE-CINDY # Exécuté depuis : C:\Users\Cindy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UZQ6QH12\adwcleaner.exe # Option [Suppression] ***** [Services] ***** ***** [Fichiers / Dossiers] ***** Dossier Supprimé : C:\Users\Cindy\AppData\Local\Wajam Dossier Supprimé : C:\Users\Cindy\AppData\Local\widestream6 Air Dossier Supprimé : C:\Users\Cindy\AppData\LocalLow\PriceGong Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\cacaoweb Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\CrazyLoader Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\OfferBox Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\widestream Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\extensions\@FissaPlugin Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} Dossier Supprimé : C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\extensions\cacaoweb@cacaoweb.org Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong Dossier Supprimé : C:\Program Files\OfferBox Dossier Supprimé : C:\Program Files\PriceGong Dossier Supprimé : C:\Program Files\Widestream6 Fichier Supprimé : C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\searchplugins\Fissa.xml Fichier Supprimé : C:\Program Files\Mozilla Firefox\.autoreg ***** [Registre] ***** Clé Supprimée : HKCU\Software\AppDataLow\Software\PriceGong Clé Supprimée : HKCU\Software\cacaoweb Clé Supprimée : HKCU\Software\FissaSearch Clé Supprimée : HKCU\Software\JavaSoft\Prefs\crazyloader Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\pricegong Clé Supprimée : HKCU\Software\Offerbox Clé Supprimée : HKCU\Software\Spointer Clé Supprimée : HKCU\Software\WideStream Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL Clé Supprimée : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO Clé Supprimée : HKLM\SOFTWARE\Classes\PriceFactorIE.PriceGongBHO.1 Clé Supprimée : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl Clé Supprimée : HKLM\SOFTWARE\Classes\PriceGongIE.PriceGongCtrl.1 Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\bjeikeheijdjdfjbmknpefojickbkmom Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong Clé Supprimée : HKLM\SOFTWARE\Offerbox ***** [Registre - GUID] ***** Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692} Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926} Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71} Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{8B3372D0-09F0-41A5-8D9B-134E148672FB} Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926} Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926} ***** [Navigateurs] ***** -\ Internet Explorer v9.0.8112.16421 [OK] Le registre ne contient aucune entrée illégitime. -\ Mozilla Firefox v3.6.6 (fr) Nom du profil : default Fichier : C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\prefs.js C:\Users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\user.js ... Supprimé ! Supprimée : user_pref("extensions.Fissa.lastRunTime", "Mon, 02 May 2011 13:03:41 GMT"); Nom du profil : default Fichier : C:\Users\Cindy_2\AppData\Roaming\Mozilla\Firefox\Profiles\8w4rcq7h.default\prefs.js [OK] Le fichier ne contient aucune entrée illégitime. ************************* AdwCleaner[S1].txt - [4562 octets] - [28/07/2012 23:21:34] ########## EOF - C:\AdwCleaner[S1].txt - [4690 octets] ########## Je n'suis pas experte en langage informatique, mais il semblerait ne plus y avoir de problème, sauf que mon anti-virus sfr me trouve toujours des virus: Trojan.Patched.Sirefef.C Si quelqu'un avait quelques minutes à consacrer à mon problème, merci d'avance Configuration: Windows Vista / Internet Explorer 9.0

Utilisateur anonyme · Answer

Bonsoir


Pour vérification

 Télécharge TDSSKiller 

    *Créez un nouveau dossier sur votre bureau puis décompressez l'archive dedans
    * Lancez le programme en cliquant sur TDSSKiller.exe, l'analyse se fait automatiquement, si l'infection est détectée, des éléments cachés (= hidden) seront alors affichés.


Si TDSS.tdl2 est détecté: l'option delete sera cochée par défaut. 
Si TDSS.tdl3 est détecté: assure toi que Cure est bien cochée. 
Si TDSS.tdl4(\HardDisk0\MBR) est détecté: assure toi que Cure est bien cochée. 
Si Rootkit.Win32.ZAccess.* est détecté : règle sur "cure" en haut , et "delete" en bas 
Si Suspicious file est indiqué, laisse l''option cochée sur Skip 
une fois qu'il a terminé , redémarre s'il te le demande pour finir de nettoyer 

sinon , ferme TDSSKiller et le rapport s'affichera sur le bureau
 
Sinon il est enregistré ici : C:\TDSSKiller_N°Version_Date_Heure.txt 
  
Poste moi son rapport à l'issue; merci

@+

g3n-h@ckm@n · Answer

salut

Attention : cet outil peut etre détecté à tort comme virus

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail.

Désactive toutes tes protections si possible , antivirus , sandbox , etc....

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe
http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan

Il est possible que l'outil fasse redemarrer ton pc plusieurs fois , laisse-le faire

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

cindy07 · Answer

Merci Guillaume5188, TDSS n'a rien donné apparemment, voici le rapport:

00:07:45.0426 5904	TDSS rootkit removing tool 2.7.48.0 Jul 24 2012 13:16:32
00:07:45.0645 5904	============================================================
00:07:45.0645 5904	Current date / time: 2012/07/29 00:07:45.0645
00:07:45.0645 5904	SystemInfo:
00:07:45.0645 5904	
00:07:45.0646 5904	OS Version: 6.0.6002 ServicePack: 2.0
00:07:45.0646 5904	Product type: Workstation
00:07:45.0646 5904	ComputerName: PC-DE-CINDY
00:07:45.0646 5904	UserName: Cindy
00:07:45.0646 5904	Windows directory: C:\Windows
00:07:45.0646 5904	System windows directory: C:\Windows
00:07:45.0646 5904	Processor architecture: Intel x86
00:07:45.0646 5904	Number of processors: 2
00:07:45.0646 5904	Page size: 0x1000
00:07:45.0646 5904	Boot type: Normal boot
00:07:45.0646 5904	============================================================
00:07:46.0635 5904	Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
00:07:46.0636 5904	============================================================
00:07:46.0637 5904	\Device\Harddisk0\DR0:
00:07:46.0637 5904	MBR partitions:
00:07:46.0637 5904	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1A00800, BlocksNum 0x38985000
00:07:46.0637 5904	============================================================
00:07:46.0659 5904	C: <-> \Device\Harddisk0\DR0\Partition0
00:07:46.0659 5904	============================================================
00:07:46.0659 5904	Initialize success
00:07:46.0659 5904	============================================================
00:07:57.0954 3200	============================================================
00:07:57.0954 3200	Scan started
00:07:57.0954 3200	Mode: Manual; SigCheck; TDLFS; 
00:07:57.0954 3200	============================================================
00:07:58.0430 3200	ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
00:07:58.0683 3200	ACPI - ok
00:07:58.0825 3200	AdobeActiveFileMonitor6.0 (e8fe4fce23d2809bd88bcc1d0f8408ce) C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
00:07:58.0968 3200	AdobeActiveFileMonitor6.0 - ok
00:07:59.0029 3200	adp94xx         (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys
00:07:59.0144 3200	adp94xx - ok
00:07:59.0198 3200	adpahci         (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys
00:07:59.0240 3200	adpahci - ok
00:07:59.0275 3200	adpu160m        (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys
00:07:59.0310 3200	adpu160m - ok
00:07:59.0349 3200	adpu320         (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys
00:07:59.0407 3200	adpu320 - ok
00:07:59.0482 3200	AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
00:07:59.0599 3200	AeLookupSvc - ok
00:07:59.0667 3200	AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
00:07:59.0744 3200	AFD - ok
00:07:59.0790 3200	agp440          (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys
00:07:59.0825 3200	agp440 - ok
00:07:59.0877 3200	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
00:07:59.0943 3200	aic78xx - ok
00:07:59.0970 3200	ALG             (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
00:08:00.0124 3200	ALG - ok
00:08:00.0144 3200	aliide          (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys
00:08:00.0175 3200	aliide - ok
00:08:00.0222 3200	amdagp          (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys
00:08:00.0257 3200	amdagp - ok
00:08:00.0277 3200	amdide          (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys
00:08:00.0308 3200	amdide - ok
00:08:00.0362 3200	AmdK7           (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys
00:08:00.0432 3200	AmdK7 - ok
00:08:00.0458 3200	AmdK8           (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys
00:08:00.0521 3200	AmdK8 - ok
00:08:00.0567 3200	Appinfo         (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
00:08:00.0620 3200	Appinfo - ok
00:08:00.0663 3200	arc             (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys
00:08:00.0725 3200	arc - ok
00:08:00.0766 3200	arcsas          (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys
00:08:00.0800 3200	arcsas - ok
00:08:00.0835 3200	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
00:08:00.0887 3200	AsyncMac - ok
00:08:00.0919 3200	atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
00:08:00.0952 3200	atapi - ok
00:08:01.0025 3200	AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
00:08:01.0076 3200	AudioEndpointBuilder - ok
00:08:01.0081 3200	Audiosrv        (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
00:08:01.0155 3200	Audiosrv - ok
00:08:01.0231 3200	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
00:08:01.0302 3200	Beep - ok
00:08:01.0327 3200	blbdrive        (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys
00:08:01.0429 3200	blbdrive - ok
00:08:01.0462 3200	bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
00:08:01.0520 3200	bowser - ok
00:08:01.0557 3200	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
00:08:01.0628 3200	BrFiltLo - ok
00:08:01.0660 3200	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
00:08:01.0769 3200	BrFiltUp - ok
00:08:01.0808 3200	Browser         (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
00:08:01.0907 3200	Browser - ok
00:08:01.0933 3200	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
00:08:02.0014 3200	Brserid - ok
00:08:02.0027 3200	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
00:08:02.0109 3200	BrSerWdm - ok
00:08:02.0127 3200	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
00:08:02.0219 3200	BrUsbMdm - ok
00:08:02.0239 3200	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
00:08:02.0315 3200	BrUsbSer - ok
00:08:02.0345 3200	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
00:08:02.0436 3200	BTHMODEM - ok
00:08:02.0480 3200	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
00:08:02.0549 3200	cdfs - ok
00:08:02.0577 3200	cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
00:08:02.0645 3200	cdrom - ok
00:08:02.0692 3200	CertPropSvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
00:08:02.0825 3200	CertPropSvc - ok
00:08:02.0868 3200	circlass        (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys
00:08:02.0913 3200	circlass - ok
00:08:02.0954 3200	CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
00:08:03.0005 3200	CLFS - ok
00:08:03.0046 3200	clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
00:08:03.0157 3200	clr_optimization_v2.0.50727_32 - ok
00:08:03.0227 3200	CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
00:08:03.0296 3200	CmBatt - ok
00:08:03.0329 3200	cmdide          (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys
00:08:03.0408 3200	cmdide - ok
00:08:03.0437 3200	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
00:08:03.0474 3200	Compbatt - ok
00:08:03.0492 3200	COMSysApp - ok
00:08:03.0498 3200	crcdisk         (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys
00:08:03.0539 3200	crcdisk - ok
00:08:03.0586 3200	Crusoe          (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys
00:08:03.0676 3200	Crusoe - ok
00:08:03.0753 3200	CryptSvc        (75c6a297e364014840b48eccd7525e30) C:\Windows\system32\cryptsvc.dll
00:08:03.0934 3200	CryptSvc - ok
00:08:04.0117 3200	DcomLaunch      (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32pcss.dll
00:08:04.0226 3200	DcomLaunch - ok
00:08:04.0271 3200	DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
00:08:04.0323 3200	DfsC - ok
00:08:04.0454 3200	DFSR            (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
00:08:04.0681 3200	DFSR - ok
00:08:04.0823 3200	Dhcp            (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
00:08:04.0925 3200	Dhcp - ok
00:08:05.0016 3200	disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
00:08:05.0053 3200	disk - ok
00:08:05.0087 3200	Dnscache        (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
00:08:05.0183 3200	Dnscache - ok
00:08:05.0230 3200	dot3svc         (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
00:08:05.0297 3200	dot3svc - ok
00:08:05.0351 3200	Dot4            (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
00:08:05.0458 3200	Dot4 - ok
00:08:05.0522 3200	Dot4Print       (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
00:08:05.0591 3200	Dot4Print - ok
00:08:05.0647 3200	dot4usb         (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
00:08:05.0732 3200	dot4usb - ok
00:08:05.0784 3200	DPS             (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
00:08:05.0867 3200	DPS - ok
00:08:05.0926 3200	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
00:08:05.0989 3200	drmkaud - ok
00:08:06.0065 3200	DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
00:08:06.0126 3200	DXGKrnl - ok
00:08:06.0175 3200	E1G60           (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys
00:08:06.0272 3200	E1G60 - ok
00:08:06.0327 3200	EapHost         (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
00:08:06.0388 3200	EapHost - ok
00:08:06.0447 3200	Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
00:08:06.0489 3200	Ecache - ok
00:08:06.0542 3200	ehRecvr         (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe
00:08:06.0653 3200	ehRecvr - ok
00:08:06.0688 3200	ehSched         (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
00:08:06.0826 3200	ehSched - ok
00:08:06.0853 3200	ehstart         (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
00:08:06.0897 3200	ehstart - ok
00:08:06.0960 3200	elxstor         (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys
00:08:07.0077 3200	elxstor - ok
00:08:07.0132 3200	EMDMgmt         (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
00:08:07.0300 3200	EMDMgmt - ok
00:08:07.0323 3200	ErrDev          (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys
00:08:07.0387 3200	ErrDev - ok
00:08:07.0443 3200	EventSystem     (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
00:08:07.0508 3200	EventSystem - ok
00:08:07.0549 3200	exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
00:08:07.0613 3200	exfat - ok
00:08:07.0659 3200	ezSharedSvc     (42f721c52eef2d6df9372a53813a83ef) C:\Windows\System32\ezsvc7.dll
00:08:07.0815 3200	ezSharedSvc ( UnsignedFile.Multi.Generic ) - warning
00:08:07.0815 3200	ezSharedSvc - detected UnsignedFile.Multi.Generic (1)
00:08:07.0946 3200	F-Secure Gatekeeper (66422dc3faa1de433371816056d28270) C:\Program Files\SFR\Pack Sécurité\Anti-Virus\minifilter\fsgk.sys
00:08:07.0995 3200	F-Secure Gatekeeper - ok
00:08:08.0039 3200	F-Secure Gatekeeper Handler Starter (2346842f07e2ab64d1dc83a67fccdfa1) C:\Program Files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
00:08:08.0208 3200	F-Secure Gatekeeper Handler Starter - ok
00:08:08.0259 3200	F-Secure HIPS   (dc0720248dc4d1f303df94ccc3adff96) C:\Program Files\SFR\Pack Sécurité\HIPS\drivers\fshs.sys
00:08:08.0293 3200	F-Secure HIPS - ok
00:08:08.0330 3200	fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
00:08:08.0418 3200	fastfat - ok
00:08:08.0466 3200	fdc             (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys
00:08:08.0538 3200	fdc - ok
00:08:08.0569 3200	fdPHost         (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
00:08:08.0617 3200	fdPHost - ok
00:08:08.0622 3200	FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
00:08:08.0701 3200	FDResPub - ok
00:08:08.0740 3200	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
00:08:08.0776 3200	FileInfo - ok
00:08:08.0790 3200	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
00:08:08.0852 3200	Filetrace - ok
00:08:08.0950 3200	FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
00:08:09.0196 3200	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
00:08:09.0196 3200	FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
00:08:09.0226 3200	flpydisk        (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys
00:08:09.0281 3200	flpydisk - ok
00:08:09.0325 3200	FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
00:08:09.0390 3200	FltMgr - ok
00:08:09.0525 3200	FontCache       (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
00:08:09.0583 3200	FontCache - ok
00:08:09.0652 3200	FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
00:08:09.0741 3200	FontCache3.0.0.0 - ok
00:08:09.0784 3200	fsbts           (1d2de58a837e6909f98ca35103d10739) C:\Windows\system32\Drivers\fsbts.sys
00:08:09.0820 3200	fsbts - ok
00:08:09.0933 3200	FSDFWD          (7cd27e80dfd22f02fbda47b706aba0f2) C:\Program Files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
00:08:10.0066 3200	FSDFWD - ok
00:08:10.0120 3200	FSES            (45d83eb65fc09acfffa5d27053eb9ff3) C:\Windows\system32\drivers\fses.sys
00:08:10.0154 3200	FSES - ok
00:08:10.0206 3200	FSFW            (4873e90a180e1585f9b6c6d52aebf52c) C:\Windows\system32\drivers\fsdfw.sys
00:08:10.0241 3200	FSFW - ok
00:08:10.0297 3200	FSMA            (8a556a81e9ff95bd9eb7207783e8fcf4) C:\Program Files\SFR\Pack Sécurité\Common\FSMA32.EXE
00:08:10.0367 3200	FSMA - ok
00:08:10.0417 3200	FSORSPClient    (42aef6a385354aca65fc210ce7ce4d7c) C:\Program Files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
00:08:10.0456 3200	FSORSPClient - ok
00:08:10.0501 3200	fssfltr         (b0082808a6856a252f7cdd939892ce50) C:\Windows\system32\DRIVERS\fssfltr.sys
00:08:10.0554 3200	fssfltr - ok
00:08:10.0726 3200	fsssvc          (28ddeeec44e988657b732cf404d504cb) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
00:08:11.0148 3200	fsssvc - ok
00:08:11.0431 3200	fsvista         (d8b300c1c744460dae837db72bc2ccbd) C:\Program Files\SFR\Pack Sécurité\Anti-Virus\minifilter\fsvista.sys
00:08:11.0470 3200	fsvista - ok
00:08:11.0718 3200	Fs_Rec          (b972a66758577e0bfd1de0f91aaa27b5) C:\Windows\system32\drivers\Fs_Rec.sys
00:08:11.0774 3200	Fs_Rec - ok
00:08:11.0832 3200	gagp30kx        (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys
00:08:11.0869 3200	gagp30kx - ok
00:08:12.0029 3200	gpsvc           (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
00:08:12.0269 3200	gpsvc - ok
00:08:12.0327 3200	gupdate         (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
00:08:12.0455 3200	gupdate - ok
00:08:12.0480 3200	gupdatem        (626a24ed1228580b9518c01930936df9) C:\Program Files\Google\Update\GoogleUpdate.exe
00:08:12.0526 3200	gupdatem - ok
00:08:12.0574 3200	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
00:08:12.0700 3200	HdAudAddService - ok
00:08:12.0767 3200	HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
00:08:12.0903 3200	HDAudBus - ok
00:08:12.0924 3200	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
00:08:13.0007 3200	HidBth - ok
00:08:13.0022 3200	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
00:08:13.0086 3200	HidIr - ok
00:08:13.0103 3200	hidserv         (84067081f3318162797385e11a8f0582) C:\Windows\system32\hidserv.dll
00:08:13.0160 3200	hidserv - ok
00:08:13.0187 3200	HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
00:08:13.0242 3200	HidUsb - ok
00:08:13.0273 3200	hkmsvc          (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
00:08:13.0371 3200	hkmsvc - ok
00:08:13.0404 3200	HpCISSs         (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys
00:08:13.0440 3200	HpCISSs - ok
00:08:13.0494 3200	HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
00:08:13.0580 3200	HTTP - ok
00:08:13.0602 3200	i2omp           (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys
00:08:13.0635 3200	i2omp - ok
00:08:13.0674 3200	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
00:08:13.0761 3200	i8042prt - ok
00:08:13.0812 3200	iaStorV         (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys
00:08:13.0894 3200	iaStorV - ok
00:08:13.0981 3200	idsvc           (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
00:08:14.0340 3200	idsvc - ok
00:08:14.0528 3200	igfx            (0627fc0c422cd6e0f23e1b0d1d9f0899) C:\Windows\system32\DRIVERS\igdkmd32.sys
00:08:14.0791 3200	igfx - ok
00:08:14.0931 3200	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
00:08:15.0009 3200	iirsp - ok
00:08:15.0074 3200	IKEEXT          (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
00:08:15.0156 3200	IKEEXT - ok
00:08:15.0308 3200	IntcAzAudAddService (9b89f2e3d705651dec1f01033b9d6b24) C:\Windows\system32\drivers\RTKVHDA.sys
00:08:15.0535 3200	IntcAzAudAddService - ok
00:08:15.0684 3200	intelide        (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
00:08:15.0720 3200	intelide - ok
00:08:15.0753 3200	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
00:08:15.0826 3200	intelppm - ok
00:08:15.0857 3200	IPBusEnum       (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
00:08:15.0938 3200	IPBusEnum - ok
00:08:15.0968 3200	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
00:08:16.0037 3200	IpFilterDriver - ok
00:08:16.0041 3200	IpInIp - ok
00:08:16.0110 3200	IPMIDRV         (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys
00:08:16.0157 3200	IPMIDRV - ok
00:08:16.0175 3200	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
00:08:16.0274 3200	IPNAT - ok
00:08:16.0305 3200	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
00:08:16.0350 3200	IRENUM - ok
00:08:16.0378 3200	isapnp          (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys
00:08:16.0411 3200	isapnp - ok
00:08:16.0456 3200	iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
00:08:16.0497 3200	iScsiPrt - ok
00:08:16.0525 3200	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
00:08:16.0556 3200	iteatapi - ok
00:08:16.0593 3200	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
00:08:16.0624 3200	iteraid - ok
00:08:16.0642 3200	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
00:08:16.0677 3200	kbdclass - ok
00:08:16.0703 3200	kbdhid          (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys
00:08:16.0759 3200	kbdhid - ok
00:08:16.0787 3200	KeyIso          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
00:08:16.0825 3200	KeyIso - ok
00:08:16.0875 3200	KSecDD          (4a1445efa932a3baf5bdb02d7131ee20) C:\Windows\system32\Drivers\ksecdd.sys
00:08:16.0931 3200	KSecDD - ok
00:08:17.0009 3200	KtmRm           (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
00:08:17.0085 3200	KtmRm - ok
00:08:17.0536 3200	LanmanServer    (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\system32\srvsvc.dll
00:08:17.0580 3200	LanmanServer - ok
00:08:17.0611 3200	LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll
00:08:17.0675 3200	LanmanWorkstation - ok
00:08:17.0708 3200	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
00:08:17.0756 3200	lltdio - ok
00:08:17.0790 3200	lltdsvc         (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
00:08:17.0848 3200	lltdsvc - ok
00:08:17.0864 3200	lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
00:08:17.0929 3200	lmhosts - ok
00:08:17.0952 3200	LSI_FC          (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys
00:08:17.0986 3200	LSI_FC - ok
00:08:18.0010 3200	LSI_SAS         (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys
00:08:18.0044 3200	LSI_SAS - ok
00:08:18.0092 3200	LSI_SCSI        (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys
00:08:18.0125 3200	LSI_SCSI - ok
00:08:18.0153 3200	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
00:08:18.0227 3200	luafv - ok
00:08:18.0261 3200	MBAMProtector   (6dfe7f2e8e8a337263aa5c92a215f161) C:\Windows\system32\drivers\mbam.sys
00:08:18.0331 3200	MBAMProtector - ok
00:08:18.0439 3200	MBAMService     (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
00:08:18.0537 3200	MBAMService - ok
00:08:18.0580 3200	Mcx2Svc         (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll
00:08:18.0615 3200	Mcx2Svc - ok
00:08:18.0659 3200	megasas         (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys
00:08:18.0691 3200	megasas - ok
00:08:18.0751 3200	MegaSR          (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys
00:08:18.0852 3200	MegaSR - ok
00:08:18.0882 3200	MMCSS           (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
00:08:18.0940 3200	MMCSS - ok
00:08:18.0985 3200	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
00:08:19.0047 3200	Modem - ok
00:08:19.0097 3200	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
00:08:19.0184 3200	monitor - ok
00:08:19.0214 3200	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
00:08:19.0248 3200	mouclass - ok
00:08:19.0257 3200	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
00:08:19.0324 3200	mouhid - ok
00:08:19.0351 3200	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
00:08:19.0385 3200	MountMgr - ok
00:08:19.0410 3200	mpio            (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys
00:08:19.0446 3200	mpio - ok
00:08:19.0475 3200	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
00:08:19.0516 3200	mpsdrv - ok
00:08:19.0535 3200	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
00:08:19.0588 3200	Mraid35x - ok
00:08:19.0608 3200	MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
00:08:19.0668 3200	MRxDAV - ok
00:08:19.0693 3200	mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
00:08:19.0735 3200	mrxsmb - ok
00:08:19.0767 3200	mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
00:08:19.0836 3200	mrxsmb10 - ok
00:08:19.0856 3200	mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
00:08:19.0917 3200	mrxsmb20 - ok
00:08:19.0956 3200	msahci          (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys
00:08:19.0988 3200	msahci - ok
00:08:20.0011 3200	msdsm           (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys
00:08:20.0074 3200	msdsm - ok
00:08:20.0110 3200	MSDTC           (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
00:08:20.0161 3200	MSDTC - ok
00:08:20.0191 3200	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
00:08:20.0279 3200	Msfs - ok
00:08:20.0309 3200	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
00:08:20.0339 3200	msisadrv - ok
00:08:20.0367 3200	MSiSCSI         (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
00:08:20.0452 3200	MSiSCSI - ok
00:08:20.0456 3200	msiserver - ok
00:08:20.0532 3200	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
00:08:20.0596 3200	MSKSSRV - ok
00:08:20.0628 3200	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
00:08:20.0673 3200	MSPCLOCK - ok
00:08:20.0688 3200	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
00:08:20.0730 3200	MSPQM - ok
00:08:20.0770 3200	MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
00:08:20.0811 3200	MsRPC - ok
00:08:20.0824 3200	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
00:08:20.0857 3200	mssmbios - ok
00:08:20.0876 3200	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
00:08:20.0918 3200	MSTEE - ok
00:08:20.0936 3200	Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
00:08:20.0971 3200	Mup - ok
00:08:21.0010 3200	napagent        (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
00:08:21.0086 3200	napagent - ok
00:08:21.0148 3200	NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS
wifi.sys
00:08:21.0233 3200	NativeWifiP - ok
00:08:21.0291 3200	NAVENG - ok
00:08:21.0299 3200	NAVEX15 - ok
00:08:21.0340 3200	NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers
dis.sys
00:08:21.0405 3200	NDIS - ok
00:08:21.0423 3200	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS
distapi.sys
00:08:21.0478 3200	NdisTapi - ok
00:08:21.0491 3200	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS
disuio.sys
00:08:21.0543 3200	Ndisuio - ok
00:08:21.0602 3200	NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS
diswan.sys
00:08:21.0670 3200	NdisWan - ok
00:08:21.0676 3200	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
00:08:21.0720 3200	NDProxy - ok
00:08:21.0774 3200	Net Driver HPZ12 (51c6d8bfbd4ea5b62a1ba7f4469250d3) C:\Windows\system32\HPZinw12.dll
00:08:21.0802 3200	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
00:08:21.0803 3200	Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
00:08:21.0813 3200	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS
etbios.sys
00:08:21.0858 3200	NetBIOS - ok
00:08:21.0954 3200	netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS
etbt.sys
00:08:22.0027 3200	netbt - ok
00:08:22.0054 3200	Netlogon        (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
00:08:22.0089 3200	Netlogon - ok
00:08:22.0130 3200	Netman          (c8052711daecc48b982434c5116ca401) C:\Windows\System32
etman.dll
00:08:22.0236 3200	Netman - ok
00:08:22.0273 3200	netprofm        (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32
etprofm.dll
00:08:22.0358 3200	netprofm - ok
00:08:22.0426 3200	netr28          (ebbd48d3f4361773b812ca67a9cfc69b) C:\Windows\system32\DRIVERS
etr28.sys
00:08:22.0522 3200	netr28 - ok
00:08:22.0579 3200	NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
00:08:22.0611 3200	NetTcpPortSharing - ok
00:08:22.0851 3200	NETw5v32        (e559ea9138c77b5d1fda8c558764a25f) C:\Windows\system32\DRIVERS\NETw5v32.sys
00:08:23.0211 3200	NETw5v32 - ok
00:08:23.0361 3200	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers
frd960.sys
00:08:23.0396 3200	nfrd960 - ok
00:08:23.0483 3200	NlaSvc          (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32
lasvc.dll
00:08:23.0604 3200	NlaSvc - ok
00:08:23.0670 3200	Norton Internet Security - ok
00:08:23.0692 3200	Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
00:08:23.0747 3200	Npfs - ok
00:08:23.0781 3200	nsi             (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32
sisvc.dll
00:08:23.0843 3200	nsi - ok
00:08:23.0862 3200	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers
siproxy.sys
00:08:23.0905 3200	nsiproxy - ok
00:08:23.0993 3200	Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
00:08:24.0088 3200	Ntfs - ok
00:08:24.0103 3200	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers
trigdigi.sys
00:08:24.0167 3200	ntrigdigi - ok
00:08:24.0181 3200	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
00:08:24.0247 3200	Null - ok
00:08:24.0278 3200	nvraid          (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers
vraid.sys
00:08:24.0346 3200	nvraid - ok
00:08:24.0369 3200	nvstor          (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers
vstor.sys
00:08:24.0402 3200	nvstor - ok
00:08:24.0429 3200	nv_agp          (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers
v_agp.sys
00:08:24.0466 3200	nv_agp - ok
00:08:24.0470 3200	NwlnkFlt - ok
00:08:24.0476 3200	NwlnkFwd - ok
00:08:24.0578 3200	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
00:08:24.0767 3200	odserv - ok
00:08:24.0799 3200	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
00:08:24.0865 3200	ohci1394 - ok
00:08:24.0910 3200	ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
00:08:24.0953 3200	ose - ok
00:08:25.0024 3200	p2pimsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
00:08:25.0114 3200	p2pimsvc - ok
00:08:25.0122 3200	p2psvc          (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
00:08:25.0209 3200	p2psvc - ok
00:08:25.0249 3200	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
00:08:25.0340 3200	Parport - ok
00:08:25.0375 3200	partmgr         (b9c2b89f08670e159f7181891e449cd9) C:\Windows\system32\drivers\partmgr.sys
00:08:25.0413 3200	partmgr - ok
00:08:25.0422 3200	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
00:08:25.0503 3200	Parvdm - ok
00:08:25.0530 3200	PcaSvc          (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
00:08:25.0585 3200	PcaSvc - ok
00:08:25.0627 3200	pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
00:08:25.0668 3200	pci - ok
00:08:25.0709 3200	pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
00:08:25.0740 3200	pciide - ok
00:08:25.0776 3200	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
00:08:25.0832 3200	pcmcia - ok
00:08:25.0939 3200	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
00:08:26.0099 3200	PEAUTH - ok
00:08:26.0222 3200	pla             (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
00:08:26.0447 3200	pla - ok
00:08:26.0563 3200	PlugPlay        (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
00:08:26.0612 3200	PlugPlay - ok
00:08:26.0659 3200	Pml Driver HPZ12 (79834aa2fbf9fe81eebb229024f6f7fc) C:\Windows\system32\HPZipm12.dll
00:08:26.0684 3200	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
00:08:26.0684 3200	Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
00:08:26.0734 3200	PNRPAutoReg     (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
00:08:26.0806 3200	PNRPAutoReg - ok
00:08:26.0815 3200	PNRPsvc         (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
00:08:26.0882 3200	PNRPsvc - ok
00:08:26.0930 3200	PolicyAgent     (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
00:08:27.0028 3200	PolicyAgent - ok
00:08:27.0123 3200	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERSaspptp.sys
00:08:27.0188 3200	PptpMiniport - ok
00:08:27.0219 3200	Processor       (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys
00:08:27.0275 3200	Processor - ok
00:08:27.0308 3200	ProfSvc         (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
00:08:27.0354 3200	ProfSvc - ok
00:08:27.0375 3200	ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
00:08:27.0408 3200	ProtectedStorage - ok
00:08:27.0437 3200	PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
00:08:27.0504 3200	PSched - ok
00:08:27.0525 3200	PxHelp20        (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys
00:08:27.0559 3200	PxHelp20 - ok
00:08:27.0662 3200	ql2300          (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys
00:08:27.0792 3200	ql2300 - ok
00:08:27.0831 3200	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
00:08:27.0865 3200	ql40xx - ok
00:08:27.0919 3200	QWAVE           (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
00:08:27.0984 3200	QWAVE - ok
00:08:28.0016 3200	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
00:08:28.0068 3200	QWAVEdrv - ok
00:08:28.0094 3200	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERSasacd.sys
00:08:28.0154 3200	RasAcd - ok
00:08:28.0174 3200	RasAuto         (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32asauto.dll
00:08:28.0278 3200	RasAuto - ok
00:08:28.0309 3200	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERSasl2tp.sys
00:08:28.0363 3200	Rasl2tp - ok
00:08:28.0391 3200	RasMan          (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32asmans.dll
00:08:28.0494 3200	RasMan - ok
00:08:28.0528 3200	RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERSaspppoe.sys
00:08:28.0610 3200	RasPppoe - ok
00:08:28.0650 3200	RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERSassstp.sys
00:08:28.0687 3200	RasSstp - ok
00:08:28.0725 3200	rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERSdbss.sys
00:08:28.0798 3200	rdbss - ok
00:08:28.0812 3200	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
00:08:28.0870 3200	RDPCDD - ok
00:08:28.0906 3200	rdpdr           (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\driversdpdr.sys
00:08:28.0966 3200	rdpdr - ok
00:08:28.0970 3200	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\driversdpencdd.sys
00:08:29.0015 3200	RDPENCDD - ok
00:08:29.0051 3200	RDPWD           (c127ebd5afab31524662c48dfceb773a) C:\Windows\system32\drivers\RDPWD.sys
00:08:29.0123 3200	RDPWD - ok
00:08:29.0206 3200	RemoteAccess    (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
00:08:29.0271 3200	RemoteAccess - ok
00:08:29.0318 3200	RemoteRegistry  (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32egsvc.dll
00:08:29.0378 3200	RemoteRegistry - ok
00:08:29.0404 3200	RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
00:08:29.0456 3200	RpcLocator - ok
00:08:29.0519 3200	RpcSs           (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32pcss.dll
00:08:29.0579 3200	RpcSs - ok
00:08:29.0617 3200	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERSspndr.sys
00:08:29.0681 3200	rspndr - ok
00:08:29.0732 3200	RTL8169         (174b9514cd1a0c33ce4bbc02a3c81a62) C:\Windows\system32\DRIVERS\Rtlh86.sys
00:08:29.0779 3200	RTL8169 - ok
00:08:29.0799 3200	RTSTOR          (01c64783db1f40e1e3df67dd36199b35) C:\Windows\system32\drivers\RTSTOR.SYS
00:08:29.0856 3200	RTSTOR - ok
00:08:29.0886 3200	SamSs           (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
00:08:29.0919 3200	SamSs - ok
00:08:29.0948 3200	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
00:08:30.0009 3200	sbp2port - ok
00:08:30.0168 3200	SBSDWSCService  (794d4b48dfb6e999537c7c3947863463) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
00:08:30.0672 3200	SBSDWSCService - ok
00:08:30.0716 3200	SCardSvr        (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
00:08:30.0758 3200	SCardSvr - ok
00:08:30.0812 3200	Schedule        (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
00:08:30.0890 3200	Schedule - ok
00:08:30.0923 3200	SCPolicySvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
00:08:30.0962 3200	SCPolicySvc - ok
00:08:30.0992 3200	SDRSVC          (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
00:08:31.0059 3200	SDRSVC - ok
00:08:31.0114 3200	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
00:08:31.0195 3200	secdrv - ok
00:08:31.0220 3200	seclogon        (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
00:08:31.0263 3200	seclogon - ok
00:08:31.0289 3200	SENS            (a9bbab5759771e523f55563d6cbe140f) C:\Windows\System32\sens.dll
00:08:31.0353 3200	SENS - ok
00:08:31.0374 3200	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
00:08:31.0458 3200	Serenum - ok
00:08:31.0470 3200	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
00:08:31.0555 3200	Serial - ok
00:08:31.0580 3200	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
00:08:31.0626 3200	sermouse - ok
00:08:31.0652 3200	SessionEnv      (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
00:08:31.0699 3200	SessionEnv - ok
00:08:31.0730 3200	sffdisk         (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys
00:08:31.0767 3200	sffdisk - ok
00:08:31.0788 3200	sffp_mmc        (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys
00:08:31.0833 3200	sffp_mmc - ok
00:08:31.0843 3200	sffp_sd         (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys
00:08:31.0890 3200	sffp_sd - ok
00:08:31.0918 3200	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
00:08:31.0992 3200	sfloppy - ok
00:08:32.0035 3200	ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
00:08:32.0115 3200	ShellHWDetection - ok
00:08:32.0155 3200	sisagp          (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys
00:08:32.0191 3200	sisagp - ok
00:08:32.0219 3200	SiSRaid2        (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys
00:08:32.0252 3200	SiSRaid2 - ok
00:08:32.0270 3200	SiSRaid4        (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys
00:08:32.0302 3200	SiSRaid4 - ok
00:08:32.0524 3200	slsvc           (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
00:08:32.0857 3200	slsvc - ok
00:08:32.0973 3200	SLUINotify      (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
00:08:33.0028 3200	SLUINotify - ok
00:08:33.0084 3200	Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
00:08:33.0141 3200	Smb - ok
00:08:33.0169 3200	SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
00:08:33.0221 3200	SNMPTRAP - ok
00:08:33.0257 3200	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
00:08:33.0291 3200	spldr - ok
00:08:33.0328 3200	Spooler         (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
00:08:33.0395 3200	Spooler - ok
00:08:33.0405 3200	SRTSP - ok
00:08:33.0416 3200	SRTSPX - ok
00:08:33.0459 3200	srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
00:08:33.0534 3200	srv - ok
00:08:33.0556 3200	srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
00:08:33.0631 3200	srv2 - ok
00:08:33.0664 3200	srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
00:08:33.0705 3200	srvnet - ok
00:08:33.0739 3200	SSDPSRV         (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
00:08:33.0789 3200	SSDPSRV - ok
00:08:33.0804 3200	SstpSvc         (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
00:08:33.0841 3200	SstpSvc - ok
00:08:33.0880 3200	stisvc          (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
00:08:33.0991 3200	stisvc - ok
00:08:34.0016 3200	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
00:08:34.0048 3200	swenum - ok
00:08:34.0090 3200	swprv           (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
00:08:34.0169 3200	swprv - ok
00:08:34.0196 3200	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
00:08:34.0227 3200	Symc8xx - ok
00:08:34.0262 3200	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
00:08:34.0292 3200	Sym_hi - ok
00:08:34.0323 3200	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
00:08:34.0354 3200	Sym_u3 - ok
00:08:34.0408 3200	SynTP           (d2aa5d5fdb821eb5f9366c5e3bc2d9ea) C:\Windows\system32\DRIVERS\SynTP.sys
00:08:34.0446 3200	SynTP - ok
00:08:34.0493 3200	SysMain         (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
00:08:34.0578 3200	SysMain - ok
00:08:34.0614 3200	TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
00:08:34.0706 3200	TabletInputService - ok
00:08:34.0753 3200	TapiSrv         (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32	apisrv.dll
00:08:34.0838 3200	TapiSrv - ok
00:08:34.0876 3200	TBS             (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32	bssvc.dll
00:08:34.0921 3200	TBS - ok
00:08:35.0005 3200	Tcpip           (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\drivers	cpip.sys
00:08:35.0160 3200	Tcpip - ok
00:08:35.0172 3200	Tcpip6          (27d470dabc77bc60d0a3b0e4deb6cb91) C:\Windows\system32\DRIVERS	cpip.sys
00:08:35.0333 3200	Tcpip6 - ok
00:08:35.0375 3200	tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers	cpipreg.sys
00:08:35.0410 3200	tcpipreg - ok
00:08:35.0446 3200	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers	dpipe.sys
00:08:35.0489 3200	TDPIPE - ok
00:08:35.0510 3200	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers	dtcp.sys
00:08:35.0571 3200	TDTCP - ok
00:08:35.0610 3200	tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS	dx.sys
00:08:35.0652 3200	tdx - ok
00:08:35.0679 3200	TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS	ermdd.sys
00:08:35.0714 3200	TermDD - ok
00:08:35.0758 3200	TermService     (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32	ermsrv.dll
00:08:35.0832 3200	TermService - ok
00:08:35.0869 3200	Themes          (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
00:08:35.0930 3200	Themes - ok
00:08:35.0981 3200	THREADORDER     (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
00:08:36.0025 3200	THREADORDER - ok
00:08:36.0049 3200	TrkWks          (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32	rkwks.dll
00:08:36.0129 3200	TrkWks - ok
00:08:36.0169 3200	TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
00:08:36.0209 3200	TrustedInstaller - ok
00:08:36.0249 3200	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS	ssecsrv.sys
00:08:36.0301 3200	tssecsrv - ok
00:08:36.0331 3200	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS	unmp.sys
00:08:36.0389 3200	tunmp - ok
00:08:36.0420 3200	tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS	unnel.sys
00:08:36.0470 3200	tunnel - ok
00:08:36.0495 3200	uagp35          (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys
00:08:36.0532 3200	uagp35 - ok
00:08:36.0559 3200	udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
00:08:36.0611 3200	udfs - ok
00:08:36.0647 3200	UI0Detect       (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
00:08:36.0710 3200	UI0Detect - ok
00:08:36.0727 3200	uliagpkx        (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys
00:08:36.0762 3200	uliagpkx - ok
00:08:36.0809 3200	uliahci         (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys
00:08:36.0849 3200	uliahci - ok
00:08:36.0882 3200	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
00:08:36.0918 3200	UlSata - ok
00:08:36.0945 3200	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
00:08:36.0979 3200	ulsata2 - ok
00:08:36.0995 3200	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
00:08:37.0040 3200	umbus - ok
00:08:37.0068 3200	upnphost        (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
00:08:37.0121 3200	upnphost - ok
00:08:37.0160 3200	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
00:08:37.0217 3200	usbccgp - ok
00:08:37.0246 3200	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
00:08:37.0310 3200	usbcir - ok
00:08:37.0327 3200	usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
00:08:37.0387 3200	usbehci - ok
00:08:37.0421 3200	usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
00:08:37.0486 3200	usbhub - ok
00:08:37.0510 3200	usbohci         (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
00:08:37.0585 3200	usbohci - ok
00:08:37.0607 3200	usbprint        (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
00:08:37.0671 3200	usbprint - ok
00:08:37.0708 3200	usbscan         (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
00:08:37.0748 3200	usbscan - ok
00:08:37.0777 3200	USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
00:08:37.0819 3200	USBSTOR - ok
00:08:37.0831 3200	usbuhci         (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
00:08:37.0886 3200	usbuhci - ok
00:08:37.0928 3200	usbvideo        (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys
00:08:38.0004 3200	usbvideo - ok
00:08:38.0026 3200	UxSms           (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
00:08:38.0086 3200	UxSms - ok
00:08:38.0125 3200	vds             (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
00:08:38.0213 3200	vds - ok
00:08:38.0243 3200	vga             (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys
00:08:38.0327 3200	vga - ok
00:08:38.0351 3200	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
00:08:38.0429 3200	VgaSave - ok
00:08:38.0450 3200	viaagp          (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys
00:08:38.0492 3200	viaagp - ok
00:08:38.0510 3200	ViaC7           (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys
00:08:38.0561 3200	ViaC7 - ok
00:08:38.0590 3200	viaide          (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys
00:08:38.0627 3200	viaide - ok
00:08:38.0649 3200	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
00:08:38.0684 3200	volmgr - ok
00:08:38.0725 3200	volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
00:08:38.0770 3200	volmgrx - ok
00:08:38.0791 3200	volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
00:08:38.0837 3200	volsnap - ok
00:08:38.0869 3200	vsmraid         (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys
00:08:38.0907 3200	vsmraid - ok
00:08:38.0999 3200	VSS             (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
00:08:39.0231 3200	VSS - ok
00:08:39.0294 3200	W32Time         (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
00:08:39.0367 3200	W32Time - ok
00:08:39.0439 3200	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
00:08:39.0502 3200	WacomPen - ok
00:08:39.0525 3200	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
00:08:39.0569 3200	Wanarp - ok
00:08:39.0573 3200	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
00:08:39.0618 3200	Wanarpv6 - ok
00:08:39.0655 3200	wcncsvc         (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
00:08:39.0756 3200	wcncsvc - ok
00:08:39.0798 3200	WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
00:08:39.0842 3200	WcsPlugInService - ok
00:08:39.0864 3200	Wd              (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys
00:08:39.0900 3200	Wd - ok
00:08:39.0954 3200	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
00:08:40.0019 3200	Wdf01000 - ok
00:08:40.0048 3200	WdiServiceHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
00:08:40.0118 3200	WdiServiceHost - ok
00:08:40.0125 3200	WdiSystemHost   (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
00:08:40.0178 3200	WdiSystemHost - ok
00:08:40.0214 3200	WebClient       (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
00:08:40.0281 3200	WebClient - ok
00:08:40.0316 3200	Wecsvc          (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
00:08:40.0356 3200	Wecsvc - ok
00:08:40.0367 3200	wercplsupport   (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
00:08:40.0436 3200	wercplsupport - ok
00:08:40.0461 3200	WerSvc          (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
00:08:40.0507 3200	WerSvc - ok
00:08:40.0513 3200	WinHttpAutoProxySvc - ok
00:08:40.0572 3200	Winmgmt         (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
00:08:40.0619 3200	Winmgmt - ok
00:08:40.0723 3200	WinRM           (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
00:08:40.0842 3200	WinRM - ok
00:08:40.0912 3200	Wlansvc         (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
00:08:41.0056 3200	Wlansvc - ok
00:08:41.0158 3200	wlcrasvc        (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
00:08:41.0194 3200	wlcrasvc - ok
00:08:41.0360 3200	wlidsvc         (fb01d4ae207b9efdbabfc55dc95c7e31) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
00:08:41.0688 3200	wlidsvc - ok
00:08:41.0833 3200	WmiAcpi         (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys
00:08:41.0894 3200	WmiAcpi - ok
00:08:41.0952 3200	wmiApSrv        (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
00:08:42.0087 3200	wmiApSrv - ok
00:08:42.0211 3200	WMPNetworkSvc   (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
00:08:42.0360 3200	WMPNetworkSvc - ok
00:08:42.0412 3200	WPCSvc          (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
00:08:42.0465 3200	WPCSvc - ok
00:08:42.0534 3200	WPDBusEnum      (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
00:08:42.0570 3200	WPDBusEnum - ok
00:08:42.0641 3200	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
00:08:42.0705 3200	ws2ifsl - ok
00:08:42.0710 3200	WSearch - ok
00:08:42.0754 3200	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
00:08:42.0806 3200	WUDFRd - ok
00:08:42.0827 3200	wudfsvc         (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
00:08:42.0872 3200	wudfsvc - ok
00:08:42.0897 3200	MBR (0x1B8)     (32a32adbc7112bd07d2546d035932152) \Device\Harddisk0\DR0
00:08:45.0718 3200	\Device\Harddisk0\DR0 - ok
00:08:45.0722 3200	Boot (0x1200)   (9483522406c535821c051db078e57717) \Device\Harddisk0\DR0\Partition0
00:08:45.0724 3200	\Device\Harddisk0\DR0\Partition0 - ok
00:08:45.0725 3200	============================================================
00:08:45.0725 3200	Scan finished
00:08:45.0725 3200	============================================================
00:08:45.0738 5308	Detected object count: 4
00:08:45.0738 5308	Actual detected object count: 4
00:09:57.0380 5308	ezSharedSvc ( UnsignedFile.Multi.Generic ) - skipped by user
00:09:57.0380 5308	ezSharedSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip 
00:09:57.0381 5308	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
00:09:57.0381 5308	FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 
00:09:57.0381 5308	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
00:09:57.0381 5308	Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
00:09:57.0381 5308	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
00:09:57.0382 5308	Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Utilisateur anonyme · Answer

Re

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
Ou ici : https://forospyware.com 
>Renomme le pour l'enregistrer sur ton bureau en  asdehi (tout simplement pour que l'infection ne le contre pas)
-> Double clique combofix.exe.(ou clic droit sous vista «  exécuter en tant que... » )
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

 Avant d'utiliser ComboFix :  

->  Déconnecte toi d'Internet et referme les fenêtres de tous les programmes en cours.  

->  Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe ; (ou clic droit sous vista « exécuter en tant que... »)

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 


- Installe le console de récupération comme demandé ;utile en cas de plantage

- Attention Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programme. Risque de figer l'ordinateur 

- En fin de scan il est possible que ComboFix ait besoin de redémarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. 

/!\  Ne touche à rien tant que le scan n'est pas terminé.  /!\ : risque de figer l'ordinateur (plantage complet) 


::Si combofix détecte quelque chose et de demande a redémarrer tu acceptes


@+

cindy07 · Answer

Voilà le rapport:

ComboFix 12-07-27.03 - Cindy 29/07/2012   0:43.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6002.2.1252.33.1036.18.2972.1752 [GMT 2:00]
Lancé depuis: c:\users\Cindy\Desktop\asdehi.exe
AV: Pack Sécurité SFR 9.12 *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: Pack Sécurité SFR 9.12 *Enabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: Pack Sécurité SFR 9.12 *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée 
Copie restaurée à partir de - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe 
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-06-28 au 2012-07-28  ))))))))))))))))))))))))))))))))))))
.
.
2012-07-28 22:52 . 2012-07-28 22:52	--------	d-----w-	c:\users\Invité\AppData\Local	emp
2012-07-28 22:52 . 2012-07-28 22:52	--------	d-----w-	c:\users\Default\AppData\Local	emp
2012-07-28 22:52 . 2012-07-28 22:52	--------	d-----w-	c:\users\Cindy_2\AppData\Local	emp
2012-07-28 18:06 . 2001-10-28 14:42	116224	----a-w-	c:\windows\system32\pdfcmnnt.dll
2012-07-28 18:06 . 1998-06-23 22:00	137000	----a-w-	c:\windows\system32\MSMAPI32.OCX
2012-07-28 18:06 . 1998-07-12 23:08	119568	----a-w-	c:\windows\system32\VB6FR.DLL
2012-07-28 18:06 . 1998-07-12 23:08	59904	----a-w-	c:\windows\system32\MSCC2FR.DLL
2012-07-28 18:06 . 1998-07-12 23:08	141312	----a-w-	c:\windows\system32\MSCMCFR.DLL
2012-07-28 18:06 . 1998-07-05 22:00	23552	----a-w-	c:\windows\system32\MSMPIDE.DLL
2012-07-28 18:06 . 2012-07-28 18:07	--------	d-----w-	c:\program files\PDFCreator
2012-07-28 17:12 . 2012-07-28 17:12	--------	d-sh--w-	c:\windows\system32\%APPDATA%
2012-07-28 17:09 . 2012-07-28 19:02	--------	d-----w-	c:\programdata\036DFF8500483E6786ABFA152F3B707C
2012-07-26 13:02 . 2012-07-26 13:02	--------	d-----w-	c:\programdata\TmForever
2012-07-26 12:58 . 2012-07-27 19:05	--------	d-----w-	c:\program files\TmNationsForever
2012-07-13 18:19 . 2012-06-13 13:40	2047488	----a-w-	c:\windows\system32\win32k.sys
2012-07-13 17:25 . 2012-06-02 09:08	140920	----a-w-	c:\program files\Internet Explorer\sqmapi.dll
2012-07-13 17:25 . 2012-06-02 08:22	194560	----a-w-	c:\program files\Internet Explorer\ieproxy.dll
2012-07-13 17:25 . 2012-06-02 08:16	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-07-13 17:25 . 2012-06-02 08:25	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-07-13 17:25 . 2012-06-02 08:21	194048	----a-w-	c:\program files\Internet Explorer\IEShims.dll
2012-07-13 17:25 . 2012-06-02 08:20	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-07-13 17:24 . 2012-06-02 09:08	748664	----a-w-	c:\program files\Internet Explorer\iexplore.exe
2012-07-13 17:24 . 2012-06-02 08:33	1800192	----a-w-	c:\windows\system32\jscript9.dll
2012-07-13 17:24 . 2012-06-02 08:27	678912	----a-w-	c:\program files\Internet Explorer\iedvtool.dll
2012-07-13 17:24 . 2012-06-02 08:26	387584	----a-w-	c:\program files\Internet Explorer\jsdbgui.dll
2012-07-13 17:24 . 2012-06-02 08:25	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-07-12 18:13 . 2012-06-05 16:47	708608	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2012-07-12 18:12 . 2012-06-05 16:47	1401856	----a-w-	c:\windows\system32\msxml6.dll
2012-07-12 18:12 . 2012-06-05 16:47	1248768	----a-w-	c:\windows\system32\msxml3.dll
2012-07-12 18:11 . 2012-06-04 15:26	440704	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-07-12 18:11 . 2012-06-02 00:03	204288	----a-w-	c:\windows\system32
crypt.dll
2012-07-12 18:11 . 2012-06-02 00:04	278528	----a-w-	c:\windows\system32\schannel.dll
2012-07-03 19:01 . 2010-06-02 02:55	74072	----a-w-	c:\windows\system32\XAPOFX1_5.dll
2012-07-03 19:01 . 2010-06-02 02:55	527192	----a-w-	c:\windows\system32\XAudio2_7.dll
2012-07-03 19:01 . 2010-05-26 09:41	1998168	----a-w-	c:\windows\system32\D3DX9_43.dll
2012-07-03 18:59 . 2012-07-03 19:00	--------	d-----w-	c:\windows\system32\AGEIA
2012-07-03 18:59 . 2012-07-03 19:00	--------	d-----w-	c:\program files\AGEIA Technologies
2012-07-03 18:58 . 2012-07-03 18:58	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2012-07-03 18:57 . 2012-07-21 20:13	--------	d-----w-	c:\program files\Agrar Simulator 2011
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 11:46 . 2012-04-07 10:44	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-06-29 08:44 . 2012-07-27 12:49	6891424	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{00AD1A72-647A-4A54-A012-E13010F90058}\mpengine.dll
2012-06-02 22:19 . 2012-06-24 09:35	53784	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-24 09:35	45080	----a-w-	c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-24 09:34	35864	----a-w-	c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-24 09:34	577048	----a-w-	c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-24 09:35	1933848	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-24 09:35	2422272	----a-w-	c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-24 09:34	88576	----a-w-	c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-24 09:34	171904	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-02 13:12 . 2012-06-24 09:34	33792	----a-w-	c:\windows\system32\wuapp.exe
2012-05-31 10:25 . 2010-02-20 13:05	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-05-09 15:21 . 2010-10-07 11:43	44184	----a-w-	c:\windows\system32\drivers\fsbts.sys
2012-05-01 14:03 . 2012-06-14 15:53	180736	----a-w-	c:\windows\system32\driversdpwd.sys
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}]
2011-06-10 06:24	165256	----a-w-	c:\program files\SFR\Kit\SFRNavErrorHelper.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmpcSys"="c:\program files\PACKARD BELL\SetUpMyPC\SmpSys.exe" [2008-07-07 1038136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2011-06-10 959880]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-04 6265376]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512]
"SmpcSys"="c:\program files\Packard Bell\SetupMyPC\SmpSys.exe" [2008-07-07 1038136]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"Skytel"="Skytel.exe" [2008-08-04 1833504]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"F-Secure Manager"="c:\program files\SFR\Pack Sécurité\Common\FSM32.EXE" [2009-11-18 201128]
"F-Secure TNB"="c:\program files\SFR\Pack Sécurité\FSGUI\TNBUtil.exe" [2011-08-23 1655464]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\users\Cindy_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
c:\users\Cindy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 15:32]
.
2012-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 15:32]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\SFR\Pack Se9,curite9,\FSPS\program\FSLSP.DLL
TCP: DhcpNameServer = 192.168.1.1
DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/3.0.1.0/GarminAxControl.CAB
DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - hxxps://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
FF - ProfilePath - c:\users\Cindy\AppData\Roaming\Mozilla\Firefox\Profiles\534sg3tj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ver-filmes.com/
FF - prefs.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsgk32st.exe
c:\program files\SFR\Pack Sécurité\Common\FSMA32.EXE
c:\program files\SFR\Pack Sécurité\Anti-Virus\FSGK32.EXE
c:\program files\SFR\Pack Sécurité\Common\FSHDLL32.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Spybot - Search & Destroy\SDWinSec.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\SFR\Pack Sécurité\FWES\Program\fsdfwd.exe
c:\program files\SFR\Pack Sécurité\ORSP Client\fsorsp.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fssm32.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\SFR\Pack Sécurité\Anti-Virus\fsav32.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\windows\ehome\ehmsas.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\program files\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2012-07-29  01:02:45 - La machine a redémarré
ComboFix-quarantined-files.txt  2012-07-28 23:01
.
Avant-CF: 295 047 032 832 octets libres
Après-CF: 296 935 124 992 octets libres
.
- - End Of File - - 971F24AFD744CA37C71ABA0951614565

Ca a l'air bon désormais nan?

Utilisateur anonyme · Answer

Re

Pour vérification, fait ceci stp

Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Ou

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

Serveur N°2

Ou

http://www.premiumorange.com/zeb-help-process/zhpdiag.html 
en bas de la page ZHP avec un numéro de version.
 
Une fois le téléchargement achevé, dé zippe le fichier obtenu et place ZHPDiag.exe sur ton Bureau.

Double-clique sur l'icône pour lancer le programme. Sous Vista ou Seven clic droit «  exécuter en tant que administrateur »


Clique sur  la loupe   pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long. 

Ferme ZHPDiag en fin d'analyse. 


Pour transmettre le rapport clique sur ce lien : 

 
http://pjjoint.malekal.com/

https://www.cjoint.com/

Regarde sur le bureau
 
Sélectionne le fichier ZHPDiag.txt. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.fr/cjlink.php?file=cj200905/cijSKAP5fU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

Merci

@+

cindy07 · Answer

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20120729_k6g7x12g5e5

Utilisateur anonyme · Answer

Re

Pour vérifier les mises à jour logiciels à appliquer sur ton PC
https://www.flexera.com/products/operations/software-vulnerability-management.html
Divers liens te seront proposés pour les logiciels non à jour.


@+

cindy07 · Answer

J'en prends note. Merci beaucoup pour l'aide!
Bonne soirée

Virus Live security platinum

9 réponses

Discussions similaires

Newsletters